S863-119

1. Short title This Act may be cited as the Genomic Data Protection Act.

2. Consumer rights regarding privacy of genomic data A direct-to-consumer genomic testing company shall provide a simple and effective mechanism to allow a consumer to— access the genomic data of the consumer; and subject to paragraph (4)— delete the account of the consumer, including any genomic data associated with such account; and request the destruction of any biological sample of the consumer. The direct-to-consumer genomic testing company shall make available to a consumer the mechanism described in subparagraph (A) through the primary means by which the company communicates with the consumer. A direct-to-consumer genomic testing company shall make available, in a clear and conspicuous, not misleading, and easy-to-read manner a notice that— provides a detailed and accurate representation of the rights set forth in clauses (i) and (ii) of paragraph (1)(A); and discloses that the deidentified genomic data of a consumer may be shared or disclosed to conduct medical or scientific research, consistent with the privacy regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d–2 note). In the event that a direct-to-consumer genomic testing company is purchased or otherwise acquired by another entity, the direct-to-consumer genomic testing company shall send to each consumer, not fewer than 30 days prior to the date on which the purchase or acquisition is complete, a notice that includes— the identity of the entity purchasing or otherwise acquiring the company; and a detailed and accurate representation of the how a consumer can exercise the rights set forth in clauses (i) and (ii) of paragraph (1)(A) under the new ownership. With respect to a consumer's request to delete the genomic data or to destroy the biological sample of the consumer, a direct-to-consumer genomic testing company shall— fulfill such request not later than 30 days after the date on which the consumer makes such request; and notify the consumer of such deletion or destruction not later than 30 days after the deletion or destruction. In the event that a direct-to-consumer genomic testing company is purchased or otherwise acquired by another entity while a consumer's request to delete the genomic data or to destroy the biological sample of the consumer is outstanding— the entity that is purchasing or otherwise acquiring the company shall comply with the requirements described in subparagraph (A); and the 30-day period to fulfill such request shall begin on the date on which the consumer makes such request to the direct-to-consumer genomic testing company. A direct-to-consumer genomic testing company shall not permit a consumer to exercise a right described in paragraph (1)(A)(ii) if the company determines that the exercise of the right would require the deletion of information— subject to a warrant, lawfully executed subpoena, or other court order; or the company is required to retain in order to comply with any other applicable legal or regulatory requirement. A violation of this section or a regulation promulgated thereunder shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). The Commission shall enforce this section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this section. Any person who violates this section or a regulation promulgated thereunder shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.). Nothing in this section shall be construed to limit the authority of the Commission under any other provision of law. Not later than 1 year after the date of enactment of this section, the Commission may promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this section. In this section: The term biological sample means any material part of the human, discharge therefrom, or derivative thereof, such as tissue, blood, urine, or saliva, known to contain deoxyribonucleic acid (DNA). The term Commission means the Federal Trade Commission. The term consumer means an individual who provides a biological sample to a direct-to-consumer genomic testing company. The term deidentified genomic data means data that cannot be used to infer information about, or otherwise be linked to, a particular individual, provided that the business that possesses the information does all of the following: Takes reasonable measures to ensure that the information cannot be associated with a particular individual. Publicly commits to maintain and use the information only in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subparagraph, provided that the business does not use or disclose any information reidentified in this process and destroys the reidentified information upon completion of that assessment. Contractually obligates any recipients of the information to take reasonable measures to ensure that the information cannot be associated with a particular individual and to commit to maintaining and using the information only in deidentified form and not to reidentify the information. The term direct-to-consumer genomic testing company means a person that does any of the following: Manufactures or develops genomic testing products or services for sale directly to consumers. Analyzes or interprets genomic data obtained from a consumer. Collects, uses, maintains, or discloses genomic data collected or derived from a direct-to-consumer genomic testing product or service. Purchases or acquires genomic data from a direct-to-consumer genomic testing company. The term direct-to-consumer genomic testing company shall not include a health care professional (as defined in section 225 of the Public Health Service Act (42 U.S.C. 234)) that performs an action described in subparagraph (A) for purposes of diagnosis or treatment of a medical condition. The term genomic data— means any data, regardless of its format or whether the data has been deidentified, that results from the analysis of a biological sample from a consumer and concerns genomic material; and includes— deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, and single nucleotide polymorphisms (SNPs); uninterpreted data that results from the analysis of the biological sample; or any information extrapolated, derived, or inferred therefrom. The term genomic data shall not include the deidentified genomic data of a consumer to the extent that such data is used to conduct medical or scientific research, consistent with the privacy regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d–2 note). The term genomic testing product or service means any testing product or service that analyzes or interprets the genomic data or biological sample of a consumer. Nothing in this Act, or a regulation promulgated under this Act, shall be construed to limit any other provision of Federal law, except as specifically provided in this Act. Nothing in this Act, or a regulation promulgated under this Act, shall be construed to preempt, displace, or supplant any State law, except to the extent that a provision of State law conflicts with a provision of this Act, or a regulation promulgated under this Act, and then only to the extent of the conflict.