EXPLANATION: CAPITALS INDICATE MATTER ADDE D TO EXISTING LAW .
[Brackets] indicate matter deleted from existing law.
*hb0866*
HOUSE BILL 866
I3 2lr2894
CF SB 766
By: Delegate Qi
Introduced and read first time: February 7, 2022
Assigned to: Economic Matters
A BILL ENTITLED
AN ACT concerning 1
Commercial Law – Consumer Protection – Genetic Information Privacy 2
FOR the purpose of regulating the use of genetic data by direct–to–consumer genetic testing 3
companies, including by requiring a direct–to–consumer genetic testing company to 4
provide consumers with certain information regarding the company’s policies and 5
procedures, obtain certain consents from consumers before collecting, using, or 6
disclosing the consumer’s genetic data, and develop and implement certain policies 7
and procedures to protect genetic data and provide for certain disclosures to law 8
enforcement and other government agencies; and generally relating to genetic 9
information privacy. 10
BY repealing and reenacting, with amendments, 11
Article – Commercial Law 12
Section 13–301(14)(xxxiv) and (xxxv) 13
Annotated Code of Maryland 14
(2013 Replacement Volume and 2021 Supplement) 15
BY adding to 16
Article – Commercial Law 17
Section 13–301(14)(xxxvi); and 14–4401 through 14–4408 to be under the new 18
subtitle “Subtitle 44. Genetic Information Privacy Act” 19
Annotated Code of Maryland 20
(2013 Replacement Volume and 2021 Supplement) 21
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 22
That the Laws of Maryland read as follows: 23
Article – Commercial Law 24
13–301. 25
2 HOUSE BILL 866
Unfair, abusive, or deceptive trade practices include any: 1
(14) Violation of a provision of: 2
(xxxiv) The federal Servicemembers Civil Relief Act; [or] 3
(xxxv) [§] SECTION 11–210 of the Education Article; or 4
(XXXVI) TITLE 14, SUBTITLE 44 OF THIS ARTICLE; OR 5
SUBTITLE 44. GENETIC INFORMATION PRIVACY ACT. 6
14–4401. 7
(A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS 8
INDICATED. 9
(B) (1) “BIOLOGICAL SAMPLE ” MEANS A MATERIAL PAR T OR A 10
DERIVATIVE OF OR DIS CHARGE FROM A MATERI AL PART OF A HUMAN K NOWN TO 11
CONTAIN DNA. 12
(2) “BIOLOGICAL SAMPLE ” INCLUDES HUMAN TISSU E, BLOOD, 13
URINE, AND SALIVA. 14
(C) (1) “DEIDENTIFIED DATA ” MEANS DATA THAT : 15
(I) CANNOT REASONABLY BE : 16
1. USED TO INFER INFORMA TION ABOUT A CONSUME R; 17
OR 18
2. LINKED TO AN IDENTIFI ABLE CONSUMER; AND 19
(2) IS SUBJECT TO: 20
(I) ADMINISTRATIVE AND TE CHNICAL MEASURES TO ENSURE 21
THAT THE DATA CANNOT BE ASSOCIATED WITH A PARTICULAR CONSUMER ; 22
(II) PUBLIC COMMITMENT BY THE COMPANY TO MAINT AIN AND 23
USE DATA IN A DEIDEN TIFIABLE FORM AND NO T ATTEMPT TO REIDENTIF Y DATA; 24
AND 25
HOUSE BILL 866 3
(III) LEGALLY ENFORCEABLE C ONTRACTUAL OBLIGATIO NS 1
THAT PROHIBIT A RECI PIENT OF THE DATA FR OM ATTEMPTING TO REI DENTIFY THE 2
DATA. 3
(D) “DIRECT–TO–CONSUMER GENETIC TES TING COMPANY ” MEANS AN 4
ENTITY THAT: 5
(1) OFFERS GENET IC TESTING PRODUCTS OR SERVICES DIRECTLY TO 6
A CONSUMER ; OR 7
(2) COLLECTS, USES, OR ANALYZES GENETIC DATA PROVIDED TO THE 8
COMPANY BY A CONSUME R. 9
(E) “DNA” MEANS DEOXYRIBONUCLE IC ACID. 10
