ByRepresentatives Kloba, Slatter, Senn, Lekanoff, Thai, Callan, Valdez, Smith, Davis, Pollet, Hudgins, and Ormsby

AN ACT Relating to collection, use, and disclosure of genetic data by direct-to-consumer genetic testing companies; adding a new chapter to Title 19 RCW; and prescribing penalties.

NEW SECTION. Sec. 1. The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

(1) "Biological sample" means any material part of the human body, discharge therefrom, or derivative thereof, such as tissue, blood, urine, or saliva, known to contain deoxyribonucleic acid (DNA).

(3) "Direct-to-consumer genetic testing company" or "company" means an entity that offers consumer genetic testing products or services directly to consumers without requiring the involvement of a health care provider.

(5) "Express consent" means a consumer's affirmative written response to a clear, meaningful, and prominent notice regarding the collection, use, or disclosure of genetic data for a specific purpose.

(6)(a) "Genetic data" means any data, regardless of its format, that concerns a consumer's genetic characteristics.

(i) Raw sequence data that result from sequencing of a consumer's complete extracted or a portion of the extracted DNA;

(iii) Self-reported health data that a consumer submits to a company regarding the consumer's health conditions and that is used for scientific research or product development and analyzed in connection with the consumer's raw sequence data.

(c) "Genetic data" does not include deidentified data. For purposes of this subsection, "deidentified data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identifiable consumer, and that is subject to:

(i) Administrative and technical measures to ensure that the data cannot be associated with a particular consumer;

(ii) Public commitment by the company to maintain and use data in deidentified form and not to attempt to reidentify data; and

(iii) Legally enforceable contractual obligations that prohibit any recipients of the data from attempting to reidentify the data.

(7) "Genetic testing" means any laboratory test of a consumer's complete DNA, regions of DNA, chromosomes, genes, or gene products to determine the presence of the genetic characteristics in a consumer or a consumer's offspring.

NEW SECTION. Sec. 2. (1) To safeguard the privacy, confidentiality, security, and integrity of a consumer's genetic data, a direct-to-consumer genetic testing company shall:

(a) Provide clear and complete information regarding the company's policies and procedures for collection, use, or disclosure of genetic data by making available to a consumer:

(i) A high-level privacy policy overview that includes basic, essential information about the company's collection, use, or disclosure of genetic data; and

(ii) A prominent, publicly available, and easy to read privacy notice that includes, at a minimum, information about the company's data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices;

(b) Obtain a consumer's consent for collection, use, or disclosure of the consumer's genetic data including, at a minimum:

(i) Initial express consent that clearly describes the uses of the genetic data collected through the genetic testing product or services purchased by the consumer, and specifies who has access to test results and how the genetic data may be shared;

(ii) Separate express consent for transferring or disclosing the consumer's genetic data to third parties other than vendors and services providers, or for using genetic data beyond the primary purpose of the purchased genetic testing product or service and inherent contextual uses;

(iii) Informed consent in compliance with the federal policy for the protection of human research subjects, 45 C.F.R. Sec. 46 (2019), when the consumer's genetic data is transferred or disclosed to third parties for research purposes or when research is done under the control of the company for the purpose of publication or generalizable knowledge; and

(iv) Express consent for marketing to a consumer based on the consumer's genetic data or the consumer having ordered or purchased a genetic testing product or service;

(d) Develop, implement, and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized or inappropriate access, disclosure, or use; and

(ii) Correct or amend inaccurate genetic data or other personal information in the consumer's account;

(iii) Specify how long the consumer's genetic data and biological sample may be retained by the company;

(2) Notwithstanding any other provisions in this section, a direct-to-consumer genetic testing company may not disclose a consumer's genetic data to any entity offering health insurance or life insurance, or to any employer of the consumer.

NEW SECTION. Sec. 3. (1) The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

(2) The attorney general may bring an action in the name of the state, or as parens patriae on behalf of persons residing in the state, to enforce this chapter. In any action brought by the attorney general to enforce this chapter, a violation of this chapter is subject to a civil penalty of two thousand five hundred dollars for each violation of this chapter.

(3) A consumer prevailing in an action under this chapter may recover actual damages, but not less than statutory damages of two thousand five hundred dollars per violation.

(4) A court must award costs and reasonable attorneys' fees to a plaintiff who prevails in an action under this chapter.