****
69th Legislature 2025 SB 163.1
- 1 - Authorized Print Version – SB 163
1 SENATE BILL NO. 163
2 INTRODUCED BY D. ZOLNIKOV
3
4 A BILL FOR AN ACT ENTITLED: “AN ACT REVISING THE GENETIC INFORMATION PRIVACY ACT;
5 INCLUDING NEURAL DATA IN THE SCOPE OF THE GENETIC INFORMATION PRIVACY ACT; ADDING
6 LEGISLATIVE FINDINGS AND PURPOSE TO THE ACT; REVISING PROVISIONS RELATING TO
7 EXCEPTIONS; ADDING PROTECTIONS FOR THE PRIVACY OF NEURAL DATA; REVISING PROVISIONS
8 RELATING TO PRIVACY NOTICES; PROVIDING A DEFINITION; AND AMENDING SECTIONS 30-23-101,
9 30-23-102, 30-23-103, 30-23-104, 30-23-105, AND 44-6-104, MCA.”
10
11 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:
12
13 Section 30-23-101, MCA, is amended to read:
14 "30-23-101. (1) This part may be
15 cited as the "Genetic Information Privacy Act".
16 (2) The legislature finds and declares that:
17 (a) (i) the people of Montana regard their privacy as a fundamental right and an essential element
18 of individual freedom; and
19 (ii) Article II, section 10, of the Montana constitution protects individuals' privacy, and fundamental
20 privacy rights have long been, and continue to be, integral to protecting Montanans;
21 (b) ongoing advances in technology have produced exponential growth in the volume and variety
22 of personal data being generated, collected, stored, and analyzed, and these advances present both great
23 promise and potential risks;
24 (c) technology that collects data about the user's bodily and mental functions is transforming the
25 volume and sensitivity of personal data collected from individuals and stored by companies;
26 (d) neurotechnologies, including devices capable of recording, interpreting, and altering the
27 response of an individual's central or peripheral nervous system to its internal or external environment, raise
28 particularly pressing privacy concerns given their ability to monitor, decode, and manipulate brain activity; ****
69th Legislature 2025 SB 163.1
- 2 - Authorized Print Version – SB 163
1 (e) data concerning the activity of the human brain and wider nervous systems, or "neural data", is
2 extremely sensitive and can reveal intimate information about individuals, including information about health,
3 mental states, emotions, and cognitive functioning;
4 (f) each human brain is unique, meaning that neural data is specific to the individual from whom it
5 is collected. Because neural data contains distinctive information about the structure and functioning of
6 individual brains and nervous systems, it contains sensitive information that may link the data to an identified or
7 identifiable individual.
8 (g) the collection of neural data involves the involuntary disclosure of information. Even if
9 individuals consent to the collection and processing of their data for narrow use, they are unlikely to be fully
10 aware of the content or quality of information they are sharing.
11 (h) neurotechnology users cannot decide what specific neural information they would like to
12 disclose, and they are unlikely to understand the extent to which their neural data can be decoded, currently or
13 in the future. Neurotechnologies can collect and process information about an individual that the individual did
14 not even know existed.
15 (i) neurotechnologies that are deployed in medical settings or otherwise utilize the surgical
16 implantation of invasive devices are typically regulated as medical tools that produce health information. Both
17 invasive and noninvasive wearable neurotechnologies used in medical settings are also regulated by health
18 data privacy laws. However, when noninvasive neurotechnologies are used outside of medical settings, they
19 are generally considered consumer products and operate without regulation or data protection standards."
20
21 Section 30-23-102, MCA, is amended to read:
22 "30-23-102. As used in this part, unless the context clearly indicates otherwise, the
23 following definitions apply:
24 (1) "Biological sample" means any human material known to contain DNA, including tissue, blood,
25 urine, or saliva.
26 (2) "Consumer" means an individual who is a resident of this state.
27 (3) "DNA" means deoxyribonucleic acid.
28 (4) "Entity" means a partnership, corporation, association, or public or private organization of any ****
69th Legislature 2025 SB 163.1
- 3 - Authorized Print Version – SB 163
1 character that:
2 (a) offers consumer genetic testing products or services directly to a consumer; or
3 (b) collects, uses, or analyzes genetic data.