(F) “EXPRESS CONSENT ” MEANS AN AFFIRMATIVE RESPONSE BY A 11
CONSUMER TO A SPECIFIC, DISCRETE, FREELY GIVEN, AND UNAMBIGUOUS NOTI CE 12
REGARDING THE COLLEC TION, USE, OR DISCLOSURE OF THE CONSUMER ’S GENETIC 13
DATA FOR A SPECIFIC PURPOSE. 14
(G) (1) “GENETIC DATA” MEANS DATA, IN ANY FORMAT, THAT CONCERNS 15
THE GENETIC CHARACTE RISTICS OF A CONSUMER . 16
(2) “GENETIC DATA” INCLUDES: 17
(I) RAW SEQUENCE DATA THA T RESULT FROM SEQUEN CING OF 18
A CONSUMER ’S COMPLETE EXTRACTED DNA OR A PORTION OF THE CONSUMER’S 19
COMPLETE EXTRACTED DNA; 20
(II) GENOTYPIC AND PHENOTY PIC INFORMATION THAT 21
RESULTS FROM ANALYZING RAW SEQ UENCE DATA; AND 22
(III) SELF–REPORTED HEALTH INFO RMATION SUBMITTED TO A 23
DIRECT–TO–CONSUMER GENETIC TES TING COMPANY BY A CO NSUMER REGARDING 24
THE CONSUMER ’S HEALTH CONDITIONS : 25
1. THAT IS USED FOR SCIE NTIFIC RESEARCH OR 26
PRODUCT DEVEL OPMENT; AND 27
2. ANALYZED IN CONNECTIO N WITH THE CONSUMER ’S 28
RAW SEQUENCE DATA . 29
(3) “GENETIC DATA” DOES NOT INCLUDE DEI DENTIFIED DATA . 30 4 HOUSE BILL 866
(H) “GENETIC TESTING ” MEANS A LABORATORY T EST OF THE COMPLETE 1
DNA, REGIONS OF DNA, CHROMOSOMES , GENES, OR GENE PRODUCTS OF A 2
CONSUMER TO DETERMIN E THE GENETIC CHARAC TERISTICS OF THE CON SUMER. 3
(I) “MARKETING” DOES NOT INCLUDE THE PROVIDING CUSTOMIZED 4
CONTENT OR OFFERS ON THE WEBSITES OR THRO UGH THE APPLICATIONS OR 5
SERVICES PROVIDED BY THE DIRECT–TO–CONSUMER GENETI C TESTING COMPANY 6
WITH THE FIRST–PARTY RELATIONSHIP T O THE CONSUMER . 7
14–4402. 8
THIS SUBTITLE DOES NO T APPLY TO: 9
(1) PROTECTED HEALTH INFO RMATION THAT IS COLL ECTED BY A 10
COVERED ENTITY OR BU SINESS ASSOCIATE AS DEFINED IN 45 C.F.R. PARTS 160 11
AND 164; 12
(2) AN INSTITUTION OF HIG HER EDUCATION , AS DEFINED IN § 10–101 13
OF THE EDUCATION ARTICLE; OR 14
(3) AN ENTITY OWNED OR OP ERATED BY AN INSTITU TION OF HIGHER 15
EDUCATION, AS DEFINED IN § 10–101 OF THE EDUCATION ARTICLE. 16
14–4403. 17
(A) A DIRECT–TO–CONSUMER GENETIC TESTING COMP ANY SHALL PROVIDE 18
A CONSUMER WITH CLEA R AND COMPLETE INFOR MATION REGARDING THE 19
COMPANY’S POLICIES AND PROCE DURES FOR COLLECTING , USING, OR DISCLOSING 20
GENETIC DATA , INCLUDING: 21
(1) A HIGH–LEVEL OVERVIEW OF TH E COMPANY’S PRIVACY POLICY 22
THAT INCLUDES BASIC AND ESSENTIAL INFORM ATION ABOUT HOW THE COMPANY 23
COLLECTS, USES, AND DISCLOSES GENETI C DATA; AND 24
(2) A PRIVACY NOTICE THAT , AT A MINIMUM , INCLUDES 25
INFORMATION ABOUT TH E COMPANY’S DATA COLLECTION , CONSENT, USE, ACCESS, 26
DISCLOSURE, TRANSFER, SECURITY, AND RETENTION AND DE LETION PRACTICES . 27
(B) THE INFORMATION REQUI RED TO BE PROVIDED U NDER SUBSECTION (A) 28
OF THIS SECTION SHAL L BE: 29
(1) MADE PUBLICLY AVAILAB LE; AND 30 HOUSE BILL 866 5
(2) PLACED IN A PROMINENT AREA OF THE DIRECT –TO–CONSUMER 1
GENETIC TESTING COMPANY ’S WEBSITE. 2
14–4404. 3
A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY , AT A MINIMUM , 4
SHALL OBTAIN THE FOL LOWING CONSENTS FROM A CONSUMER BEFORE 5
COLLECTING, USING, OR DISCLOSING THE CO NSUMER’S GENETIC DATA: 6
(1) INITIAL EXPRESS CONSE NT THAT CLEARLY: 7
(I) DESCRIBES THE USES OF THE GENETIC DATA COL LECTED 8
