1. (a)

   1. (1) A genetic testing company shall prominently display to a consumer complete information regarding the company’s policies and procedures governing the collection, use, maintenance, and disclosure of genetic data in plain language, including all of the following:

      1. a. A privacy policy overview that includes basic information about the company’s collection, use, or disclosure of genetic data.
      2. b. A privacy policy notice that sets forth the complete text of the company’s collection, consent, use, access, disclosure, transfer, security, retention, and deletion policies or practices.
      3. c. A clear and complete notice that the consumer’s genetic data may be included in deidentified data shared or disclosed by the company to a third party for research in compliance with the U.S. Department of Health and Human Services policy for the protection of human subjects, 45 C.F.R. Part 46.
      4. d. A clear description of how to file a complaint alleging a violation of this chapter.

   2. (2) A genetic testing company shall obtain the consumer’s initial express consent for all of the following:

      1. a. Use of the biological sample and resulting genetic data to provide the product or service ordered by the consumer.
      2. b. Identification of who may have access to the biological sample, genetic data, and test results, including a contractor, in order to fulfill the consumer’s order.
      3. c. Permission to retain the biological sample and genetic data for future testing for other products or services offered by the company.
      4. d. Acknowledgment that the company may seek express consent in the future to transfer the biological sample or disclose the genetic data to a third party other than a contractor for a reason other than fulfillment of an order for the company’s products or services.

   3. (3) A genetic testing company shall obtain the consumer’s express consent every time the company does any of the following:

      1. a. Transfers the biological sample or discloses the genetic data to a third party other than a contractor for a reason other than fulfillment of an order for the company’s products or services.
      2. b. Uses the biological sample or genetic data for a purpose other than the company’s products or services ordered by the consumer.
      3. c. Markets to a consumer based on the consumer’s genetic data, or markets to a consumer by a third party based on the consumer having ordered or purchased a genetic testing product or service. Marketing does not include the provision of customized content or offers on websites or through the applications or services provided by the direct-to-consumer genetic testing company with the first-party relationship to the consumer.

   4. (4) A genetic testing company shall obtain the consumer’s informed consent to transfer the biological sample or disclose the consumer’s genetic data in compliance with 45 C.F.R. Part 46, in the following cases:

      1. a. For independent research conducted by a third party.
      2. b. For research conducted under the sponsorship of the genetic testing company for the purpose of product or service research and development, scientific publication, or promotion of the company.

   5. (5)

      1. a. A genetic testing company shall provide a process for the consumer to do all of the following:

         1. 1. Access the consumer’s genetic data.
         2. 2. Delete the consumer’s account.
         3. 3. Request the destruction of the consumer’s biological sample and genetic data.
         4. 4. Revoke any express or informed consent given.

      2. b.

         1. 1. If the consumer requests the destruction of the consumer’s biological sample and genetic data, the company shall comply with the request as soon as reasonably possible, but no more than 30 days after the request is made.
         2. 2. If the consumer revokes any express or informed consent given that resulted in the transfer of the consumer’s biological sample or disclosure of the consumer’s genetic data to a third party, the company shall secure the return of the biological sample and the genetic data as soon as reasonably possible, but no more than 60 days after the revocation is tendered.
2. (b) A genetic testing company may disclose a consumer’s genetic data to any law enforcement agency pursuant to a valid legal process. When a law enforcement agency requests data from a genetic testing company, the company shall not disclose the existence of the valid legal process or the fact of the company’s compliance specifically to the party to whom the valid legal process pertains. Nothing in this subsection shall prevent a company from publishing a transparency report that details the number and types of law enforcement requests received and the number of times categories of information are shared, nor prevent a company from complying with other laws or policies, including a company’s privacy policy.

3. (c) A genetic testing company may not do any of the following without a consumer’s express written consent:

   1. (1) Disclose a consumer’s genetic data to any person issuing health, life, disability, or long-term care insurance.
   2. (2) Disclose a consumer’s genetic data to any employer or prospective employer of the consumer.

(Act 2024-384, §3.)