HB 1179 — An Act providing for privacy, transparency and compensation regarding the disclosure of information collected by genetic material testing entities.

PRINTER'S NO.   1316

                   THE GENERAL ASSEMBLY OF PENNSYLVANIA



                       HOUSE BILL
                       No. 1179
                                               Session of
                                                 2025

     INTRODUCED BY KINKEAD, MUNROE, ISAACSON, MERSKI, MADDEN, HILL-
        EVANS, RABB, HOWARD, PIELLI, HANBIDGE, SANCHEZ, SHUSTERMAN,
        CIRESI, CEPEDA-FREYTIZ, RIVERA, CERRATO, GREEN, WARREN AND
        SAMUELSON, APRIL 9, 2025

     REFERRED TO COMMITTEE ON CONSUMER PROTECTION, TECHNOLOGY AND
        UTILITIES, APRIL 9, 2025


                                      AN ACT
 1   Providing for privacy, transparency and compensation regarding
 2      the disclosure of information collected by genetic material
 3      testing entities.
 4      The General Assembly of the Commonwealth of Pennsylvania
 5   hereby enacts as follows:
 6   Section 1.   Short title.
 7      This act shall be known and may be cited as the Genetic
 8   Materials Privacy and Compensation Act.
 9   Section 2.   Definitions.
10      The following words and phrases when used in this act shall
11   have the meanings given to them in this section unless the
12   context clearly indicates otherwise:
13      "Genetic material."      As follows:
14          (1)   Deoxyribonucleic acid, including mitochondrial DNA,
15      complementary DNA and DNA derived from ribonucleic acid.
16          (2)   The term includes a gene, chromosome or alteration
17      of a gene or chromosome that may be tested to determine the
 1      existence or risk of a disease, disorder, trait, propensity,
 2      syndrome or information identifying an individual or a blood
 3      relative.
 4          (3)     The term does not include family history or a
 5      genetically transmitted characteristic whose existence or
 6      identity is determined through means other than a genetic
 7      test.
 8      "Genetic material collection."        Information collected, or
 9   planned to be collected, by a genetic material testing entity
10   about the content accessed, personal identifiers, reports or
11   knowledge derived from testing and any other reports or
12   statistics combined with the information or data.
13      "Genetic material testing."       As follows:
14          (1)     DNA or genetic typing and testing to determine the
15      presence or absence of genetic characteristics in an
16      individual.
17          (2)     The term includes a test of nucleic acids or
18      chromosomes in order to diagnose or identify a genetic
19      characteristic.
20          (3)     The term does not include:
21                (i)    A routine physical measurement.
22                (ii)    A test for drugs, alcohol, cholesterol or human
23          immunodeficiency virus.
24                (iii)    A chemical, blood or urine analysis.
25                (iv)    Any other diagnostic test that is widely
26          accepted and in use in clinical practice.
27      "Genetic material testing entity."        An entity collecting,
28   testing or otherwise analyzing the genetic material of
29   individuals, including:
30          (1)     A medical facility.

20250HB1179PN1316                     - 2 -
 1        (2)   An entity that provides genealogy services.
 2        (3)   A law enforcement agency.
 3    "Prominently disclose."     As follows:
 4        (1)   To communicate in a manner that is difficult to miss
 5    and easily understandable by ordinary individuals, including
 6    the following:
 7              (i)    A visual disclosure that, by its size, contrast,
 8        location, length, appearance and other characteristics,
 9        stands out from accompanying text or other visual
10        elements so that it is easily noticed, read and
11        understood.
12              (ii)    An audible disclosure, including by telephone
13        or streaming video, that is delivered in a volume, speed
14        and cadence sufficient for ordinary individuals to easily
15        hear and understand.
16              (iii)    An interactive electronic medium, such as in
17        connection with an update to device firmware, the
18        disclosure of which is unavoidable.
19              (iv)    A disclosure that uses diction and syntax
20        understandable to ordinary individuals and appears in
21        each language in which the triggering representation
22        appears.
23              (v)    A disclosure that complies with the requirements
24        in each medium through which it is received, including
25        all electronic devices and face-to-face communications.
26              (vi)    A disclosure that is not contradicted,
27        mitigated by or inconsistent with anything else in the
28        communication.
29        (2)   When the communication targets a specific audience,
30    such as children, the elderly or the terminally ill, the term

