Bill Summary
The **Genomic Data Protection Act** is legislation aimed at safeguarding consumer rights regarding their genomic data held by direct-to-consumer genomic testing companies. It establishes several key provisions:
1. **Consumer Controls**: The Act mandates that genomic testing companies provide an easy mechanism for consumers to access, delete their accounts, and destroy their biological samples. This mechanism must be clearly communicated to consumers.
2. **Notification Requirements**: Companies must inform consumers about their rights regarding genomic data and any deidentified data that might be used for research. Additionally, if a company is acquired, consumers must be notified about how their rights will be affected under the new ownership.
3. **Request Processing**: Companies are required to process consumer requests to delete genomic data or biological samples within 30 days and inform consumers once the action has been completed. If a company is sold during this period, the new owners must still comply with these requests.
4. **Exceptions**: There are certain conditions under which companies can deny deletion requests, such as when information is required for legal reasons or regulatory compliance.
5. **Enforcement**: The Federal Trade Commission (FTC) is given the authority to enforce the provisions of this Act, treating violations as unfair or deceptive practices under existing laws.
6. **Definitions**: The Act provides clear definitions for terms like "genomic data," "biological sample," and "direct-to-consumer genomic testing company," ensuring clarity in its application.
7. **Legal Relationship**: The Act preserves existing federal and state laws, ensuring it does not override other legal protections unless there is a direct conflict.
Overall, the Genomic Data Protection Act enhances consumer autonomy over genomic data, ensuring privacy and security in the face of growing genomic testing services.
Possible Impacts
Here are three examples of how the **Genomic Data Protection Act** could affect people:
1. **Enhanced Control Over Personal Data**:
Consumers will have the right to delete their genomic data and request the destruction of any associated biological samples. This means individuals can take control of their genetic information, ensuring that it is not stored or misused by genomic testing companies after they no longer wish to be associated with the service. For instance, a person who undergoes genetic testing and later changes their mind about sharing that information can effectively remove it from the company’s records.
2. **Informed Decision-Making**:
The Act requires genomic testing companies to provide consumers with clear notifications about their rights regarding genomic data, including how it may be shared for research. This transparency empowers consumers to make informed choices about participating in genomic testing and whether they want their data to be utilized in research. For example, a consumer may decide not to proceed with a test if they are not comfortable with how their data might be used.
3. **Consumer Protection and Legal Recourse**:
The enforcement provisions of the Act grant the Federal Trade Commission (FTC) the authority to treat violations of consumer rights regarding genomic data as unfair or deceptive practices. This means consumers have a legal framework to pursue action against companies that fail to comply with the law, providing an avenue for accountability. For example, if a company does not fulfill a consumer's request to delete their genomic data, the consumer can report this to the FTC and seek legal recourse.
[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 863 Introduced in Senate (IS)]
<DOC>
119th CONGRESS
1st Session
S. 863
To provide consumers with the right to delete their genomic data, and
for other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
March 5, 2025
Mr. Cassidy (for himself and Mr. Peters) introduced the following bill;
which was read twice and referred to the Committee on Commerce,
Science, and Transportation
_______________________________________________________________________
A BILL
To provide consumers with the right to delete their genomic data, and
for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Genomic Data Protection Act''.
SEC. 2. CONSUMER RIGHTS REGARDING PRIVACY OF GENOMIC DATA.
(a) Requirements.--
(1) Consumer controls.--
(A) In general.--A direct-to-consumer genomic
testing company shall provide a simple and effective
mechanism to allow a consumer to--
(i) access the genomic data of the
consumer; and
(ii) subject to paragraph (4)--
(I) delete the account of the
consumer, including any genomic data
associated with such account; and
(II) request the destruction of any
biological sample of the consumer.
(B) Required mechanism.--The direct-to-consumer
genomic testing company shall make available to a
consumer the mechanism described in subparagraph (A)
through the primary means by which the company
communicates with the consumer.
(2) Notification.--
(A) Consumer controls and use of deidentified
genomic data.--A direct-to-consumer genomic testing
company shall make available, in a clear and
conspicuous, not misleading, and easy-to-read manner a
notice that--
(i) provides a detailed and accurate
representation of the rights set forth in
clauses (i) and (ii) of paragraph (1)(A); and
(ii) discloses that the deidentified
genomic data of a consumer may be shared or
disclosed to conduct medical or scientific
research, consistent with the privacy
regulations promulgated under section 264(c) of
the Health Insurance Portability and
Accountability Act of 1996 (42 U.S.C. 1320d-2
note).
(B) Purchase of company.--In the event that a
direct-to-consumer genomic testing company is purchased
or otherwise acquired by another entity, the direct-to-
consumer genomic testing company shall send to each
consumer, not fewer than 30 days prior to the date on
which the purchase or acquisition is complete, a notice
that includes--
(i) the identity of the entity purchasing
or otherwise acquiring the company; and
(ii) a detailed and accurate representation
of the how a consumer can exercise the rights
set forth in clauses (i) and (ii) of paragraph
(1)(A) under the new ownership.
(3) Processing of deletion or destruction requests.--
(A) In general.--With respect to a consumer's
request to delete the genomic data or to destroy the
biological sample of the consumer, a direct-to-consumer
genomic testing company shall--
(i) fulfill such request not later than 30
days after the date on which the consumer makes
such request; and
(ii) notify the consumer of such deletion
or destruction not later than 30 days after the
deletion or destruction.
