Bill Summary – FastDemocracy

LEGISLATIVE GENERAL COUNSEL                                                S.B. 218
Approved for Filing: J. Rogers 6
         6 02-08-24 10:37 AM 6
                         GENETIC GENEALOGY AMENDMENTS
                                       2024 GENERAL SESSION
                                           STATE OF UTAH
                                 Chief Sponsor: Todd D. Weiler
                                 House Sponsor: ____________
 6
 LONG TITLE
 General Description:
        This bill concerns genetic genealogy.
 Highlighted Provisions:
        This bill:
        < defines terms;
        < creates requirements that a genetic genealogy company shall meet before a law
 enforcement agency may request certain genetic genealogy information from the
 genetic genealogy company;
        < amends the requirements that a law enforcement agency is required to meet in order
 to:
            C    request certain genetic genealogy information from a genetic genealogy
 company or the Bureau of Forensic Services, including when a search warrant is
 required; and
            C    covertly obtain a third-party DNA specimen for information regarding a
 third-party individual's genetic genealogy information;
        < prohibits a law enforcement agency or a prosecuting agency from contracting with
 or otherwise using a third party to request, review, or obtain certain genetic
 genealogy information if the law enforcement agency or prosecuting agency would
                                                                                                   S.B. 218
 be prohibited from undertaking the action directly;
        < prohibits a genetic genealogy company from providing certain genetic genealogy
     *SB0218*
       S.B. 218                                                                  02-08-24 10:37 AM
 information to a law enforcement agency unless certain requirements are met;
        < allows a service user of a genetic genealogy company to recover damages and be
 granted equitable relief against a genetic genealogy company if the service user's
 genetic genealogy information is released to a law enforcement agency in violation
 of certain statutory requirements;
        < establishes additional law enforcement reporting requirements concerning certain
 investigative genetic genealogy database utilizations; and
        < makes technical and conforming changes.
 Money Appropriated in this Bill:
        None
 Other Special Clauses:
        None
 Utah Code Sections Affected:
 AMENDS:
        13-60-104, as renumbered and amended by Laws of Utah 2023, Chapter 327
        53-10-403.7, as enacted by Laws of Utah 2023, Chapter 500
        53-26-101, as enacted by Laws of Utah 2023, Chapter 500
45
 Be it enacted by the Legislature of the state of Utah:
        Section 1. Section 13-60-104 is amended to read:
        13-60-104. Consumer genetic information -- Privacy notice -- Consent -- Access --
 Deletion -- Destruction -- Law enforcement access.
        (1) A direct-to-consumer genetic testing company shall:
        (a) provide to a consumer:
        (i) essential information about the company's collection, use, and disclosure of genetic
 data; and
        (ii) a prominent, publicly available privacy notice that includes information about the
 company's data collection, consent, use, access, disclosure, transfer, security, retention, and
 deletion practices;
        (b) obtain a consumer's initial express consent for collection, use, or disclosure of the
 consumer's genetic data that:
                                                     -2-
       02-08-24 10:37 AM                                                                     S.B. 218
         (i) clearly describes the company's use of the genetic data that the company collects
 through the company's genetic testing product or service;
         (ii) specifies who has access to test results; and
         (iii) specifies how the company may share the genetic data;
         (c) if the company engages in any of the following, obtain a consumer's:
         (i) separate express consent for:
         (A) the transfer or disclosure of the consumer's genetic data to any person other than
 the company's vendors and service providers;
         (B) the use of genetic data beyond the primary purpose of the company's genetic testing
 product or service; or
         (C) the company's retention of any biological sample provided by the consumer
 following the company's completion of the initial testing service requested by the consumer;
         (ii) informed consent in accordance with the Federal Policy for the Protection of
 Human Subjects, 45 C.F.R. Part 46, for transfer or disclosure of the consumer's genetic data to
 a third party for:
         (A) research purposes; or
         (B) research conducted under the control of the company for the purpose of publication
 or generalizable knowledge; and
         (iii) express consent for:
         (A) marketing to a consumer based on the consumer's genetic data; or
         (B) marketing by a third party person to a consumer based on the consumer having
 ordered or purchased a genetic testing product or service;
         (d) in accordance with Subsection (3), require valid legal process for the company's
 disclosure of a consumer's genetic data to law enforcement or any government entity without
 the consumer's express written consent;
         (e) develop, implement, and maintain a comprehensive security program to protect a
 consumer's genetic data against unauthorized access, use, or disclosure; and
         (f) provide a process for a consumer to:
         (i) access the consumer's genetic data;
         (ii) delete the consumer's account and genetic data; and
         (iii) destroy the consumer's biological sample.
