EXPLANATION: CAPITALS INDICATE MAT TER ADDED TO EXISTIN G LAW.
[Brackets] indicate matter deleted from existing law.
*sb0766*
SENATE BILL 766
I3 2lr2890
CF HB 866
By: Senator Sydnor
Introduced and read first time: February 7, 2022
Assigned to: Finance
A BILL ENTITLED
AN ACT concerning 1
Commercial Law – Consumer Protection – Genetic Information Privacy 2
FOR the purpose of regulating the use of genetic data by direct–to–consumer genetic testing 3
companies, including by requiring a direct–to–consumer genetic testing company to 4
provide consumers with certain information regarding the company’s policies and 5
procedures, obtain certain consents from consumers before collecting, using, or 6
disclosing the consumer’s genetic data, and develop and implement certain policies 7
and procedures to protect genetic data and provide for certain disclosures to law 8
enforcement and other government agencies; and generally relating to genetic 9
information privacy. 10
BY repealing and reenacting, with amendments, 11
Article – Commercial Law 12
Section 13–301(14)(xxxiv) and (xxxv) 13
Annotated Code of Maryland 14
(2013 Replacement Volume and 2021 Supplement) 15
BY adding to 16
Article – Commercial Law 17
Section 13–301(14)(xxxvi); and 14–4401 through 14–4408 to be under the new 18
subtitle “Subtitle 44. Genetic Information Privacy Act” 19
Annotated Code of Maryland 20
(2013 Replacement Volume and 2021 Supplement) 21
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 22
That the Laws of Maryland read as follows: 23
Article – Commercial Law 24
13–301. 25
2 SENATE BILL 766
Unfair, abusive, or deceptive trade practices include any: 1
(14) Violation of a provision of: 2
(xxxiv) The federal Servicemembers Civil Relief Act; [or] 3
(xxxv) [§] SECTION 11–210 of the Education Article; or 4
(XXXVI) TITLE 14, SUBTITLE 44 OF THIS ARTICLE; OR 5
SUBTITLE 44. GENETIC INFORMATION PRIVACY ACT. 6
14–4401. 7
(A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS 8
INDICATED. 9
(B) (1) “BIOLOGICAL SAMPLE ” MEANS A MATERIAL PART OR A 10
DERIVATIVE OF OR DISCHARGE FROM A MATERIAL PART OF A HUMAN KNOWN TO 11
CONTAIN DNA. 12
(2) “BIOLOGICAL SAMPLE ” INCLUDES HUMAN TISSUE, BLOOD, 13
URINE, AND SALIVA. 14
(C) (1) “DEIDENTIFIED DATA ” MEANS DATA THAT : 15
(I) CANNOT REASONABLY BE : 16
1. USED TO INFER INFORMA TION ABOUT A CONSUME R; 17
OR 18
2. LINKED TO AN IDENTIFIABLE CONSUME R; AND 19
(2) IS SUBJECT TO: 20
(I) ADMINISTRATIVE AND TE CHNICAL MEASURES TO ENSURE 21
THAT THE DATA CANNOT BE ASSOCIATED WITH A PARTICULAR CONSUMER ; 22
(II) PUBLIC COMMITMENT BY THE COMPANY TO MAINT AIN AND 23
USE DATA IN A DEIDENTIFIABLE FORM AND NOT ATTEMPT TO REIDENTIFY DATA ; 24
AND 25
SENATE BILL 766 3
(III) LEGALLY ENFORCEABLE C ONTRACTUAL OBLIGATIO NS 1
THAT PROHIBIT A RECI PIENT OF THE DATA FR OM ATTEMPTING TO REI DENTIFY THE 2
DATA. 3
(D) “DIRECT–TO–CONSUMER GENETIC TES TING COMPANY ” MEANS AN 4
ENTITY THAT: 5
(1) OFFERS GENETIC TESTIN G PRODUCTS OR SERVIC ES DIRECTLY TO 6
A CONSUMER ; OR 7
(2) COLLECTS, USES, OR ANALYZES GENETIC DATA PROVIDED TO THE 8
COMPANY BY A CONSUMER . 9
(E) “DNA” MEANS DEOXYRIBONUCLE IC ACID. 10
