1.1 A bill for an act
1.2 relating to consumer data protection; requiring direct-to-consumer genetic testing
1.3 companies to provide disclosure notices and obtain consent;proposing coding for
1.4 new law in Minnesota Statutes, chapter 325F.
1.5 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:
1.6 Section 1. [325F.995] GENETIC INFORMATION PRIVACY ACT.
1.7 Subdivision 1.Definitions. (a) For purposes of this section, the following terms have
1.8 the meanings given them.
1.9 (b) "Biological sample" means any material part of a human, discharge from a material
1.10 part of a human, or derivative from a material part of a human, including but not limited to
1.11 tissue, blood, urine, or saliva, that is known to contain deoxyribonucleic acid (DNA).
1.12 (c) "Consumer" means an individual who is a Minnesota resident.
1.13 (d) "Deidentified data" means data that cannot reasonably be used to infer information
1.14 about, or otherwise be linked to, an identifiable consumer and that is subject to:
1.15 (1) administrative and technical measures to ensure the data cannot be associated with
1.16 a particular consumer;
1.17 (2) public commitment by the company to (i) maintain and use data in deidentified form,
1.18 and (ii) not attempt to reidentify the data; and
1.19 (3) legally enforceable contractual obligations that prohibit any recipients of the data
1.20 from attempting to reidentify the data.
2.1 (e) "Direct-to-consumer genetic testing company" or "company" means an entity that:
2.2 (1) offers consumer genetic testing products or services directly to consumers; or (2) collects,
2.3 uses, or analyzes genetic data that was (i) collected via a direct-to-consumer genetic testing
2.4 product or service, and (ii) provided to the company by a consumer. Direct-to-consumer
2.5 genetic testing company does not include an entity that collects, uses, or analyzes genetic
2.6 data or biological samples only in the context of research, as defined in Code of Federal
2.7 Regulations, title 45, section 164.501, that is conducted in a manner that complies with the
2.8 federal policy for the protection of human research subjects under Code of Federal
2.9 Regulations, title 45, part 46; the Good Clinical Practice Guideline issued by the International
2.10 Council for Harmonisation; or the United States Food and Drug Administration Policy for
2.11 the Protection of Human Subjects under Code of Federal Regulations, title 21, parts 50 and
2.12 56.
2.13 (f) "Express consent" means a consumer's affirmative written response to a clear,
2.14 meaningful, and prominent written notice regarding the collection, use, or disclosure of
2.15 genetic data for a specific purpose. Written notices and responses may be presented and
2.16 captured electronically.
2.17 (g) "Genetic data" means any data, regardless of the data's format, that concerns a
2.18 consumer's genetic characteristics. Genetic data includes but is not limited to:
2.19 (1) raw sequence data that results from sequencing a consumer's complete extracted
2.20 DNA or a portion of the extracted DNA;
2.21 (2) genotypic and phenotypic information that results from analyzing the raw sequence
2.22 data; and
2.23 (3) self-reported health information that a consumer submits to a company regarding
2.24 the consumer's health conditions and that is (i) used for scientific research or product
2.25 development, and (ii) analyzed in connection with the consumer's raw sequence data.
2.26 Genetic data does not include deidentified data.
2.27 (h) "Genetic testing" means any laboratory test of a consumer's complete DNA, regions
2.28 of a consumer's DNA, chromosomes, genes, or gene products to determine the presence of
2.29 genetic characteristics.
2.30 (i) "Person" means an individual, partnership, corporation, association, business, business
2.31 trust, sole proprietorship, other entity, or representative of an organization.
2.32 (j) "Service provider" means a person that is involved in the collection, transportation,
2.33 analysis of, or any other service in connection with a consumer's biological sample, extracted
3.1 genetic material, or genetic data on behalf of the direct-to-consumer genetic testing company,
3.2 or on behalf of any other person that collects, uses, maintains, or discloses biological samples,
3.3 extracted genetic material, or genetic data collected or derived from a direct-to-consumer
3.4 genetic testing product or service, or is directly provided by a consumer, or the delivery of
3.5 the results of the analysis of the biological sample, extracted genetic material, or genetic
3.6 data.
