HB 1530 — An Act providing for duties of direct-to-consumer genetic testing companies and for prohibition on disclosure of genetic data of consumers; and imposing civil penalties.

PRINTER'S NO.   1787

                   THE GENERAL ASSEMBLY OF PENNSYLVANIA



                       HOUSE BILL
                       No. 1530
                                                Session of
                                                  2025

     INTRODUCED BY BURGOS, PIELLI, MAYES, HILL-EVANS, GIRAL, NEILSON,
        SANCHEZ, McANDREW, BOROWSKI, KENYATTA, DONAHUE, CERRATO,
        WARREN, RIVERA, BOYD, E. NELSON, BIZZARRO, McNEILL, CEPEDA-
        FREYTIZ, TOMLINSON AND CIRESI, MAY 30, 2025

     REFERRED TO COMMITTEE ON CONSUMER PROTECTION, TECHNOLOGY AND
        UTILITIES, MAY 30, 2025


                                     AN ACT
 1   Providing for duties of direct-to-consumer genetic testing
 2      companies and for prohibition on disclosure of genetic data
 3      of consumers; and imposing civil penalties.
 4      The General Assembly of the Commonwealth of Pennsylvania
 5   hereby enacts as follows:
 6   Section 1.   Short title.
 7      This act shall be known and may be cited as the Genetic
 8   Information Privacy Act.
 9   Section 2.   Definitions.
10      The following words and phrases when used in this act shall
11   have the meanings given to them in this section unless the
12   context clearly indicates otherwise:
13      "Biological sample."     A material part of, or discharge from,
14   a human being or a derivative of a material part of, or
15   discharge from, a human being, including tissue, blood, urine
16   and saliva, known to contain DNA.
17      "Consumer."   An individual who is a resident of this
 1   Commonwealth.
 2      "Deidentified data."      Data that cannot reasonably be used to
 3   infer information about, or otherwise be linked to, an
 4   identifiable consumer that is subject to all of the following:
 5          (1)    Administrative and technical measures to ensure that
 6      the data cannot be associated with a particular consumer.
 7          (2)    A public commitment by a direct-to-consumer genetic
 8      testing company to maintain and use the data in a
 9      deidentified form and to not attempt to reidentify the data.
10          (3)    Legally enforceable contractual obligations that
11      prohibit a recipient of the data from attempting to
12      reidentify the data.
13      "Direct-to-consumer genetic testing company" or "company."
14   As follows:
15          (1)    An entity that:
16                 (i)    offers a direct-to-consumer genetic testing
17          product or service; or
18                 (ii)    collects, uses or analyzes genetic data
19          provided to the entity by a consumer as a result of a
20          direct-to-consumer genetic testing product or service.
21          (2)    The term does not include an entity that is only
22      engaged in collecting, using or analyzing genetic data or
23      biological samples in the context of research, as defined in
24      45 CFR 164.501 (relating to definitions), that is conducted
25      in accordance with 21 CFR Ch. I Subch. A Pts. 50 (relating to
26      protection of human subjects) and 56 (relating to
27      institutional review boards), 45 CFR Subt. A Subch. A Pt. 46
28      (relating to protection of human subjects) and the Good
29      Clinical Practice Guideline issued by the International
30      Council for Harmonisation.

20250HB1530PN1787                      - 2 -
 1      "DNA."    Deoxyribonucleic acid.
 2      "Express consent."     A consumer's affirmative response to a
 3   clear, meaningful and prominent notice regarding the collection,
 4   use or disclosure of genetic data for a specific purpose.
 5      "Genetic data."    Any data, regardless of the format of the
 6   data, that concerns a consumer's genetic characteristics. The
 7   term does not include deidentified data. The term includes any
 8   of the following:
 9          (1)     Raw sequence data that results from sequencing of a
10      consumer's complete extracted DNA or a portion of the
11      extracted DNA.
12          (2)     Genotypic and phenotypic information that results
13      from analyzing the raw sequence data.
14          (3)     Self-reported health information that a consumer
15      submits to a direct-to-consumer genetic testing company
16      regarding the consumer's health conditions and that is used
17      for scientific research or product development and analyzed
18      in connection with the consumer's raw sequence data.
19      "Genetic testing."     A laboratory test of a consumer's
20   complete DNA, regions of DNA, chromosomes, genes or gene
21   products to determine the presence of genetic characteristics of
22   the consumer.
23      "Person."    An individual, partnership, corporation,
24   association, business, business trust or legal representative of
25   an organization.
26   Section 3.   Duties of direct-to-consumer genetic testing
27                companies.
28      In order to safeguard the privacy, confidentiality, security
29   and integrity of a consumer's genetic data, a direct-to-consumer
30   genetic testing company shall have the following duties:

