LAWRENCE J. HOGAN, JR., Governor Ch. 501
– 1 –
Chapter 501
(House Bill 866)
AN ACT concerning
Commercial Law – Consumer Protection – Genetic Information Privacy
– Consumer Protection and Forensic Genealogy
FOR the purpose of regulating the use of genetic data by direct–to–consumer genetic testing
companies, including by requiring a direct–to–consumer genetic testing company to
provide consumers with certain information regarding the company’s policies and
procedures, obtain certain consents from consumers before collecting, using, or
disclosing the consumer’s genetic data, and develop and implement certain policies
and procedures to protect genetic data and provide for certain disclosures to law
enforcement and other government agencies; altering the direct–to–consumer or
publicly available open–data personal genomics databases that may be used to
conduct forensic genetic genealogical DNA analysis and search to require that the
databases seek express consent from their service users regarding the substance of
a certain notice; and generally relating to genetic information privacy.
BY repealing and reenacting, with amendments,
Article – Commercial Law
Section 13–301(14)(xxxiv) and (xxxv)
Annotated Code of Maryland
(2013 Replacement Volume and 2021 Supplement)
BY adding to
Article – Commercial Law
Section 13–301(14)(xxxvi); and 14–4401 through 14–4408 to be under the new
subtitle “Subtitle 44. Genetic Information Privacy Act”
Annotated Code of Maryland
(2013 Replacement Volume and 2021 Supplement)
BY repealing and reenacting, without amendments,
Article – Criminal Procedure
Section 17–101(a), (c), (e), and (g) and 17–102(a)
Annotated Code of Maryland
(2018 Replacement Volume and 2021 Supplement)
BY adding to
Article – Criminal Procedure
Section 17–101(c–1)
Annotated Code of Maryland
(2018 Replacement Volume and 2021 Supplement)
BY repealing and reenacting, with amendments, Ch. 501 2022 LAWS OF MARYLAND
– 2 –
Article – Criminal Procedure
Section 17–102(d) and 17–103(a)(4)
Annotated Code of Maryland
(2018 Replacement Volume and 2021 Supplement)
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND,
That the Laws of Maryland read as follows:
Article – Commercial Law
13–301.
Unfair, abusive, or deceptive trade practices include any:
(14) Violation of a provision of:
(xxxiv) The federal Servicemembers Civil Relief Act; [or]
(xxxv) [§] SECTION 11–210 of the Education Article; or
(XXXVI) TITLE 14, SUBTITLE 44 OF THIS ARTICLE; OR
SUBTITLE 44. GENETIC INFORMATION PRIVACY ACT.
14–4401.
(A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS
INDICATED.
(B) (1) “BIOLOGICAL SAMPLE ” MEANS A MATERIAL PAR T OR A
DERIVATIVE OF OR DIS CHARGE FROM A MATERI AL PART OF A HUMAN K NOWN TO
CONTAIN DNA.
(2) “BIOLOGICAL SAMPLE ” INCLUDES HUMAN TISSU E, BLOOD,
URINE, AND SALIVA.
(C) (1) “DEIDENTIFIED DATA ” MEANS DATA THAT :
(I) (1) CANNOT REASONABLY BE :
1. (I) USED TO INFER INFORMA TION ABOUT A CONSUME R;
OR
2. (II) LINKED TO AN IDENTIFI ABLE CONSUME R; AND
LAWRENCE J. HOGAN, JR., Governor Ch. 501
– 3 –
(2) IS SUBJECT TO:
(I) ADMINISTRATIVE AND TE CHNICAL MEASURES TO ENSURE
THAT THE DATA CANNOT BE ASSOCIATED WITH A PARTICULAR CONSUMER ;
(II) PUBLIC COMMITMENT BY THE COMPANY TO MAINT AIN AND
USE DATA IN A DEIDEN TIFIABLE FORM AND NO T ATTEMPT TO REIDENTIFY DATA ;
AND
(III) LEGALLY ENFORCEABLE C ONTRACTUAL OBLIGATIO NS
THAT PROHIBIT A RECI PIENT OF THE DATA FR OM ATTEMPTING TO REI DENTIFY THE
DATA.
