This bill, titled the Genomic Data Protection Act, establishes significant consumer rights regarding their genomic data and biological samples held by direct-to-consumer genomic testing companies. It mandates that these companies provide a simple and effective mechanism for consumers to access their genomic data , delete their accounts and associated genomic data , and request the destruction of their biological samples . Companies must fulfill these deletion or destruction requests within 30 days of the consumer's request and subsequently notify the consumer of the completion. The legislation also requires companies to provide clear and conspicuous notice of these consumer rights and to disclose that deidentified genomic data may be shared for medical or scientific research, consistent with HIPAA privacy regulations. Should a company be purchased or acquired, it must notify consumers at least 30 days prior, and the acquiring entity is obligated to comply with any outstanding deletion or destruction requests. Exceptions to these deletion rights apply if the information is subject to a warrant, subpoena, court order, or other legal or regulatory retention requirements. The Federal Trade Commission is empowered to enforce these provisions, treating violations as unfair or deceptive acts or practices, and may promulgate necessary rules within one year of enactment. The bill defines key terms such as "genomic data" and "direct-to-consumer genomic testing company," specifically excluding healthcare professionals acting for diagnosis or treatment, and preserves existing federal and state laws unless there is a direct conflict.
Read twice and referred to the Committee on Commerce, Science, and Transportation.
Commerce
Genomic Data Protection Act
USA119th CongressS-863| Senate
| Updated: 3/5/2025
This bill, titled the Genomic Data Protection Act, establishes significant consumer rights regarding their genomic data and biological samples held by direct-to-consumer genomic testing companies. It mandates that these companies provide a simple and effective mechanism for consumers to access their genomic data , delete their accounts and associated genomic data , and request the destruction of their biological samples . Companies must fulfill these deletion or destruction requests within 30 days of the consumer's request and subsequently notify the consumer of the completion. The legislation also requires companies to provide clear and conspicuous notice of these consumer rights and to disclose that deidentified genomic data may be shared for medical or scientific research, consistent with HIPAA privacy regulations. Should a company be purchased or acquired, it must notify consumers at least 30 days prior, and the acquiring entity is obligated to comply with any outstanding deletion or destruction requests. Exceptions to these deletion rights apply if the information is subject to a warrant, subpoena, court order, or other legal or regulatory retention requirements. The Federal Trade Commission is empowered to enforce these provisions, treating violations as unfair or deceptive acts or practices, and may promulgate necessary rules within one year of enactment. The bill defines key terms such as "genomic data" and "direct-to-consumer genomic testing company," specifically excluding healthcare professionals acting for diagnosis or treatment, and preserves existing federal and state laws unless there is a direct conflict.