20250HB1530PN1787                    - 3 -
 1        (1)   Provide clear and complete information regarding the
 2    company's policies and procedures for the collection, use or
 3    disclosure of genetic data by making all of the following
 4    available to a consumer:
 5              (i)    A high-level privacy policy overview that
 6        includes basic, essential information about the
 7        company's collection, use or disclosure of genetic data.
 8              (ii)    A prominent, publicly available privacy notice
 9        with information about the company's data collection,
10        consent, use, access, disclosure, transfer, security and
11        retention and deletion practices.
12        (2)   Obtain a consumer's consent for the collection, use
13    or disclosure of the consumer's genetic data, which includes
14    all of the following:
15              (i)    Initial express consent that clearly describes
16        the uses of the consumer's genetic data collected through
17        the genetic testing product or service and specifies who
18        has access to test results and how the genetic data may
19        be shared.
20              (ii)    Separate express consent for transferring or
21        disclosing the consumer's genetic data to a person other
22        than the company's vendor or service provider or for
23        using the consumer's genetic data beyond the primary
24        purpose of the genetic testing product or service and
25        inherent contextual uses.
26              (iii)    Separate express consent for the retention of
27        a biological sample provided by the consumer after
28        completion of the initial testing service requested by
29        the consumer.
30              (iv)    Informed consent in accordance with 45 CFR

20250HB1530PN1787                   - 4 -
 1        Subt. A Subch. A Pt. 46 (relating to protection of human
 2        subjects) for the transfer or disclosure of the
 3        consumer's genetic data to a third-party person for
 4        research purposes or research conducted under the control
 5        of the company for the purpose of publication or
 6        generalizable knowledge.
 7              (v)    Express consent for marketing to the consumer
 8        based on the consumer's genetic data or for marketing by
 9        a third-party person to the consumer based on the
10        consumer having ordered or purchased a genetic testing
11        product or service. As used in this subparagraph, the
12        term "marketing" does not include the provision of
13        customized content or offers on an Internet website or
14        through an application or service provided by a direct-
15        to-consumer genetic testing company with a first-party
16        relationship to a consumer.
17        (3)   Require a valid legal process for disclosing genetic
18    data to a law enforcement agency or any other Federal, State
19    or local government entity without the consumer's express
20    written consent.
21        (4)   Develop, implement and maintain a comprehensive
22    security program to protect the consumer's genetic data
23    against unauthorized access, use or disclosure.
24        (5)   Provide a process for the consumer to:
25              (i)    access the consumer's genetic data;
26              (ii)    delete the consumer's account and genetic data;
27        and
28              (iii)    request and obtain the destruction of the
29        consumer's biological sample.
30        (6)   Otherwise comply with Federal and State laws

20250HB1530PN1787                   - 5 -
 1      regarding the privacy, confidentiality, security and
 2      integrity of the consumer's genetic data.
 3   Section 4.   Prohibition on disclosure of genetic data of
 4                consumers.
 5      Notwithstanding the provisions of section 3, a direct-to-
 6   consumer genetic testing company may not disclose a consumer's
 7   genetic data to any of the following without the consumer's
 8   written consent:
 9          (1)   An entity offering health insurance, life insurance
10      or long-term care insurance.
11          (2)   An employer of the consumer.
12   Section 5.   Civil penalties.
13      The Office of Attorney General may bring a civil action in
14   the name of the Commonwealth or on behalf of consumers to
15   enforce the provisions of this act in a court of competent
16   jurisdiction. In an action brought under this section, the court
17   may impose a civil penalty of $2,500 for each violation of this
18   act, the recovery of actual damages incurred by consumers on
19   whose behalf the action was brought and the costs and reasonable
20   attorney fees incurred by the Office of Attorney General.
21   Section 6.   Applicability.
22      This act shall not apply to any of the following:
23          (1)   Protected health information that is collected by a
24      covered entity or business associate governed by the privacy,
25      security and breach notification regulations issued by the
26      United States Department of Health and Human Services under
27      45 CFR Subt. A Subch. C Pts. 160 (relating to general
28      administrative requirements) and 164 (relating to security
29      and privacy) and established under the Health Insurance
30      Portability and Accountability Act of 1996 (Public Law 104-

20250HB1530PN1787                    - 6 -
 1      191, 110 Stat. 1936) and the Health Information Technology
 2      for Economic and Clinical Health Act (Public Law 111-5, 123
 3      Stat. 226-279 and 467-496).
 4          (2)   Biological samples or genetic data lawfully obtained
 5      by a law enforcement agency from a crime scene reasonably
 6      suspected to belong to a putative suspect in a criminal case.
 7          (3)   Biological samples or genetic data obtained from a
 8      deceased individual whose identity is unknown solely for the
 9      purposes of identifying the individual.
10   Section 7.   Effective date.
11      This act shall take effect in 60 days.




20250HB1530PN1787                   - 7 -