EXPLANATION: CAPITALS INDICATE MAT TER ADDED TO EXISTIN G LAW.
[Brackets] indicate matter deleted from existing law.
Underlining indicates amendments to bill.
Strike out indicates matter stricken from the bill by amendment or deleted from the law by
amendment.
*hb0866*
HOUSE BILL 866
I3 2lr2894
CF SB 766
By: Delegate Qi
Introduced and read first time: February 7, 2022
Assigned to: Economic Matters
Committee Report: Favorable with amendments
House action: Adopted
Read second time: March 10, 2022
CHAPTER ______
AN ACT concerning 1
Commercial Law – Consumer Protection – Genetic Information Privacy 2
– Consumer Protection and Forensic Genealogy 3
FOR the purpose of regulating the use of genetic data by direct–to–consumer genetic testing 4
companies, including by requiring a direct–to–consumer genetic testing company to 5
provide consumers with certain information regarding the company’s policies and 6
procedures, obtain certain consents from consumers before collecting, using, or 7
disclosing the consumer’s genetic data, and develop and implement certain policies 8
and procedures to protect genetic data and provide for certain disclosures to law 9
enforcement and other government agencies; altering the direct–to–consumer or 10
publicly available open–data personal genomics databases that may be used to 11
conduct forensic genetic genealogical DNA analysis and search to require that the 12
databases seek express consent from their service users regarding the substance of 13
a certain notice; and generally relating to genetic information privacy. 14
BY repealing and reenacting, with amendments, 15
Article – Commercial Law 16
Section 13–301(14)(xxxiv) and (xxxv) 17
Annotated Code of Maryland 18
(2013 Replacement Volume and 2021 Supplement) 19
BY adding to 20
Article – Commercial Law 21
Section 13–301(14)(xxxvi); and 14–4401 through 14–4408 to be under the new 22
subtitle “Subtitle 44. Genetic Information Privacy Act” 23 2 HOUSE BILL 866
Annotated Code of Maryland 1
(2013 Replacement Volume and 2021 Supplement) 2
BY repealing and reenacting, without amendments, 3
Article – Criminal Procedure 4
Section 17–101(a), (c), (e), and (g) and 17–102(a) 5
Annotated Code of Maryland 6
(2018 Replacement Volume and 2021 Supplement) 7
BY adding to 8
Article – Criminal Procedure 9
Section 17–101(c–1) 10
Annotated Code of Maryland 11
(2018 Replacement Volume and 2021 Supplement) 12
BY repealing and reenacting, with amendments, 13
Article – Criminal Procedure 14
Section 17–102(d) and 17–103(a)(4) 15
Annotated Code of Maryland 16
(2018 Replacement Volume and 2021 Supplement) 17
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 18
That the Laws of Maryland read as follows: 19
Article – Commercial Law 20
13–301. 21
Unfair, abusive, or deceptive trade practices include any: 22
(14) Violation of a provision of: 23
(xxxiv) The federal Servicemembers Civil Relief Act; [or] 24
(xxxv) [§] SECTION 11–210 of the Education Article; or 25
