Texas 2023 - 88th Regular

Texas Senate Bill SB1544 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New	Differences
1	1	88R13807 JES-F
2	2	By: Johnson S.B. No. 1544
3	3
4	4
5	5	A BILL TO BE ENTITLED
6	6	AN ACT
7	7	relating to the use of an individual's genetic data by certain
8	8	genetic testing companies for commercial purposes; authorizing a
9	9	civil penalty.
10	10	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
11	11	SECTION 1. Subtitle A, Title 11, Business & Commerce Code,
12	12	is amended by adding Chapter 503A to read as follows:
13	13	CHAPTER 503A. DIRECT-TO-INDIVIDUAL GENETIC TESTING COMPANIES
14	14	Sec. 503A.001. DEFINITIONS. In this chapter:
15	15	(1) "Biological sample" means a material part of the
16	16	human body, or a discharge or derivative part of the body, including
17	17	tissue, blood, urine, or saliva that is known to contain DNA.
18	18	(2) "Deidentified data" means data not reasonably
19	19	linked to and that cannot reasonably be used to infer information
20	20	about an identifiable individual.
21	21	(3) "Direct-to-individual genetic testing company"
22	22	means an entity that:
23	23	(A) offers genetic testing products or services
24	24	directly to individuals; or
25	25	(B) collects, uses, or analyzes genetic data that
26	26	results from a direct-to-individual genetic testing product or
27	27	service and that an individual provides to the entity.
28	28	(4) "DNA" means deoxyribonucleic acid.
29	29	(5) "Express consent" means an individual's
30	30	affirmative response to a clear and meaningful notice regarding the
31	31	collection, use, or disclosure of genetic data for a specific
32	32	purpose.
33	33	(6) "Genetic data" means any data, regardless of
34	34	format, concerning an individual's genetic characteristics. The
35	35	term:
36	36	(A) includes:
37	37	(i) raw sequence data derived from
38	38	sequencing all or a portion of an individual's extracted DNA;
39	39	(ii) genotypic and phenotypic information
40	40	obtained from analyzing an individual's raw sequence data; and
41	41	(iii) health information regarding the
42	42	health conditions that an individual self-reports to a company and
43	43	that the company:
44	44	(a) uses for scientific research or
45	45	product development; and
46	46	(b) analyzes in connection with the
47	47	individual's raw sequence data; and
48	48	(B) does not include deidentified data.
49	49	(7) "Genetic testing" means a laboratory test of an
50	50	individual's complete DNA, regions of DNA, chromosomes, genes, or
51	51	gene products to determine the presence of the individual's genetic
52	52	characteristics.
53	53	(8) "Person" means an individual, partnership,
54	54	corporation, association, business, or business trust or the legal
55	55	representative of an organization.
56	56	Sec. 503A.002. APPLICABILITY. (a) This chapter applies to
57	57	a direct-to-individual genetic testing company that:
58	58	(1) offers its products or services to individuals who
59	59	are residents of this state; or
60	60	(2) collects, uses, or analyzes genetic data that
61	61	results from the company's products or services and was provided to
62	62	the company by an individual who is a resident of this state.
63	63	(b) This chapter does not apply to:
64	64	(1) an entity only when they are engaged in
65	65	collecting, using, or analyzing genetic data or biological samples
66	66	in the context of research, as defined by 45 C.F.R. Section 164.501,
67	67	that is conducted in accordance with:
68	68	(A) the federal policy for the protection of
69	69	human subjects (45 C.F.R. Part 46);
70	70	(B) the good clinical practice guidelines issued
71	71	by the International Council for Harmonisation of Technical
72	72	Requirements for Pharmaceuticals for Human Use (ICH); or
73	73	(C) the United States Food and Drug
74	74	Administration policy for the protection of human subjects (21
75	75	C.F.R. Parts 50 and 56); or
76	76	(2) genetic data that is protected health information
77	77	collected by a covered entity or business associate, as defined by
78	78	45 C.F.R. Part 160, subject to the privacy, security, and breach
79	79	notification rules under the Health Insurance Portability and
80	80	Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.).
81	81	Sec. 503A.003. REQUIREMENTS FOR CERTAIN USES OF
82	82	DEIDENTIFIED DATA. (a) Except as otherwise provided by this
83	83	chapter or other law, a direct-to-individual genetic testing
84	84	company that possesses an individual's deidentified data shall:
85	85	(1) implement administrative and technical measures
86	86	to ensure the data is not associated with a particular individual;
87	87	and
88	88	(2) publicly commit to maintaining and using data in
89	89	deidentified form and refraining from making any attempt to
90	90	identify an individual using the individual's deidentified data.