20250HB1179PN1316                   - 3 -
 1      "ordinary individuals" includes reasonable members of that
 2      group.
 3      "Third party."          An entity that gathers or otherwise has
 4   access to an individual's genetic material whether obtained for
 5   the entity's purposes or accessed from another entity.
 6   Section 3.     Disclosure requirements.
 7      (a)   Prohibition.--In addition to other requirements imposed
 8   by law, a genetic material testing entity, directly or through a
 9   corporation, subsidiary, division, website or other device or
10   affiliate, may not misrepresent, expressly or by implication:
11            (1)   The extent to which data is collected, used or
12      maintained or methods for protecting the privacy,
13      confidentiality or security of genetic material.
14            (2)   The purpose of the collection, use or disclosure of
15      genetic material.
16      (b)   Notice and consent.--
17            (1)   A genetic material testing entity or third party,
18      directly or through a corporation, subsidiary, division,
19      website or other device or affiliate, in connection with the
20      collection of genetic material of an individual, shall:
21                  (i)   Prior to collection of the genetic material
22            undertaken after the effective date of this section,
23            prominently disclose to the individual, separate and
24            apart from a privacy policy, terms of use page or other
25            similar documents, the following:
26                        (A)    The type of genetic material that will be
27                  collected and used.
28                        (B)    The type of genetic material that will be
29                  shared with a third party.
30                        (C)    The identity of the third party.

20250HB1179PN1316                         - 4 -
 1                       (D)   The purpose for any genetic testing entity
 2                sharing of the data collected.
 3                       (E)   A data-sharing agreement between the genetic
 4                testing entity or third party and a Federal, State or
 5                local law enforcement agency or other government
 6                agency.
 7                (ii)    Obtain the individual's affirmative express
 8          consent to the genetic material collection as follows:
 9                       (A)   At the time the disclosure under
10                subparagraph (i) is made.
11                       (B)   Upon a material change to the terms
12                disclosed under subparagraph (i).
13                (iii)    Provide instruction, if the individual's
14          affirmative express consent is sought under subparagraph
15          (ii), for how the individual may revoke consent to the
16          genetic material collection and sharing.
17                (iv)    Obtain the individual's affirmative express
18          consent to continued genetic material collection or
19          sharing.
20          (2)   A genetic testing entity or third party, directly or
21      through a corporation, subsidiary, division, website or other
22      device or affiliate, may not collect the genetic material of
23      an individual who does not provide affirmative express
24      consent under paragraph (1)(ii).
25          (3)   A genetic material testing entity or third party
26      collecting or accessing the genetic material of an individual
27      shall not provide information on the genetic material to law
28      enforcement without a warrant or the explicit, affirmative
29      permission of the individual providing the genetic material.
30   Section 4.   Compensation.

20250HB1179PN1316                       - 5 -
 1      (a)   Prohibition.--A genetic material testing entity or third
 2   party collecting or accessing the genetic material of an
 3   individual is prohibited from selling or donating information
 4   about an individual's genetic material without:
 5            (1)   getting express authorization from the individual
 6      or, in the case that the individual is deceased, the next of
 7      kin; and
 8            (2)   providing fair and adequate compensation at a rate
 9      of not less than 90% of the amount received in compensation
10      for the sale of the individual's genetic material.
11      (b)   Nonapplicability.--Subsection (a)(2) does not apply if
12   an individual or, in the case that the individual is deceased,
13   the next of kin, makes a voluntary and direct genetic material
14   donation of the individual's genetic material for medical
15   treatment or medical or scientific study.
16   Section 5.     Genetic materials database requests.
17      (a)   Insurance companies.--An insurance company may not
18   request genetic material or related data of an insured or an
19   individual applying for insurance from a company or entity
20   maintaining a genetic database.
21      (b)   Employers.--An employer may not request genetic material
22   or related data of an employee or a prospective employee from a
23   company or entity maintaining a genetic database.
24   Section 6.     Data deletion requirements.
25      (a)   Destruction of genetic material.--Within 120 days of the
26   effective date of this section, a genetic material testing
27   entity or third party, in connection with genetic material
28   collection for a product or service, and any person or entity in
29   active concert or participation, directly or through a
30   corporation, subsidiary, division, website or other device or

