California leads in reproductive and trans health data privacy


Following the Supreme Court ruling Dobbs decision, anti-choice sheriffs and bounty hunters will attempt to investigate and punish abortion seekers based on their internet browsing, private messaging and phone app location data. We can expect similar tactics from state officials who argue that parents who allow their trans youth to receive gender-affirming health care should be investigated for child abuse. children.

So it’s great news that California Governor Gavin Newsom just signed three bills that will help address these threats: AB 1242, authored by Asm. Rebecca Bauer-Kahan; AB 2091, written by Asm. Mia Bonta; and SB 107, written by Senator Scott Wiener. The EFF supported all three bills.

This article summarizes California’s new data privacy safeguards and provides a breakdown of specific places where they change California state law. For those interested, we have included quotes of these changes. These three new laws limit how California courts, government agencies, healthcare providers and businesses handle this data. Some provisions create new exemptions to existing disclosure warrants; others create new limits on disclosure.

The EFF encourages other states to consider passing similar bills tailored to their own civil and criminal laws.

New exemptions for reproductive and trans health data from old disclosure mandates

Law enforcement agencies and private litigants often seek evidence located in other states. In response, many states have enacted various laws that require state entities to share data with outside entities. Now that anti-choice states are increasingly criminalizing abortions, pro-choice states should create abortion exceptions to these sharing mandates. Likewise, now that anti-trans states claim that gender-affirming care for trans youth is abuse, pro-trans states should create trans healthcare exceptions to these sharing mandates. The new California laws do this in three ways.

First, an existing California law provides that California-based providers of electronic communications and remote computing services, upon receipt of an out-of-state warrant, must treat it as an in-state warrant. AB 1242 creates an abortion waiver. A supplier cannot produce documents if it “knows or ought to know” that the investigation concerns a “prohibited violation”. (See Second. 8, Penal Code 1524.2(c)(1)) A “prohibited violation” is an abortion that would be legal in California but illegal elsewhere. (See Second. 2, Penal Code 629.51(5)) In addition, the warrants must attest that the investigation does not involve a prohibited violation. (See Second. 8, Penal Code 1524.2(c)(2))

Second, an existing California law requires state courts to help enforce out-of-state court orders. This is the California version of the Interstate Depositions and Discovery Act of the Uniform Law Commission (ULC). It requires California court clerks to issue subpoenas at the request of litigants who have a subpoena from an out-of-state judge. California attorneys can also issue subpoenas in such circumstances.

AB 2091 and SB 107 create new exemptions for abortion and transgender health to this existing law:

  • California clerks and attorneys should not issue a subpoena based on an out-of-state subpoena, if it relates to a “foreign criminal civil action” and requests information about “sensitive services.” (See AB 2091, art. 4.5, to the Civil Code. Pro. 2029.300(e)(2); AB 2091, art. 5.5, to the Civil Code. Pro. 2029.350(c); SB 107, s. 2.5, to the Civil Code. Pro. 2029.300(e)(2); SB 107, s. 3.5, to the Civil Code. Pro. 2029. 350(c)) A “foreign criminal civil action” is an action outside the state “to punish an offense against the public justice of that state.” (See Second. 3, to the Civil Code. Pro. 2029.200(b)) “Sensitive services” include sexual health care and gender-affirming health care.
  • California clerks and attorneys also must not issue a subpoena based on an out-of-state subpoena, if it is based on laws that interfere with a person’s right to allow a transgender child to receive gender-affirming health care. (See AB 2091, art. 4.5, to the Civil Code. Pro. 2029.300(e)(1); AB 2091, art. 5.5, to the Civil Code. Pro. 2029.350(b); SB 107, s. 2.5, to the Civil Code. Pro. 2029.300(e)(1); SB 107, s. 3.5, to the Civil Code. Pro. 2029.350(b))

Third, a current California law requires health care providers to disclose certain types of medical information to certain types of entities. AB 2091 and SB 107 create new exemptions for abortion and transgender health to this existing law:

  • Providers may not disclose abortion medical information to law enforcement or in response to a subpoena, based on either an out-of-state law that interferes with the right to abortion in California or a foreign criminal civil action. (See AB 2091, art. 2, to the Civil Code 56.108)
  • Providers also cannot disclose medical information about a person allowing a child to receive gender-affirming care, in response to a criminal or civil action out of state against such person. (See S.B.107, s. 1, to the Civil Code 56.109; Second. 10, Penal Code 1326(c))

All of these new exemptions from the old sharing mandates are significant advances. But that’s not all these three new California bills do.

