California Leads on Reproductive and Trans Health Data Privacy

In the wake of the Supreme Court’s Dobbs decision, anti-choice sheriffs and bounty hunters will try to investigate and punish abortion seekers based on their internet browsing, private messaging, and phone app location data. We can expect similar tactics from state officials who claim that parents who allow their transgender youth to receive gender-affirming health care should be investigated for child abuse.

So it is great news that California Gov. Gavin Newsom just signed three bills that will help meet these threats: A.B. 1242, authored by Asm. Rebecca Bauer-Kahan; A.B. 2091, authored by Asm. Mia Bonta; and S.B. 107, authored by Sen. Scott Wiener. EFF supported all three bills.

This post summarizes the new California data privacy safeguards and provides a breakdown of the specific places where they change California state law. For those interested, we have included the citations to these changes. These three new laws limit how California courts, government agencies, health care providers, and businesses handle this data. Some provisions create new exemptions from existing disclosure mandates; others create new limits on disclosure.

EFF encourages other states to consider passing similar bills adapted to their own state civil and criminal laws.

New Reproductive and Trans Health Data Exemptions from Old Disclosure Mandates

Law enforcement agencies and private litigants often seek evidence located in other states. In response, many states have enacted various laws that require in-state entities to share data with out-of-state entities. Now that anti-choice states are criminalizing more and more abortions, pro-choice states should create abortion exceptions from these sharing mandates. Likewise, now that anti-trans states are claiming that gender-affirming care for trans youth is child abuse, pro-trans states should create trans health care exceptions from these sharing mandates. California’s new laws do this in three ways.

First, an existing California law provides that California-based providers of electronic communication and remote computing services, upon receipt of an out-of-state warrant, must treat it like an in-state warrant. A.B. 1242 creates an abortion exemption. A provider cannot produce records if it “knows or should know” that the investigation concerns a “prohibited violation.” (See Sec. 8, at Penal Code 1524.2(c)(1)) A “prohibited violation” is an abortion that would be legal in California but is illegal elsewhere. (See Sec. 2, at Penal Code 629.51(5)) Further, warrants must attest that the investigation does not involve a prohibited violation. (See Sec. 8, at Penal Code 1524.2(c)(2))

Second, an existing California law requires state courts to assist in enforcing out-of-state judicial orders. This is California’s version of the Uniform Law Commission’s (ULC’s) Interstate Depositions and Discovery Act. It requires California court clerks to issue subpoenas on request of litigants that have a subpoena from an out-of-state judge. California lawyers may issue subpoenas in such circumstances, too.

A.B. 2091 and S.B. 107 create new abortion and transgender health exemptions to this existing law:

• California clerks and lawyers shall not issue a subpoena based on an out-of-state subpoena, if it relates to a “foreign penal civil action” and seeks information about “sensitive services.” (See A.B. 2091, Sec. 4.5, at Code Civ. Pro. 2029.300(e)(2); A.B. 2091, Sec. 5.5, at Code Civ. Pro. 2029.350(c); S.B. 107, Sec. 2.5, at Code Civ. Pro. 2029.300(e)(2); S.B. 107, Sec. 3.5, at Code Civ. Pro. 2029. 350(c)) A “foreign penal civil action” is an out-of-state suit “to punish an offense against the public justice of that state.” (See Sec. 3, at Code of Civ. Pro. 2029.200(b)) “Sensitive services” include sexual health care and gender-affirming health care.
• California clerks and lawyers also shall not issue a subpoena based on an out-of-state subpoena, if it is based on laws that interfere with a person’s right to allow a transgender child to receive gendering-affirming health care. (See A.B. 2091, Sec. 4.5, at Code Civ. Pro. 2029.300(e)(1); A.B. 2091, Sec. 5.5, at Code Civ. Pro. 2029.350(b); S.B. 107, Sec. 2.5, at Code Civ. Pro. 2029.300(e)(1); S.B. 107, Sec. 3.5, at Code Civ. Pro. 2029.350(b))

Third, an existing California law requires health care providers to disclose certain kinds of medical information to certain kinds of entities. A.B. 2091 and S.B. 107 create new abortion and transgender health exemptions to this existing law:

• Providers cannot release medical information about abortion to law enforcement, or in response to a subpoena, based on either an out-of-state law that interferes with California abortion rights, or a foreign penal civil action. (See A.B. 2091, Sec. 2, at Civil Code 56.108)
• Providers also cannot release medical information about a person allowing a child to receive gender-affirming care, in response to an out-of-state criminal or civil action against such a person. (See S.B. 107, Sec. 1, at Civil Code 56.109; Sec. 10, at Penal Code 1326(c))

All of these new exemptions from old sharing mandates are important steps forward. But that’s not all these three new California bills do.

