SB 1087 — Genetic data privacy; civil penalty.

SESSION ENROLLED VIRGINIA ACTS OF ASSEMBLY ––-- 2023 SESSION CHAPTER E526 An Act to amend the Code of Virginia by adding in Title 59.1 a chapter numbered 56, consisting of sections numbered 59.1-593 through 59.1-602, relating to genetic data privacy;

civil penaltyRpenalty. O [S 1087] Approved L L Be it enacted by the General Assembly of Virginia:

[S 1087] Approved March 26, 2023 Be it enacted by the General Assembly of Virginia:

That the Code of Virginia is amended by adding in Title 59.1 a chapter numbered 56, consistiEgconsisting of sections numbered 59.1-593 through 59.1-602, as follows:

DCHAPTER GENETIC56. DATA PRIVACY.

GENETIC DATA PRIVACY.

"Affirmative"Biological authorization"sample" means anany actionmaterial thatpart demonstratesof anthe intentionalhuman, decisiondischarge bytherefrom, aor consumer.derivativeonsumer.

"Biological sample" means any material part of the human, discharge therefrom, or derivative thereof, such as tissue, blood, urine, or saliva, known to contain deoxyribonucleic acid (DNA).

B "Deidentified data" means data that cannot be used to infer information about, or otherwise 0ebe linked to, a particular individual, provided that the direct-to-consumer genetic testing company (i) takes reasonable measures to ensure that such information cannot be associated with a consumer ormpan7or (i) takes household;

and (iii) contractually obligates any recipients of the information to take reasonable measures to ensure that the information cannot be inassociated deidentifiedwith forma andconsumer notor household and to reidentifycommit theto information.intainingmaintaining and using the information only "Direct-to-consumerin geneticdeidentified testingform company"and meansnot an entity that (i) offers consumer-initiated genetic testing products or services directly to areidentify consumerthe orinformation. (ii) collects, uses, or analyzes genetic data that is collected or derived from a direct-to-consumer genetic testing product or service and is directly provided by a consumer.

"Direct-to-consumer genetic testing company" means an entity that (i) offers consumer-initiated genetic testing products or services directly to a consumer or (ii) collects, uses, or analyzes genetic data that is collected or derived from a direct-to-consumer genetic testing product or service and is directly provided by a consumer.

Food and Dru"ExpressDrug consent"Administration meansPolicy afor consumer's affirmative authorization to grant permission in response to a clear, meaningful, and prominent notice regarding the collection,Protection use, maintenance, or disclosure of geneticHuman dataSubjects, for21 aC.F.R. specific purpose.

Parts 50 and 56.

"Express consent" means a consumer's affirmative authorization to grant permission in response to a clear, meaningful, and prominent notice regarding the collection, use, maintenance, or disclosure of genetic data for a specific purpose.

"Genetic data" includes uninterpreted data that results from the analysis of the biological sample and any information extrapolated, derived, or inferred therefrom.

"Genetic data" does not include (i) deidentified data or (ii) data or a biological sample toedto the extent that data or a biological sample is collected, used, maintained, and disclosed exclusively for scientific research conducted by an investigator with an institution that holds an assurance with the U.S.

"Genetic testing" means any laboratory test of a biological sample from a consumer for the purpose of determining information concerning genetic material contained within the biological sample, or any information extrapolated, derived, or inferred therefrom.

of 4 "Service provider" means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its of 4 shareholders or other owners that is involved in (i) the collection, transportation, and analysis of the consumer's biological sample or extracted genetic material (a) on behalf of the direct-to-consumer genetic testing company or (b) on behalf of any other company that collects, uses, maintains, or discloses genetic data collected or derived from a direct-to-consumer genetic testing product or service or directly provided by a consumer or (ii) the delivery of the results of the analysis of the biological sample or genetic material.

of 4 A.

Express consent required pursuant to this chapter requires a statement of the nature of the data collection, use, maintenance, or disclosure for which express consent is sought in plain and prEminentprominent language that an ordinary consumer would notice and understand and an affirmative authorization by the consumer granting permission in response to such statement.

Rof 4 B.

Every direct-to-consumer genetic testing company shall obtain a consumer's express consent for the collection, use, and disclosure of the consumer's genetic data, including, at a minimum, separate and express consent for each of the following:

consumer's genetic data, including, at a minimum, seOarate and 1.

E 2.

D 3.

other4. than a service provider, including the name of the third party to which the consumer's geneticty data or biological sample will be transferred or disclosed;

Each transfer or disclosure of the consumer's genetic data or biological sample to a third party other than a service provider, including the name of the third party to which the consumer's genetic data or biological sample will be transferred or disclosed;

Any marketing or facilitation of marketing to a consumer based on the consumer's genetic data or marketing or facilitation of marketing by a third party based on the consumer's having ordered,Sordered, purchased, received, or used a genetic testing product or service, except that a direct-to-cons1merdirect-to-consumer genetic testing company shall not be required to obtain a consumer's express consent to marketi8gmarketing to the consumer on the company's own website or mobile application based on the consumer having E ordered, purchased, received, or used a genetic testing product or service from that company ifR(i)if (i) the advertisement does not depend on any information specific to that consumer other than information regarding the product or service that the consumer ordered, purchased, received, or used;

(ii) the placement of the advertisement does not result in disparate exposure to advertising content on the basis of the sex, race, color, religion, ancestry, national origin, disability, medical condition, genetic data, marital status, sexual orientation, citizenship, primary language, or immigration status of the consumer;

Every direct-to-consumer genetic testing company shall provide a mechanism by which a consumer may revoke the express consent required pursuant to subsection B, which shall include an communicatesoption withfor consumers.ressrevocation of express consent through the primary medium through which the company D.communicates with consumers.

D.

Implement and maintain reasonable security procedures and practices to protect a consumer's gen2.genetic data against unauthorized access, destruction, use, modification, or disclosure;

and 2.

Every direct-to-consumer genetic testing company that enters into a contract with a service provider shall prohibit the service provider from retaining, using, or disclosing the biological sample, extracted genetic material, genetic data, or any information regarding the identity of the consumer, including whether the consumer has solicited or received genetic testing, as applicable, for any purpose providerother than for the business.cspecific purpose of performing the services specified in the contract with the service B.provider for the business.

EveryB. contract between a direct-to-consumer genetic testing company and a service provider shall of 4 include:

Every contract between a direct-to-consumer genetic testing company and a service provider shall include:

A provision prohibiting the service provider from associating or combining the biological sample, extracted genetic material, genetic data, or any information regarding the identity of the consumer, of 4 including whether the consumer has solicited or received genetic testing, as applicable, with information the service provider has received from or on behalf of another person or has collected from its own interaction with consumers or as required by law.

Each violation of this chapter shall constitute a separate violation and shall be subject to any civil penalties imposed under this subsection.section.