Genomic Data Protection Act

A direct-to-consumer genomic testing company shall develop procedures and provide an effective mechanism (including an option that is through the primary medium by which the company communicates with the consumer) to allow a consumer to—

(A) access the genomic data of the consumer; and

(B) subject to paragraph (4)—

(i) delete the account of the consumer, including any genomic data associated with such account; and

(ii) request the destruction of any biological sample of the consumer.

A direct-to-consumer genomic testing company shall make available, in a clear and conspicuous, not misleading, and easy-to-read manner a notice that—

(i) provides a detailed and accurate representation of the rights set forth in subparagraphs (A) and (B) of paragraph (1); and

(ii) discloses that the deidentified genomic data of a consumer may be shared or disclosed to conduct medical or scientific research, consistent with the privacy regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d–2 note).

In the event that a direct-to-consumer genomic testing company (or the genomic data of such company) is purchased or otherwise acquired by another entity, the direct-to-consumer genomic testing company shall send to each consumer, not fewer than 30 days prior to the date on which the purchase or acquisition is complete, a notice that includes—

(i) the identity of the entity purchasing or otherwise acquiring the company; and

(ii) a detailed and accurate representation of the rights set forth in subparagraphs (A) and (B) of paragraph (1).

With respect to a consumer's request to delete the genomic data or to destroy the biological sample of the consumer, a direct-to-consumer genomic testing company shall—

(A) fulfill such request not later than 30 days after the date on which the consumer makes such request; and

(B) notify the consumer of such deletion or destruction not later than 30 days after the deletion or destruction.

A direct-to-consumer genomic testing company shall not permit a consumer to exercise a right described in paragraph (1)(B) if the company determines that the exercise of the right would require the deletion of information—

(A) subject to a warrant, lawfully executed subpoena, or other court order; or

(B) the company is required to retain in order to comply with any other applicable legal or regulatory requirement.

A violation of this section or a regulation promulgated thereunder shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

The Commission shall enforce this section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this section.

Any person who violates this section or a regulation promulgated thereunder shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

Nothing in this section shall be construed to limit the authority of the Commission under any other provision of law.

Not later than 1 year after the date of enactment of this section, the Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this section.

In this section:

The term biological sample means any material part of the human, discharge therefrom, or derivative thereof, such as tissue, blood, urine, or saliva, known to contain deoxyribonucleic acid (DNA).

The term Commission means the Federal Trade Commission.

The term consumer means an individual that obtains a genomic testing product or service from a direct-to-consumer genomic testing company.

The term direct-to-consumer genomic testing company means a person that does any of the following:

(i) Sells, markets, interprets, analyzes, or otherwise offers genomic testing products or services directly to consumers.

(ii) Analyzes genomic data obtained from a consumer.

(iii) Collects, uses, maintains, or discloses genomic data collected or derived from a direct-to-consumer genomic testing product or service.

(iv) Purchases or acquires genomic data from a direct-to-consumer genomic testing company.

The term direct-to-consumer genomic testing company shall not include a health care professional (as defined in section 225 of the Public Health Service Act (42 U.S.C. 234)) that performs an action described in subparagraph (A) for purposes of diagnosis or treatment of a medical condition.

The term genomic data —

(i) means any data, regardless of its format or whether the data has been deidentified, that results from the analysis of a biological sample from a consumer and concerns genomic material; and

(ii) includes—

(I) deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, and single nucleotide polymorphisms (SNPs);

(II) uninterpreted data that results from the analysis of the biological sample; or

(III) any information extrapolated, derived, or inferred therefrom.

The term genomic data shall not include the deidentified genomic data of a consumer to the extent that such data is used to conduct medical or scientific research, consistent with the privacy regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d–2 note).

The term genomic testing product or service means any testing product or service that analyzes or otherwise uses the genomic data or biological sample of a consumer.

Nothing in this Act, or a regulation promulgated under this Act, shall be construed to limit any other provision of Federal law, except as specifically provided in this Act.

Nothing in this Act, or a regulation promulgated under this Act, shall be construed to preempt, displace, or supplant any State law, except to the extent that a provision of State law conflicts with a provision of this Act, or a regulation promulgated under this Act, and then only to the extent of the conflict.