3.7 Subd. 2.Disclosure and consent requirements. (a) To safeguard the privacy,
3.8 confidentiality, security, and integrity of a consumer's genetic data, a direct-to-consumer
3.9 genetic testing company must:
3.10 (1) provide easily accessible, clear, and complete information regarding the company's
3.11 policies and procedures governing the collection, use, maintenance, and disclosure of genetic
3.12 data by making available to a consumer all of the following written in plain language:
3.13 (i) a high-level privacy policy overview that includes basic, essential information about
3.14 the company's collection, use, or disclosure of genetic data;
3.15 (ii) a prominent, publicly available privacy notice that includes at a minimum information
3.16 about the company's data collection, consent, use, access, disclosure, maintenance, transfer,
3.17 security, retention, and deletion practices of genetic data; and
3.18 (iii) information that clearly describes how to file a complaint alleging a violation of
3.19 this section, pursuant to section 45.027;
3.20 (2) obtain a consumer's express consent to collect, use, and disclose the consumer's
3.21 genetic data, including at a minimum:
3.22 (i) initial express consent that clearly (A) describes the uses of the genetic data collected
3.23 through the genetic testing product service, and (B) specifies who has access to the test
3.24 results and how the genetic data may be shared;
3.25 (ii) separate express consent, which must include the name of the person to receive the
3.26 information, for each transfer or disclosure of the consumer's genetic data or biological
3.27 sample to any person other than the company's vendors and service providers;
3.28 (iii) separate express consent for each use of genetic data or the biological sample beyond
3.29 the primary purpose of the genetic testing product or service and inherent contextual uses;
3.30 (iv) separate express consent to retain any biological sample provided by the consumer
3.31 following completion of the initial testing service requested by the consumer;
4.1 (v) informed consent in compliance with federal policy for the protection of human
4.2 research subjects under Code of Federal Regulations, title 45, part 46, to transfer or disclose
4.3 the consumer's genetic data to a third-party person for research purposes or research
4.4 conducted under the control of the company for publication or generalizable knowledge
4.5 purposes; and
4.6 (vi) express consent for marketing by (A) the direct-to-consumer genetic testing company
4.7 to a consumer based on the consumer's genetic data, or (B) a third party to a consumer based
4.8 on the consumer having ordered or purchased a genetic testing product or service. For
4.9 purposes of this clause, "marketing" does not include customized content or offers provided
4.10 on the websites or through the applications or services provided by the direct-to-consumer
4.11 genetic testing company with the first-party relationship to the customer;
4.12 (3) not disclose genetic data to law enforcement or any other governmental agency
4.13 without a consumer's express written consent, unless the disclosure is made pursuant to a
4.14 valid search warrant or court order;
4.15 (4) develop, implement, and maintain a comprehensive security program and measures
4.16 to protect a consumer's genetic data against unauthorized access, use, or disclosure; and
4.17 (5) provide a process for a consumer to:
4.18 (i) access the consumer's genetic data;
4.19 (ii) delete the consumer's account and genetic data; and
4.20 (iii) request and obtain the destruction of the consumer's biological sample.
4.21 (b) Notwithstanding any other provisions in this section, a direct-to-consumer genetic
4.22 testing company is prohibited from disclosing a consumer's genetic data without the
4.23 consumer's written consent to: (1) any entity offering health insurance, life insurance,
4.24 disability insurance, or long-term care insurance; or (2) any employer of the consumer. Any
4.25 consent under this paragraph must clearly identify the recipient of the consumer's genetic
4.26 data proposed to be disclosed.
4.27 (c) A company that is subject to the requirements described in paragraph (a), clause (2),
4.28 shall provide effective mechanisms, without any unnecessary steps, for a consumer to revoke
4.29 any consent of the consumer or all of the consumer's consents after a consent is given,
4.30 including at least one mechanism which utilizes the primary medium through which the
4.31 company communicates to the consumer. If a consumer revokes consent provided pursuant
4.32 to paragraph (a), clause (2), the company shall honor the consumer's consent revocation as
4.33 soon as practicable, but not later than 30 days after the consumer revokes consent. The
5.1 company shall destroy a consumer's biological sample within 30 days of receipt of revocation
5.2 of consent to store the sample.
5.3 (d) A direct-to-consumer genetic testing company must provide a clear and complete
5.4 notice to a consumer that the consumer's deidentified data may be shared with or disclosed
5.5 to third parties for research purposes in accordance with Code of Federal Regulations, title
5.6 45, part 46.
5.7 Subd. 3.Service provider agreements. (a) A contract between the company and a
5.8 service provider must prohibit the service provider from retaining, using, or disclosing any
5.9 biological sample, extracted genetic material, genetic data, or information regarding the
5.10 identity of the consumer, including whether that consumer has solicited or received genetic
5.11 testing, as applicable, for any purpose other than for the specific purpose of performing the
5.12 services specified in the service contract. The mandatory prohibition set forth in this
5.13 subdivision requires a service contract to include, at minimum, the following provisions:
5.14 (1) a provision prohibiting the service provider from retaining, using, or disclosing the
5.15 biological sample, extracted genetic material, genetic data, or any information regarding
5.16 the identity of the consumer, including whether that consumer has solicited or received
5.17 genetic testing, as applicable, for any purpose other than providing the services specified
5.18 in the service contract; and
5.19 (2) a provision prohibiting the service provider from associating or combining the
5.20 biological sample, extracted genetic material, genetic data, or any information regarding
5.21 the identity of the consumer, including whether that consumer has solicited or received
5.22 genetic testing, as applicable, with information the service provider has received from or
5.23 on behalf of another person or persons, or has collected from its own interaction with
5.24 consumers or as required by law.
5.25 (b) A service provider subject to this subdivision is subject to the same confidentiality
5.26 obligations as a direct-to-consumer genetic testing company with respect to all biological
5.27 samples, extracted genetic materials, and genetic material, or any information regarding the
5.28 identity of any consumer in the service provider's possession.
5.29 Subd. 4.Enforcement. The commissioner of commerce may enforce this section under
5.30 section 45.027.
5.31 Subd. 5.Limitations. This section does not apply to:
5.32 (1) protected health information that is collected by a covered entity or business associate,
5.33 as those terms are defined in Code of Federal Regulations, title 45, parts 160 and 164;
6.1 (2) a public or private institution of higher education; or
6.2 (3) an entity owned or operated by a public or private institution of higher education.
6.3 Subd. 6.Construction. This section does not supersede the requirements and rights
6.4 described in section 13.386 or the remedies available under chapter 13 for violations of
6.5 section 13.386.