(XXXVI) TITLE 14, SUBTITLE 44 OF THIS ARTICLE; OR 26
SUBTITLE 44. GENETIC INFORMATION PRIVACY ACT. 27
14–4401. 28
(A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS 29
INDICATED. 30
HOUSE BILL 866 3
(B) (1) “BIOLOGICAL SAMPLE ” MEANS A MATERIAL PAR T OR A 1
DERIVATIVE OF OR DIS CHARGE FROM A MATERI AL PART OF A HUMAN K NOWN TO 2
CONTAIN DNA. 3
(2) “BIOLOGICAL SAMPLE ” INCLUDES HUMAN TISSU E, BLOOD, 4
URINE, AND SALIVA. 5
(C) (1) “DEIDENTIFIED DATA ” MEANS DATA THAT : 6
(I) CANNOT REASONABLY BE : 7
1. USED TO INFER INFORMA TION ABOUT A CONSUME R; 8
OR 9
2. LINKED TO AN IDENTIFI ABLE CONSUMER ; AND 10
(2) IS SUBJECT TO: 11
(I) ADMINISTRATIVE AND TE CHNICAL MEASURES TO ENSURE 12
THAT THE DATA CANNOT BE ASSOCIATED WITH A PARTICULAR CONSUMER ; 13
(II) PUBLIC COMMITMENT BY THE COMPANY TO MAINT AIN AND 14
USE DATA IN A DEIDEN TIFIABLE FORM AND NO T ATTEMPT TO REIDENT IFY DATA; 15
AND 16
(III) LEGALLY ENFORCEABLE C ONTRACTUAL OBLIGATIO NS 17
THAT PROHIBIT A RECI PIENT OF THE DATA FR OM ATTEMPTING TO REI DENTIFY THE 18
DATA. 19
(D) (1) “DIRECT–TO–CONSUMER GENETIC TES TING COMPANY ” MEANS 20
AN ENTITY THAT: 21
(1) (I) OFFERS GENETIC TESTIN G PRODUC TS OR SERVICES 22
DIRECTLY TO A CONSUM ER; OR 23
(2) (II) COLLECTS, USES, OR ANALYZES GENETIC DATA THAT 24
RESULTED FROM A DIRE CT–TO–CONSUMER GENETIC TES TING PRODUCT OR 25
SERVICE THAT WAS PROVIDED TO THE COMP ANY BY A CONSUMER . 26
(2) “DIRECT–TO–CONSUMER GENETIC TESTING COMPANY ” DOES NOT 27
INCLUDE AN ENTITY ON LY WHEN THE ENTITY I S ENGAGED IN COLLECT ING, 28
ANALYZING, RETAINING, OR DISCLOSING GENETI C DATA OR BIOLOGICAL SAMPLES 29 4 HOUSE BILL 866
IN THE CONTEXT OF RE SEARCH, AS DEFINED IN 45 C.F.R. 164.501, CONDUCTED IN 1
ACCORDANCE WITH : 2
(I) THE FEDERAL POLICY FO R THE PROTECTION OF HUMAN 3
SUBJECTS ESTABLISHED IN 45 C.F.R. PART 46; 4
(II) THE GOOD CLINICAL PRACTICE GUIDELINES ISSUED BY 5
THE INTERNATIONAL COUNCIL FOR HARMONISATION ; OR 6
(III) THE U.S. FOOD AND DRUG ADMINISTRATION PROTECTION 7
OF HUMAN SUBJECTS UNDER 21 C.F.R. PARTS 50 AND 56. 8
(E) “DNA” MEANS DEOXYRIBONUCLE IC ACID. 9
(F) “EXPRESS CONSENT ” MEANS AN AFFIRMATIVE RESPONSE BY A 10
CONSUMER TO A SPECIF IC, DISCRETE, FREELY GIVEN, AND UNAMBIGUOUS NOTI CE 11
REGARDING THE COLLEC TION, USE, OR DISCLOSURE OF THE CONSUMER ’S GENETIC 12
DATA FOR A SPECIFIC PURPOSE. 13
(G) (1) “GENETIC DATA” MEANS DATA, IN ANY FORMAT, THAT CONCERNS 14
THE GENETIC CHARACTE RISTICS OF A CONSUME R. 15
(2) “GENETIC DATA” INCLUDES: 16
(I) RAW SEQUENCE DATA THA T RESULT FROM SEQ UENCING OF 17
A CONSUMER ’S COMPLETE EXTRACTED DNA OR A PORTION OF THE CONSUMER’S 18
COMPLETE EXTRACTED DNA; 19
(II) GENOTYPIC AND PHENOTY PIC INFORMATION THAT 20
RESULTS FROM ANALYZI NG RAW SEQUENCE DATA ; AND 21
(III) INFORMATION EXTRAPOLA TED, DERIVED, OR INFERRED 22
FROM THE ANALYSIS OF RAW SEQUENCE DATA ; AND 23
(III) (IV) SELF–REPORTED HEALTH INFO RMATION SUBMITTED 24
TO A DIRECT –TO–CONSUMER GENETIC TES TING COMPANY BY A CO NSUMER 25