New limits for California judges

To protect the privacy of people seeking reproductive health care, these new laws limit the power of California courts to authorize or compel the disclosure of reproductive health data.

First, AB 1242 prohibits California judges from authorizing certain forms of digital surveillance, if conducted for the purpose of investigating legal abortions in California. These are:

  • Interception of wired or electronic communications. (See Second. 3, Penal Code 629.52(e)) Interception captures the content of communications, such as the words in an email.
  • A pen register or a trap and trace device. (See Second. 5, Penal Code 638.52(m)) These devices capture communications metadata, such as who called who and when.
  • A warrant for any item. (See Second. 7, to Penal Code 1524(h)) This would include digital devices that contain evidence of an abortion, such as a calendar entry.

Second, AB 1242 prohibits California judges and clerks from issuing subpoenas related to out-of-state proceedings involving a person performing, supporting, assisting, or obtaining a legal abortion in California. (See Second. 11, Penal Code 13778.2(c)(2))

Third, AB 2091 prohibits state and local courts from compelling a person to identify or provide information about a person who obtained an abortion, if the investigation is based on either an interfering out-of-state law with the right to abortion, or on a foreign criminal civil action. This warranty also applies to administrative, legislative and other governmental proceedings. (See Second. 6, health code 123466(b))

New Limits for California Government Agencies

Government agencies can also be the source of information regarding reproductive and transgender health care. For example, the police may be able to identify who visited a health care facility, and government facilities may identify who received what care. Thus, the bills create two new limits on the disclosure of health care data by California government agencies.

First, AB 1242 and SB 107 prohibit all California state and local government agencies, and their employees, from providing information to any outside person or agency regarding:

Third, AB 2091 prohibits prison staff from disclosing medical information about an incarcerated person’s abortion, if the request is based either on an out-of-state law that interferes with California’s abortion rights, or on a foreign civil criminal action. (See Second. 8, Penal Code 3408(r))

New Limit on California Communication Services

Finally, AB 1242 provides a new safeguard to protect individuals from disclosure requests made to any type of business that holds their information. These are California companies and companies headquartered in California that provide electronic communication services. They must not, in California, provide “records, information, facilities, or assistance” in response to any out-of-state legal process (such as a warrant or other court order) related to a violation prohibited. (See Second. 9, Penal Code 1546.5(a)) The California Attorney General may enforce this rule. (See Second. 9, at Penal Code 1546.5(b)) However, Covered Companies are not subject to any cause of action for providing such assistance in response to such legal proceeding, unless Covered Company “knows or ought to have known” than legal proceedings related to a prohibited violation. (See Second. 9, Penal Code 1546.5(c))

Next steps

These three new California laws – AB 1242, AB 2091 and SB 107 – are strong privacy protections for reproductive and transgender health data. Other pro-choice and pro-trans states should pass similar laws.

More work remains in California. After these important new laws take effect, we can expect anti-choice sheriffs and bounty hunters to continue to hunt for abortion-related data located in the Golden State. So will officials outside the state who seek to punish parents who allow their children to seek gender-affirming health care. California policymakers need to be vigilant and enact new laws as needed. For example, an existing California law, based on another ULC model, allows state courts to order a resident to travel out of state to testify in a criminal proceeding. This law may also require an exemption for information related to abortion and trans people. California officials should also work with companies to identify efforts by anti-choice and anti-trans states to circumvent these new protections and use all the tools at their disposal to respond.


Comments are closed.