The new Florida law, which imposes criminal penalties, is helping to develop a nationwide patchwork of state genetic privacy laws


Last Friday, October 1st, the Data Protection Act to protect DNA (HB 833) a new genetic data protection law came into effect in the state of Florida that created four new offenses related to the unlawful use of someone else’s DNA. While the criminal penalties in HB 833 are noteworthy, Florida is not alone in its focus on increased protection of genetic privacy. A growing number of states, including Utah, Arizona, and California, have begun developing a genetic privacy network to fill loopholes in state and other state laws that often affect direct-to-consumer privacy practices ( “DTC”) concentrate. Genetic testing company. While some processing of genetic information is covered by federal law, the existing patchwork of state genetic privacy does not clearly cover all forms of genetic testing, including DTC genetic testing.

Florida’s Data Protection Act to Protect DNA

HB 833 was introduced in the Florida House of Representatives in February 2021 and signed by the governor in June. HB 833 applies to DNA samples collected from one person in Florida and governs the use, retention, disclosure, or transfer of another person’s DNA samples or analysis. HB 833 changed Florida’s previous genetic data protection law, P. 760.40, FSto require that a person from whom the DNA was extracted “explicitly agrees” with certain uses of their genetic information. Under previous law, analyzing a person’s DNA without their informed consent was a first-degree offense; according to HB 833, however, unlawful use can be a crime, depending on which provision of the law is violated. In addition, HB 833 states that the genetic information of the person from whom it is extracted is the “exclusive property” of that person, which can be controlled. While HB 833 imposes remarkable criminal penalties on those who violate it, there are a number of exceptions (such as the Health Insurance Portability and Accountability Act (“HIPAA”)).

HB 833 isn’t the only genetic privacy change recently made in Florida. Florida enacted in July 2020 HB 1189 which extended existing protection against the use of genetic information by health insurers to include long-term care and life insurers, including those who issue disability insurance policies. In particular, HB 1189 prohibits these insurers from canceling, limiting, refusing or changing the premium rates on the basis of genetic information. In addition, HB 1189 prevents insurers from soliciting or soliciting genetic information or test results, or using a consumer’s choice of whether to take any action related to genetic testing “for any insurance purpose”.

Additional DTC laws and regulations on genetic data protection

Utah enacted earlier this year SB227, the Genetic Information Privacy Act, which imposes restrictions on DTC genetic testing companies, requires specific privacy notices, security processes to protect consumer data, and a consumer’s ability to access and delete their own personal genetic data. Similar to Florida’s HB 833, Utah’s SB 227 includes a requirement that DTC genetic testing companies obtain express consent to collect, use, or disclose consumer genetic data. In addition, SB 227 specifically creates requirements for the anonymization of data, including that the company in possession of the data take certain measures to ensure that data cannot be re-identified and “enter into a legally enforceable contractual obligation, which prohibits a recipient of the data from attempting to re-identify the data. “

Arizona recently enacted as well HB 2069, the Genetic Information Privacy Act, which went into effect last week on September 29th. HB 2069 also focuses on DTC genetic testing companies and is similar in many ways to Utah SB 227 (e.g. followed by certain separate explicit consents for purposes beyond the original uses) but not all (e.g. the standard anonymous ones genetic data).

California state legislature passed SB 41, its own Genetic Information Privacy Act, which incorporates many of the same consent, privacy, and security mechanisms found in the laws of Utah and Arizona. The bill is currently on the governor’s desk for signature. SB 41 creates its own de-identification standard similar to that in Utah’s SB 227. In addition, SB 41 requires a DTC genetic testing company to comply with a consumer’s withdrawal of consent and destroy a consumer’s biological sample within 30 days of such withdrawal. SB 41 is almost identical to a bill that the governor vetoed last year amid concerns about a disruption in reporting COVID-19 test results to public health officials. However, SB 41 seeks to address the governor’s concerns by providing an exemption for testing to diagnose a specific disease, as long as the genetic information obtained through that diagnostic test is treated as medical or proprietary health information.

Federal genetic data protection landscape and efforts

Current state genetic privacy stems from several laws, including HIPAA, the Genetic Information Nondiskrimination Act of 2008, and the ability of the Federal Trade Commission to crack down on “unfair” or “fraudulent” business practices. However, these laws do not cover all forms of genetic testing a consumer can perform, including DTC genetic testing. There have been attempts recently to enact federal laws to protect Americans’ personal health information. Senators Amy Klobuchar and Lisa Murkowski introduced themselves in January 2021 P.24, the Personal Health Data Protection Act, which aims to provide comprehensive protection of personal health data not covered by HIPAA. On page 24, “personal health data” includes “genetic information”. . . which relates to the past, present or future physical or mental health or condition of a person who identifies the person or to whom there is a reasonable assumption that the information can be used to identify the person ”and states that DTC Genetic testing services are recorded as “services” in the invoice. To date, however, page 24 has been referred to the Senate Health, Education, Labor and Pensions Committee since its inception, but has not been postponed elsewhere.

Leave A Reply

Your email address will not be published.