REGARDING THE CONSUM ER’S HEALTH CONDITIONS : 26
1. THAT IS USED FOR SCIE NTIFIC RESEARCH OR 27
PRODUCT DEVELOPMENT ; AND 28
2. ANALYZED IN CONNECTIO N WITH THE CONSUMER ’S 29
RAW SEQUENCE DATA . 30 HOUSE BILL 866 5
(3) “GENETIC DATA” DOES NOT INCLUDE DEI DENTIFIED DATA WHEN 1
USED FOR RESEARCH PR OJECTS. 2
(H) “GENETIC TESTING ” MEANS A LABORATORY T EST OF THE COMPLETE 3
DNA, REGIONS OF DNA, CHROMOSOMES , GENES, OR GENE PRODUCTS OF A 4
CONSUMER TO DETERMIN E THE GENETIC CHARAC TERISTICS OF THE CON SUMER. 5
(I) “MARKETING” DOES NOT INCLUDE THE PROVIDING CUSTOMIZED 6
CONTENT OR OFFERS ON THE WEBSITES OR THRO UGH THE APPLICATIONS OR 7
SERVICES PROVIDED BY THE DI RECT–TO–CONSUMER GENETIC TES TING COMPANY 8
WITH THE FIRST–PARTY RELATIONSHIP T O THE CONSUMER . 9
14–4402. 10
THIS SUBTITLE DOES NO T APPLY TO: 11
(1) PROTECTED PROTECTED HEALTH INFORMATION T HAT IS 12
COLLECTED BY A COVER ED ENTITY OR BUSINES S ASSOCIATE AS DEFINED IN 45 13
C.F.R. PARTS 160 AND 164; 14
(2) AN INSTITUTION OF HIG HER EDUCATION , AS DEFINED IN § 10–101 15
OF THE EDUCATION ARTICLE; OR 16
(3) AN ENTITY OWNED OR OP ERATED BY AN INSTITU TION OF HIGHER 17
EDUCATION, AS DEFINED IN § 10–101 OF THE EDUCATION ARTICLE. 18
14–4403. 19
(A) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL P ROVIDE 20
A CONSUMER WITH CLEA R AND COMPLETE INFOR MATION REGARDING THE 21
COMPANY’S POLICIES AND PROCE DURES FOR COLLECTING , USING, OR DISCLOSING 22
GENETIC DATA , INCLUDING: 23
(1) A HIGH–LEVEL OVERVIEW OF TH E COMPANY’S PRIVACY POLICY 24
THAT INCLUDES BASIC AND ESSENTIAL INFORM ATION ABOUT HOW THE COMPANY 25
COLLECTS, USES, AND DISCLOSES GENETI C DATA; AND 26
(2) A PRIVACY NOTICE THAT , AT A MINIMUM , INCLUDES 27
INFORMATION ABOUT TH E COMPANY’S DATA COLLECTION , CONSENT, USE, ACCESS, 28
DISCLOSURE, TRANSFER, SECURITY, AND RETENTION AND DE LETION PRACTICES . 29
6 HOUSE BILL 866
(B) THE INFORMATION REQUI RED TO BE PROVIDED U NDER SUBSECTION (A) 1
OF THIS SECTION SHAL L BE: 2
(1) MADE PUBLICLY AVAILAB LE; AND 3
(2) PLACED IN A PR OMINENT AREA OF THE DIRECT–TO–CONSUMER 4
GENETIC TESTING COMP ANY’S WEBSITE. 5
14–4404. 6
A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY , AT A MINIMUM , 7
SHALL OBTAIN THE FOL LOWING CONSENTS FROM A CONSUMER BEFORE 8
COLLECTING, USING, OR DISCLOSING THE CO NSUMER’S GENETIC DATA: 9
(1) INITIAL EXPRESS CONSE NT THAT CLEARLY : 10
(I) DESCRIBES THE USES OF THE GENETIC DATA COL LECTED 11
THROUGH THE GENETIC TESTING PRODUCT OR S ERVICE; AND 12
(II) SPECIFIES: 13
1. WHO HAS ACCESS TO THE RESULTS OF THE GENET IC 14
TESTING; AND 15
2. HOW THE GENETIC DATA MAY BE SHARED ; 16
(2) EXPRESS CONSENT FOR T RANSFERRING OR DISCL OSING THE 17
CONSUMER ’S GENETIC DATA TO A PERSON OTHER THAN TH E COMPANY’S VENDORS 18
AND SERVICE PROVIDER S; 19
(3) EXPRESS CONSENT FOR U SING GENETIC DATA BE YOND THE 20
PRIMARY PURPOSE OF THE GENET IC TESTING PRODUCT O R SERVICE REQUESTED BY 21
THE CONSUMER ; 22