THROUGH THE GENETIC TESTING PRODUCT OR S ERVICE; AND 9
(II) SPECIFIES: 10
1. WHO HAS ACCESS TO THE RESULTS OF THE GENET IC 11
TESTING; AND 12
2. HOW THE GENETIC DATA MAY BE SHARED ; 13
(2) EXPRESS CONSENT FOR T RANSFERRING OR DISCL OSING THE 14
CONSUMER ’S GENETIC DATA TO A PERSON OTHER THAN TH E COMPANY’S VENDORS 15
AND SERVICE PROVIDER S; 16
(3) EXPRESS CONSENT FOR U SING GENETIC DATA BE YOND THE 17
PRIMARY PURPOSE OF T HE GENETIC TESTING P RODUCT OR SERVI CE REQUESTED BY 18
THE CONSUMER ; 19
(4) EXPRESS CONSENT FOR T HE RETENTION OF A BI OLOGICAL 20
SAMPLE PROVIDED BY T HE CONSUMER AFTER TH E INITIAL TESTING SE RVICE 21
REQUESTED BY THE CON SUMER IS COMPLETED ; 22
(5) EXPRESS CONSENT TO BE MARKETED TO BY : 23
(I) THE DIRECT–TO–CONSUMER GENETIC TES TING COMPANY 24
BASED ON THE CONSUME R’S GENETIC DATA; AND 25
(II) A THIRD PARTY BASED ON THE CONSUMER HAVING 26
ORDERED OR PURCHASED A GENETIC TESTING PR ODUCT OR SERVICE ; AND 27
6 HOUSE BILL 866
(6) INFORMED CONSENT IN C OMPLIANCE WITH THE F EDERAL POLICY 1
FOR THE PROTECTION O F HUMAN RESEARCH SUB JECTS FOR TRANSFER O R 2
DISCLOSURE OF THE CO NSUMER’S GENETIC DATA TO TH IRD PARTIES FOR 3
RESEARCH PURPOSES OR RESEARCH CONDUCTED U NDER THE CONTROL OF THE 4
COMPANY FOR THE PURP OSE OF PUBLICATION O R GENERALIZABLE KNOW LEDGE. 5
14–4405. 6
(A) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL 7
ESTABLISH LEGAL POLI CIES AND PROCESSES F OR DISCLOSING GENETI C DATA TO 8
LAW ENFORCEMENT OR A NOTHER GOVERNMENT AG ENCY WITHOUT A CONSU MER’S 9
EXPRESS WRITTEN CONS ENT. 10
(B) A DIRECT–TO–CONSUMER GENETIC TESTING COMP ANY SHALL 11
DEVELOP, IMPLEMENT, AND MAINTAIN A COMPR EHENSIVE SECURITY PR OGRAM TO 12
PROTECT CONSUMERS ’ GENETIC DATA AGAINST UNAUTHORIZED ACCESS , USE, OR 13
DISCLOSURE. 14
(C) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL 15
ESTABLISH A PROCESS FOR A CONSUMER TO : 16
(1) ACCESS THE CONSUMER ’S GENETIC DATA; 17
(2) DELETE THE CONSUMER ’S ACCOUNT AND GENETI C DATA; AND 18
(3) REQUEST THE DESTRUCTI ON OF THE CONSUMER ’S BIOLOGICAL 19
SAMPLE. 20
(D) NOTWITHSTANDING ANY O THER PROVISIONS OF L AW, A 21
DIRECT–TO–CONSUMER GENETIC TESTI NG COMPANY MAY NOT , WITHOUT THE 22
CONSUMER ’S WRITTEN CONSENT , DISCLOSE A CONSUMER ’S GENETIC DATA TO : 23
(1) AN ENTITY OFFERING HE ALTH INSURANCE , LIFE INSURANCE , OR 24
LONG–TERM CARE INSURANCE ; OR 25
(2) AN EMPLOYER OF THE CO NSUMER. 26
14–4406. 27
(A) A VIOLATION OF THIS SE CTION IS AN UNFAIR , ABUSIVE, OR DECEPTIVE 28
TRADE PRACTICE WITHI N THE MEANING OF TITLE 13 OF THIS ARTICLE AND IS 29
SUBJECT TO THE ENFOR CEMENT AND PENALTY P ROVISIONS CONTAINED IN TITLE 30
13 OF THIS ARTICLE. 31 HOUSE BILL 866 7
(B) THIS SECTION DOES NOT PREVENT AN INDIVIDUA L FROM PURSUING 1
ANY OTHER REMEDY PRO VIDED BY LAW. 2
14–4407. 3
THE DISCLOSURE OF GEN ETIC DATA IN ACCORDA NCE WITH THIS SUBTIT LE 4
SHALL COMPLY WITH AL L STATE AND FEDERAL LAW S FOR THE PROTECTION OF 5
PRIVACY AND SECURITY . 6
14–4408. 7
THIS SUBTITLE MAY BE KNOWN A ND CITED AS THE MARYLAND GENETIC 8
INFORMATION PRIVACY ACT. 9
SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect 10
October 1, 2022. 11