4 (5) "Express consent" means a consumer's affirmative response to a clear, meaningful, and
5 prominent notice regarding the collection, use, or disclosure of genetic data for a specific purpose.
6 (6) (a) "Genetic data" means any data, regardless of format, concerning a consumer's genetic
7 characteristics.
8 (b) The term includes but is not limited to:
9 (i) raw sequence data that result from sequencing all or a portion of a consumer's extracted DNA;
10 (ii) genotypic and phenotypic information obtained from analyzing a consumer's raw sequence
11 data; and
12 (iii) self-reported health information regarding a consumer's health conditions that the consumer
13 provides to an entity that the entity:
14 (A) uses for scientific research or product development; and
15 (B) analyzes in connection with the consumer's raw sequence data.
16 (7) "Genetic testing" means:
17 (a) a laboratory test of a consumer's complete DNA, regions of DNA, chromosomes, genes, or
18 gene products to determine the presence of genetic characteristics of a consumer; or
19 (b) an interpretation of a consumer's genetic data.
20 (8) "Governmental agency" means an executive, legislative, or judicial agency, department, board,
21 commission, authority, institution, or instrumentality of the federal government or of a state or of a county,
22 municipality, or other political subdivision of a state.
23 (9) "Neural data" means information that is generated by the measurement of the activity of an
24 individual's central or peripheral nervous systems and that can be processed by or with the assistance of a
25 device.
26 (9)(10) "Person" means an individual, partnership, corporation, association, business, business trust,
27 or legal representative of an organization.
28 (10)(11)"Processor" means a person that processes genetic data on behalf of an entity pursuant to a ****
69th Legislature 2025 SB 163.1
- 4 - Authorized Print Version – SB 163
1 contract between the entity and the processor that prohibits the processor from retaining, using, or disclosing
2 the genetic data, or any information regarding the identity of the consumer, including whether that consumer
3 has solicited or received genetic testing, as applicable, for any purpose other than for the specific purpose of
4 performing the services specified in the contract.
5 (11)(12)"Third party" means a person other than the consumer, entity, or processor."
6
7 Section 30-23-103, MCA, is amended to read:
8 "30-23-103. (1) This part does not apply to:
9 (a) protected health information that is collected by a covered entity or business associate as
10 those terms are defined in 45 CFR, parts 160 and 164, if separate informed consent related to the collection,
11 use, and dissemination of genetic or neural data is obtained from the consumer, parent, guardian, or power of
12 attorney, and the covered entity or business associate follows the policies under 30-23-104(6)(a) through (6)(d);
13 (b) an entity when it is engaged only in collecting, using, or analyzing genetic or neural data or
14 biological samples in the context of research as defined in 45 CFR 164.501 conducted with the express
15 consent of an individual and in accordance with:
16 (i) the federal policy for the protection of human research subjects under 45 CFR, part 46, the
17 good clinical practice guideline issued by the international council for harmonisation of technical requirements
18 for pharmaceuticals for human use; or
19 (ii) the United States food and drug administration policy for the protection of human subjects
20 under 21 CFR, parts 50 and 56; or
21 (c) uses by a governmental agency.
22 (2) Beginning June 1, 2025, any Any collection, storage, use, or dissemination of genetic or neural
23 data by a governmental agency must be performed in accordance with a specific state law or executed through
24 a search warrant or investigative subpoena issued pursuant to 46-4-301."
25
26 Section 30-23-104, MCA, is amended to read:
27 "30-23-104.