(4) EXPRESS CONSENT FOR T HE RETENTION OF A BI OLOGICAL 23
SAMPLE PROVIDED BY T HE CONSUMER AFTER TH E INITIAL TESTING SE RVICE 24
REQUESTED BY THE CON SUMER IS COMPLETED ; 25
(5) EXPRESS CONSENT TO BE MARKETE D TO BY: 26
(I) THE DIRECT–TO–CONSUMER GENETIC TES TING COMPANY 27
BASED ON THE CONSUME R’S GENETIC DATA; AND 28
HOUSE BILL 866 7
(II) A THIRD PARTY BASED ON THE CONSUMER HAVING 1
ORDERED OR PURCHASED A GENETIC TESTING PR ODUCT OR SERVICE ; AND 2
(6) INFORMED CONSENT IN COMPLIANC E WITH THE FEDERAL P OLICY 3
FOR THE PROTECTION O F HUMAN RESEARCH SUB JECTS FOR TRANSFER O R 4
DISCLOSURE OF THE CO NSUMER’S GENETIC DATA TO TH IRD PARTIES FOR 5
RESEARCH PURPOSES OR RESEARCH CONDUCTED U NDER THE CONTROL OF THE 6
COMPANY FOR THE PUR POSE OF PUBLICATION OR GENERALIZABLE KNO WLEDGE. 7
14–4405. 8
(A) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL 9
ESTABLISH LEGAL POLI CIES AND PROCESSES F OR DISCLOSING GENETI C DATA TO 10
LAW ENFORCEMENT OR A NOTHER GOVERNMENT AG ENCY WITHOUT A CONSU MER’S 11
EXPRESS WRITTEN CONSENT . 12
(B) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL 13
DEVELOP, IMPLEMENT, AND MAINTAIN A COMPR EHENSIVE SECURITY PR OGRAM TO 14
PROTECT CONSUMERS ’ GENETIC DATA AGAINST UNAUTHORIZED ACCESS , USE, OR 15
DISCLOSURE. 16
(C) A DIRECT–TO–CONSUMER GENETIC TESTING COMP ANY SHALL 17
ESTABLISH A PROCESS FOR A CONSUMER TO : 18
(1) ACCESS THE CONSUMER ’S GENETIC DATA; 19
(2) DELETE THE CONSUMER ’S ACCOUNT AND GENETI C DATA; AND 20
(3) REQUEST THE DESTRUCTI ON OF THE CONSUMER ’S BIOLOGICAL 21
SAMPLE. 22
(D) NOTWITHSTAN DING ANY OTHER PROVI SIONS OF LAW , A 23
DIRECT–TO–CONSUMER GENETIC TES TING COMPANY MAY NOT , WITHOUT THE 24
CONSUMER ’S WRITTEN CONSENT , DISCLOSE A CONSUMER ’S GENETIC DATA TO : 25
(1) AN ENTITY OFFERING HE ALTH INSURANCE , LIFE INSURANCE , 26
DISABILITY INSURANCE , OR LONG–TERM CARE INSURANCE ; OR 27
(2) AN EMPLOYER OF THE CO NSUMER. 28
14–4406. 29
8 HOUSE BILL 866
(A) A VIOLATION OF THIS SE CTION IS AN UNFAIR , ABUSIVE, OR DECEPTIVE 1
TRADE PRACTICE WITHI N THE MEANING OF TITLE 13 OF THIS ARTICLE AND IS 2
SUBJECT TO THE ENFOR CEMENT AND PENALTY P ROVISIONS CONTAINED IN TITLE 3
13 OF THIS ARTICLE. 4
(B) THIS SECTION DOES NOT PREVENT AN INDIVIDUA L FROM PURSUING 5
ANY OTHER REMEDY PRO VIDED BY LAW. 6
14–4407. 7
THE DISCLOSURE OF GEN ETIC DATA IN ACCORDA NCE WITH THIS SUBTIT LE 8
SHALL COMPLY WITH AL L STATE AND FEDERA L LAWS FOR THE PROTE CTION OF 9
PRIVACY AND SECURITY . 10
14–4408. 11
THIS SUBTITLE MAY BE KNOWN AND CITED AS T HE MARYLAND GENETIC 12
INFORMATION PRIVACY ACT. 13
Article – Criminal Procedure 14
17–101. 15
(a) In this title the following words have the meanings indicated. 16
(c) “Direct–to–consumer genetic genealogy services” means genetic genealogy 17
services that are offered by private companies directly to members of the public and law 18
enforcement agencies rather than through clinical health care providers, typically via 19
customer access to secure online websites. 20