(D) (1) “DIRECT–TO–CONSUMER GENETIC TES TING COMPANY ” MEANS
AN ENTITY THAT :
(1) (I) (1) OFFERS GENETIC TESTIN G PRODUCTS OR SERVIC ES
DIRECTLY TO A CONSUM ER; OR
(2) (II) (2) COLLECTS, USES, OR ANALYZES GENETIC DATA THAT
RESULTED FROM A DIRE CT–TO–CONSUMER GENETIC TES TING PRODUCT OR
SERVICE THAT WAS PROVIDED TO THE COMP ANY BY A CONSUMER .
(2) “DIRECT–TO–CONSUMER GENETIC TES TING COMPANY ” DOES NOT
INCLUDE AN ENTITY ON LY WHEN THE ENTITY I S ENGAGED IN COLLECT ING,
ANALYZING, RETAINING, OR DISCLOSING GENETI C DATA OR BIOLOGICAL SAMPLES
IN THE CONTEXT OF RE SEARCH, AS DEFINED IN 45 C.F.R. 164.501, CONDUCTED IN
ACCORDANCE WITH :
(I) THE FEDERAL POLICY FO R THE PROTECTION OF HUMAN
SUBJECTS ESTABLISHED IN 45 C.F.R. PART 46;
(II) THE GOOD CLINICAL PRACTICE GUIDELINES ISSUED BY
THE INTERNATIONAL COUNCIL FOR HARMONISATION ; OR
(III) THE U.S. FOOD AND DRUG ADMINISTRATION PROTECTION
OF HUMAN SUBJECTS UNDER 21 C.F.R. PARTS 50 AND 56.
(E) “DNA” MEANS DEOXYRIBONUCLE IC ACID.
(F) “EXPRESS CONSENT ” MEANS AN AFFIRMATIVE RESPONSE BY A
CONSUMER TO A SPECIF IC, DISCRETE, FREELY GIVEN, AND UNAMBIGUOUS NOTI CE
REGARDING THE COLLEC TION, USE, OR DISCLOSURE OF THE CONSUMER ’S GENETIC
DATA FOR A SPECIFIC PURPOSE. Ch. 501 2022 LAWS OF MARYLAND
– 4 –
(G) (1) “GENETIC DATA” MEANS DATA, IN ANY FORMAT, THAT CONCERNS
THE GENETIC CHARACTE RISTICS OF A CONSUME R.
(2) “GENETIC DATA” INCLUDES:
(I) RAW SEQUENCE DATA THAT RES ULT FROM SEQUENCING OF
A CONSUMER ’S COMPLETE EXTRACTED DNA OR A PORTION OF THE CONSUMER’S
COMPLETE EXTRACTED DNA;
(II) GENOTYPIC AND PHENOTY PIC INFORMATION THAT
RESULTS FROM ANALYZI NG RAW SEQUENCE DATA ; AND
(III) INFORMATION EXTRAPOLATED , DERIVED, OR INFERRED
FROM THE ANALYSIS OF RAW SEQUENCE DATA ; AND
(III) (IV) SELF–REPORTED HEALTH INFO RMATION SUBMITTED
TO A DIRECT –TO–CONSUMER GENETIC TES TING COMPANY BY A CO NSUMER
REGARDING THE CONSUM ER’S HEALTH CONDITIONS :
1. THAT IS USED FOR SCIENTIF IC RESEARCH OR
PRODUCT DEVELOPMENT ; AND
2. ANALYZED IN CONNECTIO N WITH THE CONSUMER ’S
RAW SEQUENCE DATA .
(3) “GENETIC DATA” DOES NOT INCLUDE DEI DENTIFIED DATA WHEN
USED FOR RESEARCH PR OJECTS.