(F) “EXPRESS CONSENT ” MEANS A N AFFIRMATIVE RESPONSE BY A 11
CONSUMER TO A SPECIFIC, DISCRETE, FREELY GIVEN, AND UNAMBIGUOUS NOTICE 12
REGARDING THE COLLEC TION, USE, OR DISCLOSURE OF THE CONSUMER ’S GENETIC 13
DATA FOR A SPECIFIC PURPOSE. 14
(G) (1) “GENETIC DATA” MEANS DATA, IN ANY FORMAT, THAT CONCERNS 15
THE GENETIC CHARACTERIST ICS OF A CONSUMER . 16
(2) “GENETIC DATA” INCLUDES: 17
(I) RAW SEQUENCE DATA THA T RESULT FROM SEQUEN CING OF 18
A CONSUMER ’S COMPLETE EXTRACTED DNA OR A PORTION OF THE CONSUMER’S 19
COMPLETE EXTRACTED DNA; 20
(II) GENOTYPIC AND PHENOTY PIC INFORMATION THAT 21
RESULTS FROM ANALYZI NG RAW SEQUENCE DATA ; AND 22
(III) SELF–REPORTED HEALTH INFO RMATION SUBMITTED TO A 23
DIRECT–TO–CONSUMER GENETIC TES TING COMPANY BY A CONSUMER REGARDING 24
THE CONSUMER ’S HEALTH CONDITIONS : 25
1. THAT IS USED FOR SCIENTIFIC RESEARCH OR 26
PRODUCT DEVELOPMENT ; AND 27
2. ANALYZED IN CONNECTIO N WITH THE CONSUMER ’S 28
RAW SEQUENCE DATA . 29
(3) “GENETIC DATA” DOES NOT INCLUDE DEIDENTIFIED DATA. 30 4 SENATE BILL 766
(H) “GENETIC TESTING ” MEANS A LABORATORY T EST OF THE COMPLETE 1
DNA, REGIONS OF DNA, CHROMOSOMES , GENES, OR GENE PRODUCTS OF A 2
CONSUMER TO DETERMINE THE GEN ETIC CHARACTERISTICS OF THE CONSUMER . 3
(I) “MARKETING” DOES NOT INCLUDE THE PROVIDING CUSTOMIZED 4
CONTENT OR OFFERS ON THE WEBSITES OR THRO UGH THE APPLICA TIONS OR 5
SERVICES PROVIDED BY THE DIRECT–TO–CONSUMER GENETIC TES TING COMPANY 6
WITH THE FIRST–PARTY RELATIONSHIP T O THE CONSUMER . 7
14–4402. 8
THIS SUBTITLE DOES NO T APPLY TO: 9
(1) PROTECTED HEALTH INFO RMATION THAT IS COLL ECTED BY A 10
COVERED ENTITY OR BUSINESS ASSOCIATE A S DEFINED IN 45 C.F.R. PARTS 160 11
AND 164; 12
(2) AN INSTITUTION OF HIGHE R EDUCATION, AS DEFINED IN § 10–101 13
OF THE EDUCATION ARTICLE; OR 14
(3) AN ENTITY OWNED OR OP ERATED BY AN INSTITUTION OF HIGHE R 15
EDUCATION, AS DEFINED IN § 10–101 OF THE EDUCATION ARTICLE. 16
14–4403. 17
(A) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL PROVIDE 18
A CONSUMER WITH CLEAR AND COMPLETE I NFORMATION REGARDING THE 19
COMPANY’S POLICIES AND PROCE DURES FOR COLLECTING, USING, OR DISCLOSING 20
GENETIC DATA , INCLUDING: 21
(1) A HIGH–LEVEL OVERVIEW OF THE COMP ANY’S PRIVACY POLICY 22
THAT INCLUDES BASIC AND ESSENTIAL INFORMATIO N ABOUT HOW THE COMPANY 23
COLLECTS, USES, AND DISCLOSES GENETI C DATA; AND 24
(2) A PRIVACY NOTICE THAT , AT A MINIMUM , INCLUDES 25
INFORMATION ABOUT TH E COMPANY’S DATA COLLECTION , CONSENT, USE, ACCESS, 26
DISCLOSURE, TRANSFER, SECURITY, AND RETENTION AND DELETI ON PRACTICES. 27
(B) THE INFORMATION REQUI RED TO BE PROVIDED UNDER SUBSECTION (A) 28
OF THIS SECTION SHAL L BE: 29
(1) MADE PUBLICLY AVAILAB LE; AND 30 SENATE BILL 766 5
(2) PLACED IN A PROMINENT AREA OF THE DIRECT–TO–CONSUMER 1
GENETIC TESTING COMP ANY’S WEBSITE. 2
14–4404. 3
A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY , AT A MINIMUM , 4
SHALL O BTAIN THE FOLLOWING CONSEN TS FROM A CONSUMER B EFORE 5
COLLECTING, USING, OR DISCLOSING THE CONSUMER ’S GENETIC DATA: 6
(1) INITIAL EXPRESS CONSE NT THAT CLEARLY : 7
(I) DESCRIBES THE USES OF THE GENET IC DATA COLLECTED 8
