Genomic Data Protection Act
- Bill Number
- S. 863
- Origin Chamber
- Senate
- Congress
- 119th Congress, Session 1
- Policy Area
- Commerce
- Status
- Introduced
- Latest Action
- 2025-03-05: Read twice and referred to the Committee on Commerce, Science, and Transportation.
- Last Updated
- 2025-05-14T15:23:51Z
AI-Generated Summary
Purpose
The Genomic Data Protection Act aims to enhance consumer privacy by granting individuals specific rights over their genomic data collected by direct-to-consumer (DTC) genomic testing companies. It focuses on ensuring consumers can access and delete their personal genomic information and biological samples, while allowing limited use of anonymized (deidentified) data for research.
Key Provisions
- Consumer Rights and Controls:
- DTC genomic testing companies must provide easy-to-use tools for consumers to access their genomic data, delete their account (including associated data), and request destruction of biological samples (e.g., saliva or blood used for testing).
- These tools must be accessible via the company's main communication channels, such as apps or websites.
- Notifications:
- Companies must clearly display information about these rights and disclose that deidentified genomic data may be shared for medical or scientific research, following HIPAA privacy rules.
- If a company is bought or acquired, it must notify consumers at least 30 days in advance, including details on exercising rights under new ownership.
- Processing Requests:
- Deletion or destruction requests must be completed within 30 days, with confirmation sent to the consumer within another 30 days.
- If a request is pending during a company acquisition, the new owner must fulfill it within the original 30-day timeline.
- Exceptions:
- Companies can deny deletion if the data is needed for legal reasons, such as a court warrant, subpoena, or other regulatory requirements.
- Enforcement:
- Violations are treated as unfair or deceptive business practices under Federal Trade Commission (FTC) rules.
- The FTC has full authority to investigate, enforce penalties, and issue regulations within one year of the law's enactment.
- No limits on the FTC's existing powers.
- Definitions (simplified explanations):
- Biological sample: Human materials like tissue, blood, or saliva containing DNA.
- Consumer: Anyone providing a sample to a DTC company.
- Deidentified genomic data: Anonymized data that cannot link back to an individual, with strict rules to prevent re-identification; usable for research under HIPAA.
- DTC genomic testing company: Businesses selling or analyzing genomic tests directly to consumers (excludes doctors diagnosing medical conditions).
- Genomic data: Information from analyzing a person's DNA/RNA, including raw data or interpretations (excludes deidentified data used for research).
- Relation to Other Laws:
- Does not override other federal laws unless specified.
- Preserves state laws unless they directly conflict with this act.
Significant Changes to Existing Law
- Introduces federal mandates for DTC companies to offer deletion rights for genomic data and samples, which were not uniformly required before; previously, privacy relied on general FTC rules or HIPAA (which mainly covers healthcare providers, not DTC firms).
- Adds specific acquisition notifications and timelines for data handling, filling gaps in consumer protections for emerging genomic technologies.
- Clarifies that deidentified data can still support research, aligning with but expanding HIPAA's scope for non-healthcare entities.
Potential Impacts
- On Citizens: Empowers individuals with greater control over sensitive genetic information, reducing risks of misuse (e.g., discrimination or unauthorized sharing), but may limit personal access to retained data in legal cases.
- On Government Agencies: Increases FTC workload for enforcement and rulemaking; no direct impact on other agencies like HHS (which oversees HIPAA).
- On Businesses: DTC companies (e.g., 23andMe or AncestryDNA) face compliance costs for systems, notifications, and deletions, potentially affecting data-driven services or sales.
- On International Relations: Minimal direct impact, though it could influence global standards for genomic data privacy if U.S. companies operate abroad.
Main Stakeholders Affected
- Consumers: Primary beneficiaries, gaining privacy tools but potentially facing delays in exceptional cases.
- DTC Genomic Testing Companies: Must implement new processes, with risks of FTC penalties for non-compliance.
- Federal Trade Commission (FTC): Gains enforcement role, requiring resources for oversight.
- Researchers and Medical Community: Can access deidentified data for studies, but face stricter anonymization requirements.
- State Governments: Retain authority over non-conflicting privacy laws.
Notable Legal, Constitutional, or Political Implications
- Legal: Strengthens data privacy enforcement via FTC, treating violations like consumer fraud; preserves HIPAA for research while carving out DTC-specific rules, potentially leading to more litigation over "deidentification" standards.
- Constitutional: Aligns with privacy expectations under the Fourth Amendment (protection against unreasonable searches) by limiting corporate retention of personal genetic data, though exceptions for warrants uphold legal processes.
- Political: Advances bipartisan data privacy efforts (introduced by Sens. Cassidy and Peters), balancing consumer rights with innovation in genomics; may spark debates on federal vs. state regulation or research access in a politically divided Congress.
This summary was generated by AI and may contain inaccuracies. Refer to the official source document for the authoritative text.
Sponsor
Cosponsors (1)
Recent Actions
- 2025-03-05: Read twice and referred to the Committee on Commerce, Science, and Transportation.
- 2025-03-05: Introduced in Senate
Bill Versions
- Genomic Data Protection Act — issued 2025-03-05 — PDF (11 pages)