(H) “GENETIC TESTING ” MEANS A LABORATORY TEST OF T HE COMPLETE
DNA, REGIONS OF DNA, CHROMOSOMES , GENES, OR GENE PRODUCTS OF A
CONSUMER TO DETERMIN E THE GENETIC CHARAC TERISTICS OF THE CON SUMER.
(I) “MARKETING” DOES NOT INCLUDE THE PROVIDING CUSTOMIZED
CONTENT OR OFFERS ON THE WEBSITES OR THROUGH THE APPLI CATIONS OR
SERVICES PROVIDED BY THE DIRECT–TO–CONSUMER GENETIC TES TING COMPANY
WITH THE FIRST–PARTY RELATIONSHIP T O THE CONSUMER .
14–4402.
THIS SUBTITLE DOES NO T APPLY TO::
LAWRENCE J. HOGAN, JR., Governor Ch. 501
– 5 –
(1) PROTECTED PROTECTED (1) PROTECTED HEALTH INFORMATION
THAT IS COLLECTED BY A COVERED ENTITY OR BUSINESS ASSOCIATE A S DEFINED IN
45 C.F.R. PARTS 160 AND 164;
(2) AN INSTITUTION OF HIG HER EDUCATION , AS DEFINED IN § 10–101
OF THE EDUCATION ARTICLE; OR
(3) AN ENTITY OWNED OR OP ERATED BY AN INSTITU TION OF HIGHER
EDUCATION, AS DEFINED IN § 10–101 OF THE EDUCATION ARTICLE.; OR
(2) GENETIC DATA OR BIOLO GICAL SAMPLES COLLEC TED FOR THE
PURPOSE OF RESEARCH , AS DEFINED IN 45 C.F.R. 164.501, THAT IS CONDUCTED IN
ACCORDANCE WITH :
(I) THE FEDERAL POLICY FO R THE PROTECTION OF HUMA N
SUBJECTS ESTABLISHED IN 45 C.F.R. PART 46;
(II) THE GOOD CLINICAL PRACTICE GUIDELINES ISSUED BY
THE INTERNATIONAL COUNCIL FOR HARMONISATION ; OR
(III) THE U.S. FOOD AND DRUG ADMINISTRATION PROTECTION
OF HUMAN SUBJECTS UNDER 21 C.F.R. PARTS 50 AND 56.
14–4403.
(A) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL P ROVIDE
A CONSUMER WITH CLEA R AND COMPLETE INFOR MATION REGARDING THE
COMPANY’S POLICIES AND PROCE DURES FOR COLLECTING , USING, OR DISCLOSING
GENETIC DATA , INCLUDING:
(1) A HIGH–LEVEL OVERVIEW OF TH E COMPANY’S PRIVACY POLICY
THAT INCLUDES BASIC AND ESSENTIAL INFORM ATION ABOUT HOW THE COMPANY
COLLECTS, USES, AND DISCLOSES GENETI C DATA; AND
(2) A PRIVACY NOTICE THAT , AT A MINIMUM , INCLUDES
INFORMATION ABOUT TH E COMPANY’S DATA COLLECTION , CONSENT, USE, ACCESS,
DISCLOSURE, TRANSFER, SECURITY, AND RETENTION AND DE LETION PRACTICES .
(B) THE INFORMATION REQUI RED TO BE PROVIDED U NDER SUBSECTION (A)
OF THIS SECTION SHAL L BE:
(1) MADE PUBLICLY AVAILAB LE; AND
Ch. 501 2022 LAWS OF MARYLAND
– 6 –
(2) PLACED IN A PROMINENT AR EA OF THE DIRECT –TO–CONSUMER
GENETIC TESTING COMP ANY’S WEBSITE.
14–4404.