                                                       -3-
        S.B. 218                                                                     02-08-24 10:37 AM
            (2) Notwithstanding Subsection (1)(c)(iii), a direct-to-consumer genetic testing
 company with a first-party relationship to a consumer may, without obtaining the consumer's
 express consent, provide customized content or offers on the company's website or through the
 company's application or service.
            (3) A request from a law enforcement agency or a law enforcement agency's agent to a
 direct-to-consumer testing company for genetic genealogy information shall comply with the
 requirements in Section 53-10-403.7.
            Section 2. Section 53-10-403.7 is amended to read:
            53-10-403.7. Investigative genetic genealogy service -- Genetic genealogy database
 utilization -- Third-party specimens -- Requirements -- Enforcement.
            (1) As used in this section:
            (a) "Genetic genealogy company" means a company that provides a genetic genealogy
 database utilization or an investigative genetic genealogy service.
            (b) "Genetic genealogy database utilization" means a utilization of a genetic
 genealogical database for the purpose of identifying potential biological relatives to a DNA
 profile.
            (c) "Genetic information" means data acquired from an analysis of a DNA specimen.
            (d) "Investigative genetic genealogy service" means the processing of an individual's
 DNA specimen or genetic data file to be used for a genetic genealogy database utilization.
            (e) "Prosecuting agency" means the Office of the Attorney General or the office of a
 county attorney or district attorney, including an attorney on the staff, whether acting in a civil
 or criminal capacity.
            (f) "Qualified genetic genealogy company" means a genetic genealogy company that:
            (i) provides notice to the genetic genealogy company's service users and the public that
 law enforcement may use the genetic genealogy company's services to investigate crimes or to
 identify unidentified human remains;
            (ii) allows a service user to:
            (A) opt in or opt out of having the service user's data be accessible to a law
 enforcement agency upon request for a criminal investigation; and
            (B) access the genetic genealogy company's services even if the service user opts out of
 having the service user's data be accessible to a law enforcement agency upon request for a
                                                         -4-
        02-08-24 10:37 AM                                                                      S.B. 218
 criminal investigation;
        (iii) has a policy that prevents the genetic genealogy company from compiling, selling,
 licensing, or transferring to a third party any data generated by the genetic genealogy company
 concerning a victim, crime scene, or suspect;
        (iv) provides a quarterly notification to all of the genetic genealogy company's service
 users that contains:
        (A) the total number of law enforcement agency requests that were received by the
 genetic genealogy company during the previous quarter;
        (B) the total number of law enforcement agency requests for which the genetic
 genealogy company provided genetic genealogy information to a law enforcement agency
 during the previous quarter;
        (C) for a service user who has opted in to allow a law enforcement agency to access the
 service user's genetic information or genetic genealogy information, a statement that states,
 "Information concerning your genetic genealogy and that of your relatives may have been
 accessed during any searches conducted on behalf of law enforcement.";
        (D) for a service user who has opted out of allowing a law enforcement agency to
 access the service user's genetic information or genetic genealogy information, a statement that
 confirms that the service user has opted out of sharing the service user's genetic information or
 genetic genealogy information;
        (E) for a service user who has opted in to allow a law enforcement agency to access the
 service user's genetic information or genetic genealogy information, a link that allows the
 service user to elect at any time to prohibit law enforcement from accessing the service user's
 genetic information or genetic genealogy information; and
        (F) for all service users, in accordance with Subsection 13-60-104(1)(f), a link that
 allows the service user to completely delete the user's information from the company's records
 and database;
        (v) for the preceding five years, has not had more than three instances, as determined
 by an independent audit, of releasing to a law enforcement agency or a law enforcement
 agency's agent in the absence of a court order or search warrant any genetic information or
 genetic genealogy information obtained from or based upon genetic information provided by a
 service user who has opted out of sharing genetic information or genetic genealogy information
                                                      -5-
        S.B. 218                                                                 02-08-24 10:37 AM
 with a law enforcement agency;
         (vi) for any instance of an unauthorized release described in Subsection (1)(f)(v),
 emails a notification of the unauthorized release to every affected service user within 30 days
 after the day on which the unauthorized release was discovered; and
         (vii) furnishes on an annual basis to the State Commission on Criminal and Juvenile
 Justice the results of an independent audit that certifies that the genetic genealogy company
 meets all statutory requirements outlined in this section to be considered a qualified genetic
 genealogy company under this section.
         [(f)] (g) "Qualifying case" means an investigation of:
         (i) a violent felony; or
         (ii) the identity of a missing or unknown individual.