28 To safeguard the privacy, confidentiality, security, and integrity of a consumer's genetic or neural ****
69th Legislature 2025 SB 163.1
- 5 - Authorized Print Version – SB 163
1 data, an entity shall:
2 (1) provide clear and complete information regarding the entity's policies and procedures for the
3 collection, use, or disclosure of genetic or neural data by making available to a consumer:
4 (a) a high-level privacy policy overview that includes basic, essential information about the entity's
5 collection, use, or disclosure of genetic or neural data; and
6 (b) a prominent, publicly available privacy notice that includes, at a minimum, information about the
7 entity's data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices
8 for genetic or neural data;
9 (2) obtain initial express consent from a consumer, parent, guardian, or power of attorney for the
10 collection, use, or disclosure of the consumer's genetic or neural data that:
11 (a) clearly describes the entity's use of the genetic or neural data that the entity collects through
12 the entity's genetic testing product or service;
13 (b) specifies the categories of individuals within the entity that have access to test results; and
14 (c) specifies how the entity may share the genetic or neural data;
15 (3) if the entity engages in any of the following, obtain a consumer's:
16 (a) separate express consent for:
17 (i) the transfer or disclosure of the consumer's genetic or neural data or biological sample to any
18 third party other than the entity's processors, including the name of the third party to which the consumer's
19 genetic or neural data or biological sample will be transferred or disclosed with the consumer's express
20 consent;
21 (ii) the use of genetic or neural data beyond the primary purpose of the entity's genetic testing
22 product or service and inherent contextual uses; or
23 (iii) the entity's retention of any biological sample provided by the consumer following the entity's
24 completion of the initial testing service requested by the consumer;
25 (b) informed express consent for transfer or disclosure of the consumer's genetic or neural data to
26 third party persons for:
27 (i) research purposes; or
28 (ii) research conducted under the control of the entity for the purpose of publication or ****
69th Legislature 2025 SB 163.1
- 6 - Authorized Print Version – SB 163
1 generalizable knowledge; and
2 (c) express consent for:
3 (i) marketing to a consumer based on the consumer's genetic or neural data;
4 (ii) marketing by a third-party person to a consumer based on the consumer having ordered or
5 purchased a genetic testing product or service. Marketing does not include the provision of customized content
6 or offers on the websites or through the applications or services provided by the entity with the first-party
7 relationship to the consumer; or
8 (iii) sale or other valuable consideration of the consumer's genetic or neural data.
9 (4) comply with the provisions of 44-6-104 requiring a valid legal process for disclosing genetic or
10 neural data to law enforcement or any other government agency without a consumer's express consent;
11 (5) develop, implement, and maintain a comprehensive security program to protect a consumer's
12 genetic or neural data against unauthorized access, use, or disclosure; and
13 (6) provide a process for a consumer to:
14 (a) access the consumer's genetic or neural data;
15 (b) delete the consumer's genetic or neural data;
16 (c) revoke any consent provided by the consumer; and
17 (d) request and obtain the destruction of the consumer's biological sample.
18 (7) The requirements of subsections (6)(a) through (6)(d) must be waived if:
19 (a) the entity obtains express and informed written consent from a consumer, parent, guardian, or
20 power of attorney for participation in a clinical research trial, including the collection and use of any genetic or
21 neural data, which at a minimum must:
22 (i) be in accordance with the good clinical practice guideline issued by the international council for
23 harmonisation of technical requirements for pharmaceuticals for human use;
24 (ii) be obtained no sooner than 14 days from the initial biological sample collection if the biological
25 sample is collected for a primary purpose unrelated to clinical research;
26 (iii) be obtained separately from any other items of consent;
27 (iv) be in writing on a form with text that is easily readable with size 12-point font or larger;
28 (v) include the entity's biological sample and data retention, sharing, and use policies; ****
69th Legislature 2025 SB 163.1
- 7 - Authorized Print Version – SB 163
1 (vi) include notice that after consent is given, there is no right to access, inspect, or require the
2 destruction of any genetic or neural biological sample or data; and
3 (vii) include notice that after consent is given, whole genome sequencing of the individual's
4 biological sample could occur and is permitted without further notice to the individual;
5 (b) the genetic or neural biological sample and data is utilized for clinical research purposes only.
