On March 5, 2025, Senators Invoice Cassidy (R-LA) and Gary Peters (D-MI) launched the federal Genomic Knowledge Safety Act (“GDPA”). The Senators launched the identical invoice on the finish of final 12 months, however the invoice stagnated, and Congress adjourned quickly after. Notably, as a part of his February 2024 white paper, Senator Cassidy particularly referred to as for the regulation of genetic information collected by direct-to-consumer genetic testing firms, pointing to a number of states which have enacted legal guidelines regulating these firms over the previous a number of years.
Whereas the GDPA bears some resemblance to those state direct-to-consumer genetic privateness legal guidelines, the invoice has sure distinctive options, equivalent to making use of to firms that buy information from direct-to-consumer genomic testing firms and requiring {that a} direct-to-consumer genomic testing firm present discover to shoppers if the corporate is bought or in any other case acquired. We summarize key provisions of the GDPA under.
Applicability
The GDPA applies to a “direct-to-consumer genomic testing firm,” which is outlined to imply an individual that:
- Manufactures or develops genomic testing services or products on the market on to shoppers;
- Analyzes or interprets genomic information obtained from a client;
- Collects, makes use of, maintains, or discloses genomic information collected or derived from a direct-to-consumer genomic testing services or products; or
- Purchases or acquires genomic information from a direct-to-consumer genomic testing firm.
The definition of “direct-to-consumer genomic testing firm” excludes “a well being care skilled” as outlined in part 225 of the Public Well being Service Act (42 U.S.C. § 234) that performs any of the 4 above actions for functions of prognosis or therapy of a medical situation.
The GDPA applies to “genomic information,” which “means any information, no matter its format or whether or not the information has been deidentified, that outcomes from the evaluation of a organic pattern from a client and issues genomic materials” together with:
- DNA, RNA, genes, chromosomes, alleles, genomes, alterations or modifications to DNA/RNA, and SNPs;
- uninterpreted information that outcomes from the evaluation of the organic pattern; or
- any data extrapolated, derived, or inferred therefrom.
The definition of “genomic information” excludes “deidentified genomic information of a client to the extent that such information is used to conduct medical or scientific analysis, per the privateness rules promulgated underneath . . . [HIPAA].” Deidentified genomic information is outlined as “information that can’t be used to deduce details about, or in any other case be linked to, a selected particular person, offered that the enterprise that possesses the data [implements specific safeguards listed in the bill to prevent against re-identification].”
A “client” means a person who gives a organic pattern to a direct-to-consumer genomic testing firm.
Client Rights
The invoice requires that direct-to-consumer genomic testing firms present a “easy and efficient mechanism” (by way of the first means the corporate communicates to the buyer) to permit a client to: (i) entry their genomic information and (ii) delete the account of the buyer (together with related genomic information) AND request destruction of any of their organic samples.
The invoice gives an exception provided that exercising the correct would (i) require deletion of knowledge topic to a warrant, subpoena, or different court docket order; or (ii) the corporate should retain such data to adjust to different relevant authorized/regulatory necessities.
Discover
The invoice requires a direct-to-consumer genomic testing firm present a discover that precisely summarizes the buyer rights and explicitly discloses that “deidentified genomic information of a client could also be shared or disclosed to conduct a medical or scientific analysis [under HIPAA].” The invoice notes that this discover should be accessible in a transparent and conspicuous, not deceptive, and easy-to-read method.
Company Transaction Disclosure
The invoice requires that if a direct-to-consumer genomic testing firm is bought or in any other case acquired by one other entity, the corporate should present shoppers with a “detailed and correct” description of the identification of the entity buying the corporate and the way the buyer can train their entry and deletion rights underneath the brand new possession. The corporate should ship its discover a minimum of 30 days earlier than the acquisition is full, and if the acquisition is accomplished whereas a client’s request is pending, the entity buying the corporate is required to adjust to the request.
Preemption
The GDPA expressly states that it’s going to not preempt state legal guidelines except they battle with the GDPA.
Enforcement
Violations of the GDPA could be misleading or unfair commerce practices underneath the FTC Act. The FTC might have interaction in rulemaking inside 1 12 months of enactment.
Following its introduction within the Senate, the GDPA was referred to the Senate Committee on Commerce, Science, and Transportation.