91	91	(b) If a direct-to-individual genetic testing company
92	92	shares an individual's deidentified data with another person, the
93	93	company shall enter into a legally enforceable contractual
94	94	obligation prohibiting the person from attempting to identify an
95	95	individual using the individual's deidentified data.
96	96	Sec. 503A.004. REQUIREMENTS FOR CERTAIN USES OR DISCLOSURE
97	97	OF GENETIC DATA AND BIOLOGICAL SAMPLE. (a) A direct-to-individual
98	98	genetic testing company shall:
99	99	(1) develop, implement, and maintain a comprehensive
100	100	security program to protect an individual's genetic data against
101	101	unauthorized access, use, or disclosure; and
102	102	(2) make publicly available:
103	103	(A) a high-level privacy policy overview that
104	104	includes basic, essential information about the company's
105	105	collection, use, or disclosure of genetic data; and
106	106	(B) a prominent privacy notice that includes
107	107	information about the company's data collection, consent, use,
108	108	access, disclosure, transfer, security, retention, and deletion
109	109	practices.
110	110	(b) Before collecting, using, or disclosing an individual's
111	111	genetic data, a direct-to-individual genetic testing company shall
112	112	provide to the individual information about the company's
113	113	collection, use, and disclosure of genetic data the company
114	114	collects through a genetic testing product or service, including
115	115	information that:
116	116	(1) clearly describes the company's use of the genetic
117	117	data;
118	118	(2) specifies the persons who have access to test
119	119	results; and
120	120	(3) specifies the manner in which the company may
121	121	share the genetic data.
122	122	(c) A direct-to-individual genetic testing company shall
123	123	provide a process for an individual to:
124	124	(1) access the individual's genetic data;
125	125	(2) delete the individual's account and genetic data;
126	126	and
127	127	(3) destroy or require the destruction of the
128	128	individual's biological sample.
129	129	Sec. 503A.005. REQUIRED CONSENT. (a) A
130	130	direct-to-individual genetic testing company engaging in any of the
131	131	following activities must obtain:
132	132	(1) an individual's separate express consent for:
133	133	(A) the transfer or disclosure of the
134	134	individual's genetic data to any person other than the company's
135	135	vendors and service providers;
136	136	(B) the use of genetic data for a purpose other
137	137	than the primary purpose of the company's genetic testing product
138	138	or service; or
139	139	(C) the retention of any biological sample
140	140	provided by the individual following the company's completion of
141	141	the initial testing service requested by the individual;
142	142	(2) an individual's informed consent in accordance
143	143	with guidelines for the protection of human subjects issued under
144	144	45 C.F.R. Part 46, for transfer or disclosure of the individual's
145	145	genetic data to a third party for:
146	146	(A) research purposes; or
147	147	(B) research conducted under the control of the
148	148	company for the purpose of publication or generalizable knowledge;
149	149	and
150	150	(3) an individual's express consent for:
151	151	(A) marketing by the company to the individual
152	152	based on the individual's genetic data; or
153	153	(B) marketing by a third party to the individual
154	154	based on the individual's ordering or purchasing of a genetic
155	155	testing product or service.
156	156	(b) For purposes of Subsection (a), "marketing" does not
157	157	include providing customized content or offers to an individual
158	158	with whom a direct-to-individual genetic testing company has a
159	159	first-party relationship on the company's Internet website or
160	160	through an application or service provided by the company to the
161	161	individual.
162	162	Sec. 503A.006. PROHIBITED DISCLOSURES. (a) A
163	163	direct-to-individual genetic testing company may not disclose an
164	164	individual's genetic data to a law enforcement entity or other
165	165	governmental body unless:
166	166	(1) the company first obtains the individual's express
167	167	written consent; or
168	168	(2) the entity or body obtains a warrant or complies
169	169	with another valid legal process required by the company.
170	170	(b) A direct-to-individual genetic testing company may not
171	171	disclose, without first obtaining an individual's written consent,
172	172	the individual's genetic data to:
173	173	(1) an entity that offers health insurance, life
174	174	insurance, or long-term care insurance; or
175	175	(2) an employer of the individual.
176	176	Sec. 503A.007. CIVIL PENALTY. (a) A direct-to-individual
177	177	genetic testing company that violates this chapter is liable to
178	178	this state for a civil penalty in an amount not to exceed $2,500 for
179	179	each violation.
180	180	(b) The attorney general or a district attorney may bring an
181	181	action to recover a civil penalty imposed under Subsection (a) and
182	182	to restrain and enjoin a violation of this chapter. The attorney
183	183	general or a district attorney may recover reasonable attorney's
184	184	fees and court costs incurred in bringing the action.
185	185	SECTION 2. The changes in law made by this Act apply only to
186	186	genetic information obtained by a direct-to-individual genetic
187	187	testing company on or after the effective date of this Act.
188	188	SECTION 3. This Act takes effect September 1, 2023.