(B) Outstanding requests during purchase of
company.--In the event that a direct-to-consumer
genomic testing company is purchased or otherwise
acquired by another entity while a consumer's request
to delete the genomic data or to destroy the biological
sample of the consumer is outstanding--
(i) the entity that is purchasing or
otherwise acquiring the company shall comply
with the requirements described in subparagraph
(A); and
(ii) the 30-day period to fulfill such
request shall begin on the date on which the
consumer makes such request to the direct-to-
consumer genomic testing company.
(4) Exceptions.--A direct-to-consumer genomic testing
company shall not permit a consumer to exercise a right
described in paragraph (1)(A)(ii) if the company determines
that the exercise of the right would require the deletion of
information--
(A) subject to a warrant, lawfully executed
subpoena, or other court order; or
(B) the company is required to retain in order to
comply with any other applicable legal or regulatory
requirement.
(b) Enforcement.--
(1) Unfair or deceptive acts or practices.--A violation of
this section or a regulation promulgated thereunder shall be
treated as a violation of a rule defining an unfair or
deceptive act or practice under section 18(a)(1)(B) of the
Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
(2) Powers of the commission.--
(A) In general.--The Commission shall enforce this
section in the same manner, by the same means, and with
the same jurisdiction, powers, and duties as though all
applicable terms and provisions of the Federal Trade
Commission Act (15 U.S.C. 41 et seq.) were incorporated
into and made a part of this section.
(B) Privileges and immunities.--Any person who
violates this section or a regulation promulgated
thereunder shall be subject to the penalties and
entitled to the privileges and immunities provided in
the Federal Trade Commission Act (15 U.S.C. 41 et
seq.).
(C) Authority preserved.--Nothing in this section
shall be construed to limit the authority of the
Commission under any other provision of law.
(D) Rulemaking.--Not later than 1 year after the
date of enactment of this section, the Commission may
promulgate in accordance with section 553 of title 5,
United States Code, such rules as may be necessary to
carry out this section.
(c) Definitions.--In this section:
(1) Biological sample.--The term ``biological sample''
means any material part of the human, discharge therefrom, or
derivative thereof, such as tissue, blood, urine, or saliva,
known to contain deoxyribonucleic acid (DNA).
(2) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(3) Consumer.--The term ``consumer'' means an individual
who provides a biological sample to a direct-to-consumer
genomic testing company.
(4) Deidentified genomic data.--The term ``deidentified
genomic data'' means data that cannot be used to infer
information about, or otherwise be linked to, a particular
individual, provided that the business that possesses the
information does all of the following:
(A) Takes reasonable measures to ensure that the
information cannot be associated with a particular
individual.
(B) Publicly commits to maintain and use the
information only in deidentified form and not to
attempt to reidentify the information, except that the
business may attempt to reidentify the information
solely for the purpose of determining whether its
deidentification processes satisfy the requirements of
this subparagraph, provided that the business does not
use or disclose any information reidentified in this
process and destroys the reidentified information upon
completion of that assessment.
(C) Contractually obligates any recipients of the
information to take reasonable measures to ensure that
the information cannot be associated with a particular
individual and to commit to maintaining and using the
information only in deidentified form and not to
reidentify the information.
(5) Direct-to-consumer genomic testing company.--
(A) In general.--The term ``direct-to-consumer
genomic testing company'' means a person that does any
of the following:
(i) Manufactures or develops genomic
testing products or services for sale directly
to consumers.
(ii) Analyzes or interprets genomic data
obtained from a consumer.
(iii) Collects, uses, maintains, or
discloses genomic data collected or derived
from a direct-to-consumer genomic testing
product or service.
(iv) Purchases or acquires genomic data
from a direct-to-consumer genomic testing
company.
(B) Exclusion for health care professionals.--The
term ``direct-to-consumer genomic testing company''
shall not include a health care professional (as
defined in section 225 of the Public Health Service Act
(42 U.S.C. 234)) that performs an action described in
subparagraph (A) for purposes of diagnosis or treatment
of a medical condition.
(6) Genomic data.--
(A) In general.--The term ``genomic data''--
(i) means any data, regardless of its
format or whether the data has been
deidentified, that results from the analysis of
a biological sample from a consumer and
concerns genomic material; and
(ii) includes--
(I) deoxyribonucleic acids (DNA),
ribonucleic acids (RNA), genes,
chromosomes, alleles, genomes,
alterations or modifications to DNA or
RNA, and single nucleotide
polymorphisms (SNPs);
(II) uninterpreted data that
results from the analysis of the
biological sample; or
(III) any information extrapolated,
derived, or inferred therefrom.
(B) Exclusion of deidentified genomic data.--The
term ``genomic data'' shall not include the
deidentified genomic data of a consumer to the extent
that such data is used to conduct medical or scientific
research, consistent with the privacy regulations
promulgated under section 264(c) of the Health
Insurance Portability and Accountability Act of 1996
(42 U.S.C. 1320d-2 note).
(7) Genomic testing product or service.--The term ``genomic
testing product or service'' means any testing product or
service that analyzes or interprets the genomic data or
biological sample of a consumer.
(d) Relationship to Federal and State Laws.--
(1) Federal law preservation.--Nothing in this Act, or a
regulation promulgated under this Act, shall be construed to
limit any other provision of Federal law, except as
specifically provided in this Act.
(2) State law preservation.--Nothing in this Act, or a
regulation promulgated under this Act, shall be construed to
preempt, displace, or supplant any State law, except to the
extent that a provision of State law conflicts with a provision
of this Act, or a regulation promulgated under this Act, and
then only to the extent of the conflict.
<all>