[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 863 Introduced in Senate (IS)]
<DOC>
119th CONGRESS
1st Session
S. 863
To provide consumers with the right to delete their genomic data, and
for other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
March 5, 2025
Mr. Cassidy (for himself and Mr. Peters) introduced the following bill;
which was read twice and referred to the Committee on Commerce,
Science, and Transportation
_______________________________________________________________________
A BILL
To provide consumers with the right to delete their genomic data, and
for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Genomic Data Protection Act''.
SEC. 2. CONSUMER RIGHTS REGARDING PRIVACY OF GENOMIC DATA.
(a) Requirements.--
(1) Consumer controls.--
(A) In general.--A direct-to-consumer genomic
testing company shall provide a simple and effective
mechanism to allow a consumer to--
(i) access the genomic data of the
consumer; and
(ii) subject to paragraph (4)--
(I) delete the account of the
consumer, including any genomic data
associated with such account; and
(II) request the destruction of any
biological sample of the consumer.
(B) Required mechanism.--The direct-to-consumer
genomic testing company shall make available to a
consumer the mechanism described in subparagraph (A)
through the primary means by which the company
communicates with the consumer.
(2) Notification.--
(A) Consumer controls and use of deidentified
genomic data.--A direct-to-consumer genomic testing
company shall make available, in a clear and
conspicuous, not misleading, and easy-to-read manner a
notice that--
(i) provides a detailed and accurate
representation of the rights set forth in
clauses (i) and (ii) of paragraph (1)(A); and
(ii) discloses that the deidentified
genomic data of a consumer may be shared or
disclosed to conduct medical or scientific
research, consistent with the privacy
regulations promulgated under section 264(c) of
the Health Insurance Portability and
Accountability Act of 1996 (42 U.S.C. 1320d-2
note).
(B) Purchase of company.--In the event that a
direct-to-consumer genomic testing company is purchased
or otherwise acquired by another entity, the direct-to-
consumer genomic testing company shall send to each
consumer, not fewer than 30 days prior to the date on
which the purchase or acquisition is complete, a notice
that includes--
(i) the identity of the entity purchasing
or otherwise acquiring the company; and
(ii) a detailed and accurate representation
of the how a consumer can exercise the rights
set forth in clauses (i) and (ii) of paragraph
(1)(A) under the new ownership.
(3) Processing of deletion or destruction requests.--
(A) In general.--With respect to a consumer's
request to delete the genomic data or to destroy the
biological sample of the consumer, a direct-to-consumer
genomic testing company shall--
(i) fulfill such request not later than 30
days after the date on which the consumer makes
such request; and
(ii) notify the consumer of such deletion
or destruction not later than 30 days after the
deletion or destruction.
(B) Outstanding requests during purchase of
company.--In the event that a direct-to-consumer
genomic testing company is purchased or otherwise
acquired by another entity while a consumer's request
to delete the genomic data or to destroy the biological
sample of the consumer is outstanding--
(i) the entity that is purchasing or
otherwise acquiring the company shall comply
with the requirements described in subparagraph
(A); and
(ii) the 30-day period to fulfill such
request shall begin on the date on which the
consumer makes such request to the direct-to-
consumer genomic testing company.
(4) Exceptions.--A direct-to-consumer genomic testing
company shall not permit a consumer to exercise a right
described in paragraph (1)(A)(ii) if the company determines
that the exercise of the right would require the deletion of
information--
(A) subject to a warrant, lawfully executed
subpoena, or other court order; or
(B) the company is required to retain in order to
comply with any other applicable legal or regulatory
requirement.
(b) Enforcement.--
(1) Unfair or deceptive acts or practices.--A violation of
this section or a regulation promulgated thereunder shall be
treated as a violation of a rule defining an unfair or
deceptive act or practice under section 18(a)(1)(B) of the
Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
(2) Powers of the commission.--
(A) In general.--The Commission shall enforce this
section in the same manner, by the same means, and with
the same jurisdiction, powers, and duties as though all
applicable terms and provisions of the Federal Trade
Commission Act (15 U.S.C. 41 et seq.) were incorporated
into and made a part of this section.