A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY , AT A MINIMUM ,
SHALL OBTAIN THE FOL LOWING CONSENTS FROM A CONSUMER BEFORE
COLLECTING , USING, OR DISCLOSING THE CO NSUMER’S GENETIC DATA :
(1) INITIAL EXPRESS CONSE NT THAT CLEARLY :
(I) DESCRIBES THE USES OF THE GENETIC DATA COL LECTED
THROUGH THE GENETIC TESTING PRODUCT OR S ERVICE; AND
(II) SPECIFIES:
1. WHO HAS ACCESS TO THE RESULTS OF THE GENET IC
TESTING; AND
2. HOW THE GENETIC DATA MAY BE SHARED ;
(2) EXPRESS CONSENT FOR T RANSFERRING OR DISCL OSING THE
CONSUMER ’S GENETIC DATA TO A PERSON OTHER THAN TH E COMPANY’S VENDORS
AND SERVICE PROVIDER S;
(3) EXPRESS CONSENT FOR U SING GENETIC DATA BE YOND THE
PRIMARY PURPOSE OF T HE GENETIC TESTING P RODUCT OR SERVICE RE QUESTED BY
THE CONSUMER ;
(4) EXPRESS CONSENT FOR T HE RETENTION OF A BI OLOGICAL
SAMPLE PROVIDED BY T HE CONSUMER AFTER TH E INITIAL TESTING SE RVICE
REQUESTED BY THE CON SUMER IS COMPLETED ;
(5) EXPRESS CONSENT TO BE MARKETED TO BY :
(I) THE DIRECT–TO–CONSUMER GENETIC TES TING COMPANY
BASED ON THE CONSUME R’S GENETIC DATA ; AND
(II) A THIRD PARTY BASED ON THE CONSUMER HAVING
ORDERED OR PURCHASED A GENETIC TESTING PR ODUCT OR SERVICE ; AND
(6) INFORMED CONSENT IN C OMPLIANCE WITH THE F EDERAL POLICY
FOR THE PROTECTION O F HUMAN RESEARCH SUB JECTS FOR TRANSFER O R
DISCLOSURE OF THE CO NSUMER’S GENETIC DATA TO TH IRD PARTIES FOR LAWRENCE J. HOGAN, JR., Governor Ch. 501
– 7 –
RESEARCH PURPOSES OR RESEARCH CONDUCTED U NDER THE CONTROL OF THE
COMPANY FOR THE PURPOSE OF P UBLICATION OR GENERA LIZABLE KNOWLEDGE .
14–4405.
(A) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL
ESTABLISH LEGAL POLI CIES AND PROCESSES F OR DISCLOSING GENETI C DATA TO
LAW ENFORCEMENT OR A NOTHER GOVERNMENT AG ENCY WITHOUT A CONS UMER’S
EXPRESS WRITTEN CONS ENT.
(B) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL
DEVELOP, IMPLEMENT, AND MAINTAIN A COMPR EHENSIVE SECURITY PR OGRAM TO
PROTECT CONSUMERS ’ GENETIC DATA AGAINST UNAUTHORIZED ACCESS , USE, OR
DISCLOSURE.
(C) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL
ESTABLISH A PROCESS FOR A CONSUMER TO :
(1) ACCESS THE CONSUMER ’S GENETIC DATA ;
(2) DELETE THE CONSUMER ’S ACCOUNT AND GENETI C DATA; AND
(3) REQUEST THE DESTRUCTI ON OF THE CONSUMER ’S BIOLOGICAL
SAMPLE.
(D) NOTWITHSTANDING ANY O THER PROVISIONS OF L AW, A
DIRECT–TO–CONSUMER GENETIC TES TING COMPANY MAY NOT , WITHOUT THE
CONSUMER ’S WRITTEN CONSENT , DISCLOSE A CONSUMER ’S GENETIC DATA TO :
(1) AN ENTITY OFFERING HE ALTH INSURANCE , LIFE INSURANCE ,
DISABILITY INSURA NCE, OR LONG–TERM CARE INSURANCE ; OR
(2) AN EMPLOYER OF THE CO NSUMER.
