Pennsylvania HB 1530: An Act providing for duties of direct-to-consumer genetic testing companies and for prohibition on disclosure of genetic data of consumers; and imposing civil penalties.

Bill Text

PRINTER'S NO. 1787
THE GENERAL ASSEMBLY OF PENNSYLVANIA
HOUSE BILL
No. 1530
Session of
2025
INTRODUCED BY BURGOS, PIELLI, MAYES, HILL-EVANS, GIRAL, NEILSON,
SANCHEZ, McANDREW, BOROWSKI, KENYATTA, DONAHUE, CERRATO,
WARREN, RIVERA, BOYD, E. NELSON, BIZZARRO, McNEILL, CEPEDA-
FREYTIZ, TOMLINSON AND CIRESI, MAY 30, 2025
REFERRED TO COMMITTEE ON CONSUMER PROTECTION, TECHNOLOGY AND
UTILITIES, MAY 30, 2025
AN ACT
Providing for duties of direct-to-consumer genetic testing
companies and for prohibition on disclosure of genetic data
of consumers; and imposing civil penalties.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Short title.
This act shall be known and may be cited as the Genetic
Information Privacy Act.
Section 2. Definitions.
The following words and phrases when used in this act shall
have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Biological sample." A material part of, or discharge from,
a human being or a derivative of a material part of, or
discharge from, a human being, including tissue, blood, urine
and saliva, known to contain DNA.
"Consumer." An individual who is a resident of this
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

Commonwealth.
"Deidentified data." Data that cannot reasonably be used to
infer information about, or otherwise be linked to, an
identifiable consumer that is subject to all of the following:
(1) Administrative and technical measures to ensure that
the data cannot be associated with a particular consumer.
(2) A public commitment by a direct-to-consumer genetic
testing company to maintain and use the data in a
deidentified form and to not attempt to reidentify the data.
(3) Legally enforceable contractual obligations that
prohibit a recipient of the data from attempting to
reidentify the data.
"Direct-to-consumer genetic testing company" or "company."
As follows:
(1) An entity that:
(i) offers a direct-to-consumer genetic testing
product or service; or
(ii) collects, uses or analyzes genetic data
provided to the entity by a consumer as a result of a
direct-to-consumer genetic testing product or service.
(2) The term does not include an entity that is only
engaged in collecting, using or analyzing genetic data or
biological samples in the context of research, as defined in
45 CFR 164.501 (relating to definitions), that is conducted
in accordance with 21 CFR Ch. I Subch. A Pts. 50 (relating to
protection of human subjects) and 56 (relating to
institutional review boards), 45 CFR Subt. A Subch. A Pt. 46
(relating to protection of human subjects) and the Good
Clinical Practice Guideline issued by the International
Council for Harmonisation.
20250HB1530PN1787 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

"DNA." Deoxyribonucleic acid.
"Express consent." A consumer's affirmative response to a
clear, meaningful and prominent notice regarding the collection,
use or disclosure of genetic data for a specific purpose.
"Genetic data." Any data, regardless of the format of the
data, that concerns a consumer's genetic characteristics. The
term does not include deidentified data. The term includes any
of the following:
(1) Raw sequence data that results from sequencing of a
consumer's complete extracted DNA or a portion of the
extracted DNA.
(2) Genotypic and phenotypic information that results
from analyzing the raw sequence data.
(3) Self-reported health information that a consumer
submits to a direct-to-consumer genetic testing company
regarding the consumer's health conditions and that is used
for scientific research or product development and analyzed
in connection with the consumer's raw sequence data.
"Genetic testing." A laboratory test of a consumer's
complete DNA, regions of DNA, chromosomes, genes or gene
products to determine the presence of genetic characteristics of
the consumer.
"Person." An individual, partnership, corporation,
association, business, business trust or legal representative of
an organization.
Section 3. Duties of direct-to-consumer genetic testing
companies.
In order to safeguard the privacy, confidentiality, security
and integrity of a consumer's genetic data, a direct-to-consumer
genetic testing company shall have the following duties:
20250HB1530PN1787 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

(1) Provide clear and complete information regarding the
company's policies and procedures for the collection, use or
disclosure of genetic data by making all of the following
available to a consumer:
(i) A high-level privacy policy overview that
includes basic, essential information about the
company's collection, use or disclosure of genetic data.
(ii) A prominent, publicly available privacy notice
with information about the company's data collection,
consent, use, access, disclosure, transfer, security and
retention and deletion practices.
(2) Obtain a consumer's consent for the collecti