(B) Privileges and immunities.--Any person who
violates this section or a regulation promulgated
thereunder shall be subject to the penalties and
entitled to the privileges and immunities provided in
the Federal Trade Commission Act (15 U.S.C. 41 et
seq.).
(C) Authority preserved.--Nothing in this section
shall be construed to limit the authority of the
Commission under any other provision of law.
(D) Rulemaking.--Not later than 1 year after the
date of enactment of this section, the Commission may
promulgate in accordance with section 553 of title 5,
United States Code, such rules as may be necessary to
carry out this section.
(c) Definitions.--In this section:
(1) Biological sample.--The term ``biological sample''
means any material part of the human, discharge therefrom, or
derivative thereof, such as tissue, blood, urine, or saliva,
known to contain deoxyribonucleic acid (DNA).
(2) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(3) Consumer.--The term ``consumer'' means an individual
who provides a biological sample to a direct-to-consumer
genomic testing company.
(4) Deidentified genomic data.--The term ``deidentified
genomic data'' means data that cannot be used to infer
information about, or otherwise be linked to, a particular
individual, provided that the business that possesses the
information does all of the following:
(A) Takes reasonable measures to ensure that the
information cannot be associated with a particular
individual.
(B) Publicly commits to maintain and use the
information only in deidentified form and not to
attempt to reidentify the information, except that the
business may attempt to reidentify the information
solely for the purpose of determining whether its
deidentification processes satisfy the requirements of
this subparagraph, provided that the business does not
use or disclose any information reidentified in this
process and destroys the reidentified information upon
completion of that assessment.
(C) Contractually obligates any recipients of the
information to take reasonable measures to ensure that
the information cannot be associated with a particular
individual and to commit to maintaining and using the
information only in deidentified form and not to
reidentify the information.
(5) Direct-to-consumer genomic testing company.--
(A) In general.--The term ``direct-to-consumer
genomic testing company'' means a person that does any
of the following:
(i) Manufactures or develops genomic
testing products or services for sale directly
to consumers.
(ii) Analyzes or interprets genomic data
obtained from a consumer.
(iii) Collects, uses, maintains, or
discloses genomic data collected or derived
from a direct-to-consumer genomic testing
product or service.
(iv) Purchases or acquires genomic data
from a direct-to-consumer genomic testing
company.
(B) Exclusion for health care professionals.--The
term ``direct-to-consumer genomic testing company''
shall not include a health care professional (as
defined in section 225 of the Public Health Service Act
(42 U.S.C. 234)) that performs an action described in
subparagraph (A) for purposes of diagnosis or treatment
of a medical condition.
(6) Genomic data.--
(A) In general.--The term ``genomic data''--
(i) means any data, regardless of its
format or whether the data has been
deidentified, that results from the analysis of
a biological sample from a consumer and
concerns genomic material; and
(ii) includes--
(I) deoxyribonucleic acids (DNA),
ribonucleic acids (RNA), genes,
chromosomes, alleles, genomes,
alterations or modifications to DNA or
RNA, and single nucleotide
polymorphisms (SNPs);
(II) uninterpreted data that
results from the analysis of the
biological sample; or
(III) any information extrapolated,
derived, or inferred therefrom.
(B) Exclusion of deidentified genomic data.--The
term ``genomic data'' shall not include the
deidentified genomic data of a consumer to the extent
that such data is used to conduct medical or scientific
research, consistent with the privacy regulations
promulgated under section 264(c) of the Health
Insurance Portability and Accountability Act of 1996
(42 U.S.C. 1320d-2 note).
(7) Genomic testing product or service.--The term ``genomic
testing product or service'' means any testing product or
service that analyzes or interprets the genomic data or
biological sample of a consumer.
(d) Relationship to Federal and State Laws.--
(1) Federal law preservation.--Nothing in this Act, or a
regulation promulgated under this Act, shall be construed to
limit any other provision of Federal law, except as
specifically provided in this Act.
(2) State law preservation.--Nothing in this Act, or a
regulation promulgated under this Act, shall be construed to
preempt, displace, or supplant any State law, except to the
extent that a provision of State law conflicts with a provision
of this Act, or a regulation promulgated under this Act, and
then only to the extent of the conflict.
<all>