20250HB1179PN1316                    - 6 -
 1   affiliate, shall destroy genetic material collected prior to the
 2   effective date of this section, except:
 3            (1)   If the genetic material collected was requested by a
 4      government agency or required by law, regulation or court
 5      order, including rules applicable to the safeguarding of
 6      evidence in pending litigation.
 7            (2)   If the individual associated with the genetic
 8      material collected has expressly consented to the collection,
 9      use or disclosure as provided under section 3(b).
10      (b)   Individual request.--After the effective date of this
11   section, a genetic material testing entity or third party in
12   connection with genetic material collection, and any person or
13   entity in active concert or participation with a genetic
14   material testing entity or third party, directly or through a
15   corporation, subsidiary, division, website or other device or
16   affiliate, shall destroy an individual's genetic material within
17   30 days of the individual requesting that the genetic material
18   be destroyed.
19   Section 7.     Mandated genetic materials privacy program.
20      (a)   Privacy program.--A genetic material testing entity or
21   third party, directly or through a corporation, subsidiary,
22   division, website or affiliate, shall establish, implement and
23   maintain a comprehensive privacy program that is reasonably
24   designed to:
25            (1)   Address privacy risks related to the development and
26      management of new and existing products and services for
27      individuals.
28            (2)   Protect the privacy and confidentiality of genetic
29      material collected directly or indirectly by a genetic
30      material testing entity or third party, directly or through a

20250HB1179PN1316                    - 7 -
 1      corporation, subsidiary, division, website or other device or
 2      affiliate.
 3      (b)   Requirements.--A privacy program, the content and
 4   implementation of which shall be documented in writing, shall
 5   contain controls and procedures appropriate to the size and
 6   complexity of the party collecting the genetic material, the
 7   nature and scope of the party's activities and the sensitivity
 8   of the genetic material, including:
 9            (1)   The designation of an employee or employees to
10      coordinate and be responsible for the privacy program.
11            (2)   The identification of reasonably foreseeable risks,
12      both internal and external, that could result in the
13      unauthorized collection, use or disclosure of genetic
14      material or private information by the party collecting the
15      genetic material or its agents and an assessment of the
16      sufficiency of any safeguards in place to control these
17      risks. At a minimum, the risk assessment shall include
18      consideration of risks in each area of relevant operation,
19      including:
20                  (i)    Employee training and management, including
21            training on the requirements of this act.
22                  (ii)    Product design, development and research.
23            (3)   The design and implementation of reasonable controls
24      and procedures to address risks and regular testing or
25      monitoring of the effectiveness of those controls and
26      procedures.
27            (4)   The development and use of reasonable steps to
28      select and retain Internet service providers capable of
29      appropriately protecting the privacy of information that the
30      Internet service providers receive from the genetic material

20250HB1179PN1316                       - 8 -
 1      testing entity or third party or agents of the genetic
 2      material testing entity or third party and requiring the
 3      Internet service providers, by contract, to implement and
 4      maintain appropriate privacy protections for genetic
 5      material.
 6          (5)     The evaluation and adjustment of the genetic
 7      material testing entity's or third party's privacy program in
 8      light of the results of the testing and monitoring required
 9      under paragraph (3), a change to the genetic material testing
10      entity's or third party's operations or business arrangements
11      or other circumstance that the manufacturer or third party or
12      agents of the manufacturer or third party know or have reason
13      to know may have an impact on the effectiveness of the
14      privacy program.
15   Section 8.    Ownership.
16      Individuals shall have inherent ownership rights for their
17   genetic material and a privacy interest in it, even when
18   voluntarily providing their genetic material to a for-profit
19   company.
20   Section 9.    Violations.
21      Conduct that is unlawful or otherwise prohibited under this
22   act shall constitute an unfair method of competition and unfair
23   or deceptive act or practice as those terms are defined under
24   section 2 of the act of December 17, 1968 (P.L.1224, No.387),
25   known as the Unfair Trade Practices and Consumer Protection Law,
26   and shall be subject to enforcement and remedies as provided in
27   that act.
28   Section 10.    Remedies available to individuals.
29      Nothing in this act shall be construed to limit the remedies
30   available to individuals, the Attorney General or a district

20250HB1179PN1316                    - 9 -
1   attorney under the act of December 17, 1968 (P.L.1224, No.387),
2   known as the Unfair Trade Practices and Consumer Protection Law,
3   or other Federal or State law.
4   Section 11.   Effective date.
5      This act shall take effect in 120 days.




20250HB1179PN1316                   - 10 -