6 (8) The requirements of subsection (6)(d) must be temporarily waived if:
7 (a) a laboratory is governed under 42 CFR 493.1105;
8 (b) the laboratory retains the biological sample for no more than 2 years or the shortest time
9 allowed under law, whichever is less;
10 (c) the laboratory does not share, test, or conduct additional analysis or research on the biological
11 sample while the sample is being held under the retention requirements set forth in 42 CFR 493.1105 prior to
12 the requested destruction of the sample; and
13 (d) when a clinical laboratory is certified by the centers for medicare and medicaid services, when
14 the retention of a patient's biological sample does not exceed the time needed for compliance with any quality
15 standard or regulation issued pursuant to section 263(a) of the Public Health Service Act, 42 U.S.C. 263(a).
16 (9) The requirements of subsection (7) supersede all exceptions to, and waivers of, informed
17 consent in the federal policy for the protection of human subjects under 45 CFR, part 46.
18 (7)(10) Genetic or neural data and biometric samples of Montana residents collected in the state may
19 not be stored within the territorial boundaries of any country currently sanctioned in any way by the United
20 States office of foreign asset control or designated as a foreign adversary under 15 CFR 7.4(a). Genetic or
21 neural data or biometric data of Montana residents collected in the state may only be transferred or stored
22 outside the United States with the consent of the resident."
23
24 Section 30-23-105, MCA, is amended to read:
25 "30-23-105. (1) The disclosure
26 of genetic or neural data pursuant to this part must comply with all state and federal laws for the protection of
27 privacy and security.
28 (2) Notwithstanding any other provisions in 30-23-104, an entity may not disclose a consumer's ****
69th Legislature 2025 SB 163.1
- 8 - Authorized Print Version – SB 163
1 genetic or neural data to any entity offering health insurance, life insurance, or long-term care insurance, or to
2 any employer of the consumer without the consumer's express consent."
3
4 Section 44-6-104, MCA, is amended to read:
5 "44-6-104.
6 (1) A government entity may not obtain DNA or neural search results from a consumer DNA
7 or neural database:
8 (a) without a search warrant or investigative subpoena issued by a court on a finding of probable
9 cause; or
10 (b) unless the consumer whose information is sought previously waived the consumer's right to
11 privacy in the information.
12 (2) A government entity may not obtain familial DNA or neural data search results or search results
13 from partial matching from the DNA or neural identification index or a consumer DNA or neural database
14 without a search warrant or investigative subpoena issued by a court on a finding of probable cause.
15 (3) For the purposes of this section, the following definitions apply:
16 (a) "Consumer DNA database" means a database maintained by a private entity that provides
17 direct-to-consumer genetic testing services.
18 (b) "DNA identification index" has the same meaning provided in 44-6-101.
19 (c) "Familial DNA search" means a search performed of a government or consumer DNA database
20 using specialized software to detect and statistically rank a list of potential candidates in the DNA database who
21 may be a close biological relative to the unknown individual contributing the evidence DNA profile. The
22 specialized software search may be combined with lineage testing to help confirm or refute biological
23 relatedness.
24 (d) "Lineage testing" means additional genetic testing used to help confirm or refute biological
25 relatedness between the known individual in a DNA database and the unknown individual contributing the
26 evidence DNA profile. Examples of additional genetic testing include but are not limited to:
27 (i) Y-STR analysis to examine STR patterns specific to the Y-chromosome used to determine
28 paternally derived relatedness among DNA profiles; ****
69th Legislature 2025 SB 163.1
- 9 - Authorized Print Version – SB 163
1 (ii) mtDNA analysis to examine cell mitochondria used to determine maternally derived
2 relatedness; or
3 (iii) single nucleotide polymorphism genotyping to generate results related to a person's ancestry
4 and genetic predisposition to health-related topics.
5 (e) "Neural data" has the same meaning as provided in 30-23-102.
6 (e)(f) "Partial matching" means a moderate stringency search of a DNA database using routine
7 search parameters that results in one or more partial matches between single-source and nondegraded DNA
8 profiles that share at least one allele at each locus, indicating a potential familial relationship between the
9 known individual in the DNA database and the unknown individual contributing the evidence DNA profile.
10 (4) A government entity that legally obtains DNA or neural data search results, as set forth in this
11 section, or genetic or neural data, as set forth in Title 30, chapter 23, part 1, may use the results during criminal
12 investigations and judicial proceedings subject to applicable rules of criminal procedure and evidence."
13 - END -