         [(g)] (h) "Third-party DNA specimen" means a DNA specimen obtained from an
 individual who is not a likely suspect in an investigation.
         (2) A law enforcement agency may request an investigative genetic genealogy service
 or a genetic genealogy database utilization from the bureau or a genetic genealogy company if:
         (a) (i) the law enforcement agency, through the law enforcement agency's investigation,
 has a DNA profile from forensic evidence that the law enforcement agency reasonably believes
 is attributable to:
         (A) the perpetrator of a crime;
         (B) the remains of an unidentified individual; or
         (C) a missing or unknown individual;
         (ii) the case for which the law enforcement agency requires the information is a
 qualifying case;
         (iii) a routine search of CODIS-eligible profiles, if any, developed in the case revealed
 no DNA matches to the DNA profile;
         (iv) the law enforcement agency, the bureau, and the prosecuting agency consult
 regarding whether an investigative genetic genealogy service or genetic genealogy database
 utilization is an appropriate and necessary step in the development of information that may
 contribute to solving the case; [and]
         (v) the law enforcement agency and prosecuting agency commit to further investigation
 of the case if the investigative genetic genealogy service or genetic genealogy database
                                                      -6-
        02-08-24 10:37 AM                                                                            S.B. 218
 utilization produces information that may contribute to solving the case; [or] and
         (vi) (A) if the investigation is based on a qualifying case concerning a violent felony,
 the law enforcement agency obtains a signed document from both the prosecuting agency and
 the bureau that certifies that in the opinion of both entities, all other viable options for
 investigation have been exhausted; or
         (B) if the investigation is based on a qualifying case concerning a covertly collected
 DNA specimen under Subsection (3)(a)(ii)(B), the law enforcement agency has requested and
 successfully obtained a search warrant that authorizes the investigative genetic genealogy
 service or genetic genealogy database utilization from the bureau or a genetic genealogy
 company; or
         (b) ordered by a court in accordance with a postconviction relief proceeding under
 Section 78B-9-301.
         (3) (a) Before a law enforcement agency may collect a third-party DNA specimen for
 the purpose of obtaining an investigative genetic genealogy service or a genetic genealogy
 database utilization, the law enforcement agency shall:
         (i) consult with the prosecuting agency; and
         (ii) (A) obtain informed, voluntary consent from the individual providing the
 third-party DNA specimen; or
         (B) [if the law enforcement agency concludes that the case-specific circumstances
 provide reasonable grounds to believe that a request for informed, voluntary consent would
 compromise the integrity of the investigation, obtain from the prosecuting agency authorization
 for a covert collection of the third-party DNA specimen] obtain a search warrant for the covert
 collection of the third-party DNA specimen.
         (b) Before obtaining a third-party DNA specimen in accordance with Subsection
 (3)(a)(ii)(B), a law enforcement agency shall, if applicable, request the prosecuting agency to
 notify and consult with the prosecuting agency in the jurisdiction in which the sample will be
 covertly collected to ensure that all applicable laws and procedures are followed.
         [(c) A law enforcement agency that obtains a DNA specimen in accordance with
 Subsection (3)(a)(ii)(B) shall obtain and process the DNA specimen in a lawful manner
 including, if necessary, obtaining a search warrant.]
         (4) A law enforcement agency or a prosecuting agency may only use a third-party DNA
                                                        -7-
       S.B. 218                                                                  02-08-24 10:37 AM
 specimen obtained under Subsection (3) to:
        (a) identify a possible suspect;
        (b) exonerate a possible suspect; or
        (c) identify a missing or unknown individual.
        (5) (a) When requesting an investigative genetic genealogy service or genetic
 genealogy database utilization from a genetic genealogy company under Subsection (2), a law
 enforcement agency or a law enforcement agency's agent shall:
        [(a) disclose to the genetic genealogy company that the request is from a law
 enforcement agency;]
        [(b)] (i) except as provided by Subsection (5)(b), only make a request to a qualified
 genetic genealogy company [that:];
        [(i) provides notice to the genetic genealogy company's service users and the public
 that law enforcement may use the genetic genealogy company's services to investigate crimes
 or to identify unidentified human remains;]
        [(ii) allows a user to:]
        [(A) opt in or out of having the user's data be accessible in an investigation requested
 by law enforcement; and]
        [(B) access the genetic genealogy company's services even if the user opts out of
 having the user's data be accessible in an investigation requested by law enforcement; and]
        [(iii) has a policy that prevents the genetic genealogy company from compiling, selling,
 licensing