THROUGH THE GENETIC TESTING PRODUCT OR S ERVICE; AND 9
(II) SPECIFIES: 10
1. WHO HAS ACCESS TO THE RESULTS OF THE G ENETIC 11
TESTING; AND 12
2. HOW THE GENETIC DATA MAY BE SHARED; 13
(2) EXPRESS CONSENT FOR T RANSFERRING OR DISCL OSING THE 14
CONSUMER ’S GENETIC DATA TO A PERSON OTHER THAN TH E COMPANY’S VENDORS 15
AND SERVICE PROVIDER S; 16
(3) EXPRESS CONSENT FOR USING GENETIC DATA B EYOND THE 17
PRIMARY PURPOSE OF T HE GENETIC TESTING P RODUCT OR SERVICE RE QUESTED BY 18
THE CONSUMER ; 19
(4) EXPRESS CONSENT FOR T HE RETENTION OF A BIOLOGICAL 20
SAMPLE PROVIDED BY T HE CONSUMER AFTER THE INITIAL TE STING SERVICE 21
REQUESTED BY THE CONSUMER IS COMPLETE D; 22
(5) EXPRESS CONSENT TO BE MARKETED TO BY : 23
(I) THE DIRECT–TO–CONSUMER GENETIC TES TING COMPANY 24
BASED ON THE CONSUME R’S GENETIC DATA; AND 25
(II) A THIRD PARTY BASED ON THE CONSUMER HAVING 26
ORDERED OR PURCHASED A GENETIC TESTING PR ODUCT OR SERVICE ; AND 27
6 SENATE BILL 766
(6) INFORMED CONSENT IN C OMPLIANCE WITH THE F EDERAL POLICY 1
FOR THE PROTECTION O F HUMAN RESEARCH SUB JECTS FOR TRANSFER O R 2
DISCLOSURE OF THE CO NSUMER’S GENETIC DATA TO THIRD PARTIES FOR 3
RESEARCH PURPOSES OR RESEARCH CONDUCTED U NDER THE CONTROL OF THE 4
COMPANY FOR THE PURPOSE OF PUBLI CATION OR GENERALIZA BLE KNOWLEDGE . 5
14–4405. 6
(A) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL 7
ESTABLISH LEGAL POLICIES AND PROCESS ES FOR DISCLOSING GENET IC DATA TO 8
LAW ENFORCEMENT OR A NOTHER GOVERNMENT AGE NCY WITHOUT A CONSUM ER’S 9
EXPRESS WRITTEN CONS ENT. 10
(B) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL 11
DEVELOP, IMPLEMENT, AND MAINTAIN A COMPR EHENSIVE SECURITY PR OGRAM TO 12
PROTECT CONSUMERS ’ GENETIC DATA AGAINST UNAUTHORIZED ACCESS, USE, OR 13
DISCLOSURE. 14
(C) A DIRECT–TO–CONSUMER GENETIC TES TING COMPANY SHALL 15
ESTABLISH A PROCESS FOR A CONS UMER TO: 16
(1) ACCESS THE CONSUMER ’S GENETIC DATA; 17
(2) DELETE THE CONSUMER ’S ACCOUNT AND GENETI C DATA; AND 18
(3) REQUEST THE DESTRUCTI ON OF THE CONSUMER ’S BIOLOGICAL 19
SAMPLE. 20
(D) NOTWITHSTANDING ANY O THER PROVISIONS OF L AW, A 21
DIRECT–TO–CONSUMER GENETIC TES TING COMPANY MAY NOT , WITHOUT THE 22
CONSUMER ’S WRITTEN CONSENT , DISCLOSE A CONSUMER ’S GENETIC DATA TO : 23
(1) AN ENTITY OFFERING HEAL TH INSURANCE , LIFE INSURANCE , OR 24
LONG–TERM CARE INSURANCE; OR 25
(2) AN EMPLOYER OF THE CONS UMER. 26
14–4406. 27
(A) A VIOLATION OF THIS SE CTION IS AN UNFAIR , ABUSIVE, OR DECEPTIVE 28
TRADE PRACTICE WITHI N THE MEANING OF TITLE 13 OF THIS ARTICLE AND IS 29
SUBJECT TO THE ENFOR CEMENT AND PENALTY P ROVISIONS CONTAINED IN TITLE 30
13 OF THIS ARTICLE. 31 SENATE BILL 766 7
(B) THIS SECTION DOES NOT PREVENT AN INDIVIDUA L FROM PURSUING 1
ANY OTHER REMEDY PRO VIDED BY LAW. 2
14–4407. 3
THE DISCLOSURE OF GEN ETIC DATA IN ACCORDA NCE WITH THIS S UBTITLE 4
SHALL COMPLY WITH AL L STATE AND FEDERAL LAW S FOR THE PROTECTION OF 5
PRIVACY AND SECURITY . 6
14–4408. 7
THIS SUBTITLE MAY BE KNOWN AND CITED AS T HE MARYLAND GENETIC 8
INFORMATION PRIVACY ACT. 9
SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect 10
October 1, 2022. 11