New Limits on California Judges

 To protect the privacy of people seeking reproductive health care, these new laws limit the power of California courts to authorize or compel the disclosure of reproductive health data.

First, A.B. 1242 prohibits California judges from authorizing certain forms of digital surveillance, if conducted for purposes of investigating abortions that are legal in California. These are:

• Interception of wire or electronic communications. (See Sec. 3, at Penal Code 629.52(e)) Interception captures communications content, such as the words of an email.
• A pen register or trap and trace device. (See Sec. 5, at Penal Code 638.52(m)) These devices capture communications metadata, such as who called whom and when.
• A warrant for any item. (See Sec. 7, at Penal Code 1524(h)) This would include digital devices that contain evidence of an abortion, such as a calendar entry.

Second, A.B. 1242 prohibits California judges and court clerks from issuing subpoenas connected to out-of-state proceedings about an individual performing, supporting, aiding, or obtaining a lawful abortion in California. (See Sec. 11, at Penal Code 13778.2(c)(2))

Third, A.B. 2091 bars state and local courts from compelling a person to identify, or provide information about, a person who obtained an abortion, if the inquiry is based on either an out-of-state law that interferes with abortion rights, or a foreign penal civil action. This safeguard also applies in administrative, legislative, and other government proceedings. (See Sec. 6, at Health Code 123466(b))

New Limits on California Government Agencies

Government agencies can also be the source of information regarding reproductive and transgender health care. For example, police might be able to identify who traveled to a health care facility, and government facilities can identify who received what care. So the bills create two new limits on disclosure of health care data by California government agencies.

First, A.B. 1242 and S.B. 107 bar all state and local government agencies in California, and their employees, from providing information to any individual or out-of-state agency regarding:

• An abortion that is lawful in California. (See A.B. 1242, Sec. 11, at Penal Code 13778.2(b))
• Provision of gender-affirming health care. (See S.B. 107, Sec. 9, at Penal Code 819(c))

Third, A.B. 2091 bars prison staff from disclosing medical information about an incarcerated person’s abortion, if the request is based on either an out-of-state law that interferes with California abortion rights, or a foreign penal civil action. (See Sec. 8, at Penal Code 3408(r))

New Limit on California Communication Services

Finally, A.B. 1242 provides a new safeguard to protect people from disclosure requests made to a type of company that holds their information. These are California corporations, and corporations with principal offices in California, that provide electronic communication services. They shall not, in California, provide “records, information, facilities, or assistance” in response to out-of-state legal process (such as a warrant or other court order) related to a prohibited violation. (See Sec. 9, at Penal Code 1546.5(a)) The California Attorney General may enforce this rule. (See Sec. 9, at Penal Code 1546.5(b)) However, covered corporations are not subject to any cause of action for providing such assistance in response to such legal process, unless the corporation “knew or should have known” that the legal process related to a prohibited violation. (See Sec. 9, at Penal Code 1546.5(c))

Next Steps

These three new California laws—A.B. 1242, A.B. 2091, and S.B. 107—are strong protections of reproductive and transgender health data privacy. Other pro-choice and pro-trans states should enact similar laws.

More work remains in California. After these important new laws go into effect, we can expect anti-choice sheriffs and bounty hunters to continue seeking abortion-related data located in the Golden State. So will out-of-state officials seeking to punish parents who allow their kids to get gender-affirming health care. California policymakers must be vigilant, and enact new laws as needed. For example, an existing California law, based on another ULC model, authorizes state courts to command a resident to travel out-of-state to testify in a criminal proceeding. This law may also need an exemption for abortion-related and trans-related information. California officials should also work with companies to identify efforts by anti-choice and anti-trans states to circumvent these new protections and use every tool at their disposal to respond.