(C–1) “EXPRESS CONSENT ” HAS THE MEANING STAT ED IN § 14–4401 OF THE 21
COMMERCIAL LAW ARTICLE. 22
(e) “Forensic genetic genealogical DNA analysis and search” or “FGGS” means: 23
(1) the forensic genetic genealogical DNA analysis of biological material 24
using SNP or other sequencing techniques to develop an FGG profile; 25
(2) a subsequent search using the FGG profile in a publicly available 26
open–data personal genomics database or a direct–to–consumer genetic genealogy service 27
to find individuals related to the source of the FGG profile; and 28
(3) a genealogical search using public records and other lawful means to 29
obtain information in accordance with this title. 30
HOUSE BILL 866 9
(g) “Publicly available open–data personal genomics database” means a database 1
in which persons voluntarily submit their genomics data or genetic profiles, typically 2
processed through direct–to–consumer genetic genealogy services, for the purposes of 3
comparison or searching against the genetic profiles of other individuals to evaluate 4
potential familial relationships between the reference sample and other service user 5
samples. 6
17–102. 7
(a) (1) FGGS may not be initiated without judicial authorization and without 8
certifying before the court that the forensic sample and the criminal case satisfy the criteria 9
set forth in this section. 10
(2) If an FGGS is certified before a court in accordance with this section, 11
the court shall authorize the initiation of the FGGS. 12
(d) FGGS may only be conducted using a direct–to–consumer or publicly available 13
open–data personal genomics database that: 14
(1) provides explicit notice to its service users and the public that law 15
enforcement may use its service sites to investigate crimes or to identify human remains; 16
and 17
(2) seeks acknowledgement and EXPRESS consent from its service users 18
regarding the substance of the notice described in item (1) of this subsection. 19
17–103. 20
(a) A defendant in a criminal case charged with a crime of violence under § 21
14–101 of the Criminal Law Article or a defendant convicted of a crime of violence under § 22
14–101 of the Criminal Law Article and seeking postconviction DNA testing is entitled to 23
seek judicial authorization for an FGGS by filing an affidavit with a trial court or 24
postconviction court certifying that: 25
(4) an FGGS shall only be conducted using a direct–to–consumer or 26
publicly available open–data personal genomics database that: 27
(i) provides explicit notice to its service users and the public that 28
law enforcement may use its service sites to investigate crimes or to identify human 29
remains; and 30
(ii) seeks acknowledgment and EXPRESS consent from its service 31
users regarding the substance of the notice described in item (i) of this paragraph; 32
SECTION 2. AND BE IT F URTHER ENACTED, That this Act shall take effect 33
October 1, 2022. 34