14–4406.
(A) A VIOLATION OF THIS SE CTION IS AN UNFAIR , ABUSIVE, OR DECEPTIVE
TRADE PRACTICE WITHI N THE MEANING OF TITLE 13 OF THIS ARTICLE AND IS
SUBJECT TO THE ENFOR CEMENT AND PENALTY PROVISIONS C ONTAINED IN TITLE
13 OF THIS ARTICLE.
(B) THIS SECTION DOES NOT PREVENT AN INDIVIDUA L FROM PURSUING
ANY OTHER REMEDY PRO VIDED BY LAW.
Ch. 501 2022 LAWS OF MARYLAND
– 8 –
14–4407.
THE DISCLOSURE OF GEN ETIC DATA IN ACCORDA NCE WITH THIS SUBTIT LE
SHALL COMPLY WITH AL L STATE AND FEDERAL LAWS FOR THE PROTECTION O F
PRIVACY AND SECURITY .
14–4408.
THIS SUBTITLE MAY BE KNOWN AND CITED AS T HE MARYLAND GENETIC
INFORMATION PRIVACY ACT.
Article – Criminal Procedure
17–101.
(a) In this title the following words have the meanings indicated.
(c) “Direct–to–consumer genetic genealogy services” means genetic genealogy
services that are offered by private companies directly to members of the public and law
enforcement agencies rather than through clinical health care providers, typically via
customer access to secure online websites.
(C–1) “EXPRESS CONSENT ” HAS THE MEANING STAT ED IN § 14–4401 OF THE
COMMERCIAL LAW ARTICLE.
(e) “Forensic genetic genealogical DNA analysis and search” or “FGGS” means:
(1) the forensic genetic genealogical DNA analysis of biological material
using SNP or other sequencing techniques to develop an FGG profile;
(2) a subsequent search using the FGG profile in a publicly available
open–data personal genomics database or a direct–to–consumer genetic genealogy service
to find individuals related to the source of the FGG profile; and
(3) a genealogical search using public records and other lawful means to
obtain information in accordance with this title.
(g) “Publicly available open–data personal genomics database” means a database
in which persons voluntarily submit their genomics data or genetic profiles, typically
processed through direct–to–consumer genetic genealogy services, for the purposes of
comparison or searching against the genetic profiles of other individuals to evaluate
potential familial relationships between the reference sample and other service user
samples.
17–102. LAWRENCE J. HOGAN, JR., Governor Ch. 501
– 9 –
(a) (1) FGGS may not be initiated without judicial authorization and without
certifying before the court that the forensic sample and the criminal case satisfy the criteria
set forth in this section.
(2) If an FGGS is certified before a court in accordance with this section,
the court shall authorize the initiation of the FGGS.
(d) FGGS may only be conducted using a direct–to–consumer or publicly available
open–data personal genomics database that:
(1) provides explicit notice to its service users and the public that law
enforcement may use its service sites to investigate crimes or to identify human remains;
and
(2) seeks acknowledgement and EXPRESS consent from its service users
regarding the substance of the notice described in item (1) of this subsection.
17–103.
(a) A defendant in a criminal case charged with a crime of violence under §
14–101 of the Criminal Law Article or a defendant convicted of a crime of violence under §
14–101 of the Criminal Law Article and seeking postconviction DNA testing is entitled to
seek judicial authorization for an FGGS by filing an affidavit with a trial court or
postconviction court certifying that:
(4) an FGGS shall only be conducted using a direct–to–consumer or
publicly available open–data personal genomics database that:
(i) provides explicit notice to its service users and the public that
law enforcement may use its service sites to investigate crimes or to identify human
remains; and
(ii) seeks acknowledgment and EXPRESS consent from its service
users regarding the substance of the notice described in item (i) of this paragraph;
SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect
October 1, 2022.
Enacted under Article II, § 17(c) of the Maryland Constitution, May 29, 2022.