March 5, 2025
Mr. Cassidy (for himself and Mr. Peters) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation
To provide consumers with the right to delete their genomic data, and for other purposes.
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,
Section 1. Short title
This Act may be cited as the Genomic Data Protection Act
.
Sec. 2. Consumer rights regarding privacy of genomic data
(a) Requirements
(1) Consumer controls
(A) In general
A direct-to-consumer genomic testing company shall provide a simple and effective mechanism to allow a consumer to—
(i)
access the genomic data of the consumer; and
(ii)
subject to paragraph (4)—
(I)
delete the account of the consumer, including any genomic data associated with such account; and
(II)
request the destruction of any biological sample of the consumer.
(B) Required mechanism
The direct-to-consumer genomic testing company shall make available to a consumer the mechanism described in subparagraph (A) through the primary means by which the company communicates with the consumer.
(2) Notification
(A) Consumer controls and use of deidentified genomic data
A direct-to-consumer genomic testing company shall make available, in a clear and conspicuous, not misleading, and easy-to-read manner a notice that—
(i)
provides a detailed and accurate representation of the rights set forth in clauses (i) and (ii) of paragraph (1)(A); and
(ii)
discloses that the deidentified genomic data of a consumer may be shared or disclosed to conduct medical or scientific research, consistent with the privacy regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d–2 note).
(B) Purchase of company
In the event that a direct-to-consumer genomic testing company is purchased or otherwise acquired by another entity, the direct-to-consumer genomic testing company shall send to each consumer, not fewer than 30 days prior to the date on which the purchase or acquisition is complete, a notice that includes—
(i)
the identity of the entity purchasing or otherwise acquiring the company; and
(ii)
a detailed and accurate representation of the how a consumer can exercise the rights set forth in clauses (i) and (ii) of paragraph (1)(A) under the new ownership.
(3) Processing of deletion or destruction requests
(A) In general
With respect to a consumer's request to delete the genomic data or to destroy the biological sample of the consumer, a direct-to-consumer genomic testing company shall—
(i)
fulfill such request not later than 30 days after the date on which the consumer makes such request; and
(ii)
notify the consumer of such deletion or destruction not later than 30 days after the deletion or destruction.
(B) Outstanding requests during purchase of company
In the event that a direct-to-consumer genomic testing company is purchased or otherwise acquired by another entity while a consumer's request to delete the genomic data or to destroy the biological sample of the consumer is outstanding—
(i)
the entity that is purchasing or otherwise acquiring the company shall comply with the requirements described in subparagraph (A); and
(ii)
the 30-day period to fulfill such request shall begin on the date on which the consumer makes such request to the direct-to-consumer genomic testing company.
(4) Exceptions
A direct-to-consumer genomic testing company shall not permit a consumer to exercise a right described in paragraph (1)(A)(ii) if the company determines that the exercise of the right would require the deletion of information—
(A)
subject to a warrant, lawfully executed subpoena, or other court order; or
(B)
the company is required to retain in order to comply with any other applicable legal or regulatory requirement.
(b) Enforcement
(1) Unfair or deceptive acts or practices
A violation of this section or a regulation promulgated thereunder shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
(2) Powers of the Commission
(A) In general
The Commission shall enforce this section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this section.
(B) Privileges and immunities
Any person who violates this section or a regulation promulgated thereunder shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
(C) Authority preserved
Nothing in this section shall be construed to limit the authority of the Commission under any other provision of law.
(D) Rulemaking
Not later than 1 year after the date of enactment of this section, the Commission may promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this section.
(c) Definitions
In this section:
(1) Biological sample
The term biological sample means any material part of the human, discharge therefrom, or derivative thereof, such as tissue, blood, urine, or saliva, known to contain deoxyribonucleic acid (DNA).
(2) Commission
The term Commission means the Federal Trade Commission.
(3) Consumer
The term consumer means an individual who provides a biological sample to a direct-to-consumer genomic testing company.
(4) Deidentified genomic data
The term deidentified genomic data means data that cannot be used to infer information about, or otherwise be linked to, a particular individual, provided that the business that possesses the information does all of the following:
(A)
Takes reasonable measures to ensure that the information cannot be associated with a particular individual.
(B)
Publicly commits to maintain and use the information only in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subparagraph, provided that the business does not use or disclose any information reidentified in this process and destroys the reidentified information upon completion of that assessment.
(C)
Contractually obligates any recipients of the information to take reasonable measures to ensure that the information cannot be associated with a particular individual and to commit to maintaining and using the information only in deidentified form and not to reidentify the information.
(5) Direct-to-consumer genomic testing company
(A) In general
The term direct-to-consumer genomic testing company means a person that does any of the following:
(i)
Manufactures or develops genomic testing products or services for sale directly to consumers.
(ii)
Analyzes or interprets genomic data obtained from a consumer.
(iii)
Collects, uses, maintains, or discloses genomic data collected or derived from a direct-to-consumer genomic testing product or service.
(iv)
Purchases or acquires genomic data from a direct-to-consumer genomic testing company.
(B) Exclusion for health care professionals
The term direct-to-consumer genomic testing company shall not include a health care professional (as defined in section 225 of the Public Health Service Act (42 U.S.C. 234)) that performs an action described in subparagraph (A) for purposes of diagnosis or treatment of a medical condition.
(6) Genomic data
(A) In general
The term genomic data—
(i)
means any data, regardless of its format or whether the data has been deidentified, that results from the analysis of a biological sample from a consumer and concerns genomic material; and
(ii)
includes—
(I)
deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, and single nucleotide polymorphisms (SNPs);
(II)
uninterpreted data that results from the analysis of the biological sample; or
(III)
any information extrapolated, derived, or inferred therefrom.
(B) Exclusion of deidentified genomic data
The term genomic data shall not include the deidentified genomic data of a consumer to the extent that such data is used to conduct medical or scientific research, consistent with the privacy regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d–2 note).
(7) Genomic testing product or service
The term genomic testing product or service means any testing product or service that analyzes or interprets the genomic data or biological sample of a consumer.
(d) Relationship to Federal and State laws
(1) Federal law preservation
Nothing in this Act, or a regulation promulgated under this Act, shall be construed to limit any other provision of Federal law, except as specifically provided in this Act.
(2) State law preservation
Nothing in this Act, or a regulation promulgated under this Act, shall be construed to preempt, displace, or supplant any State law, except to the extent that a provision of State law conflicts with a provision of this Act, or a regulation promulgated under this Act, and then only to the extent of the conflict.