119-s863

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 863 Introduced in Senate

    (IS) ]

<DOC>

119th CONGRESS
 1st Session
 S. 863

 To provide consumers with the right to delete their genomic data, and 
 for other purposes.

_______________________________________________________________________

 IN THE SENATE OF THE UNITED STATES

 March 5, 2025

Mr. Cassidy (for himself and Mr. Peters) introduced the following bill; 
 which was read twice and referred to the Committee on Commerce, 
 Science, and Transportation

_______________________________________________________________________

 A BILL

 To provide consumers with the right to delete their genomic data, and 
 for other purposes.

 Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

 This Act may be cited as the ``Genomic Data Protection Act''.

SEC. 2. CONSUMER RIGHTS REGARDING PRIVACY OF GENOMIC DATA.

    (a) Requirements.--

    (1) Consumer controls.--
        (A) In general.--A direct-to-consumer genomic 
 testing company shall provide a simple and effective 
 mechanism to allow a consumer to--
            (i) access the genomic data of the 
 consumer; and
            (ii) subject to paragraph

    (4) --
            (I) delete the account of the 
 consumer, including any genomic data 
 associated with such account; and
            (II) request the destruction of any 
 biological sample of the consumer.
        (B) Required mechanism.--The direct-to-consumer 
 genomic testing company shall make available to a 
 consumer the mechanism described in subparagraph
        (A) through the primary means by which the company 
 communicates with the consumer.

    (2) Notification.--
        (A) Consumer controls and use of deidentified 
 genomic data.--A direct-to-consumer genomic testing 
 company shall make available, in a clear and 
 conspicuous, not misleading, and easy-to-read manner a 
 notice that--
            (i) provides a detailed and accurate 
 representation of the rights set forth in 
 clauses
            (i) and
            (ii) of paragraph

    (1)
        (A) ; and
            (ii) discloses that the deidentified 
 genomic data of a consumer may be shared or 
 disclosed to conduct medical or scientific 
 research, consistent with the privacy 
 regulations promulgated under 

section 264
            (c) of 
 the Health Insurance Portability and 
 Accountability Act of 1996 (42 U.S.C. 1320d-2 
 note).
        (B) Purchase of company.--In the event that a 
 direct-to-consumer genomic testing company is purchased 
 or otherwise acquired by another entity, the direct-to-
 consumer genomic testing company shall send to each 
 consumer, not fewer than 30 days prior to the date on 
 which the purchase or acquisition is complete, a notice 
 that includes--
            (i) the identity of the entity purchasing 
 or otherwise acquiring the company; and
            (ii) a detailed and accurate representation 
 of the how a consumer can exercise the rights 
 set forth in clauses
            (i) and
            (ii) of paragraph

    (1)
        (A) under the new ownership.

    (3) Processing of deletion or destruction requests.--
        (A) In general.--With respect to a consumer's 
 request to delete the genomic data or to destroy the 
 biological sample of the consumer, a direct-to-consumer 
 genomic testing company shall--
            (i) fulfill such request not later than 30 
 days after the date on which the consumer makes 
 such request; and
            (ii) notify the consumer of such deletion 
 or destruction not later than 30 days after the 
 deletion or destruction.
        (B) Outstanding requests during purchase of 
 company.--In the event that a direct-to-consumer 
 genomic testing company is purchased or otherwise 
 acquired by another entity while a consumer's request 
 to delete the genomic data or to destroy the biological 
 sample of the consumer is outstanding--
            (i) the entity that is purchasing or 
 otherwise acquiring the company shall comply 
 with the requirements described in subparagraph
        (A) ; and
            (ii) the 30-day period to fulfill such 
 request shall begin on the date on which the 
 consumer makes such request to the direct-to-
 consumer genomic testing company.

    (4) Exceptions.--A direct-to-consumer genomic testing 
 company shall not permit a consumer to exercise a right 
 described in paragraph

    (1)
        (A)
            (ii) if the company determines 
 that the exercise of the right would require the deletion of 
 information--
        (A) subject to a warrant, lawfully executed 
 subpoena, or other court order; or
        (B) the company is required to retain in order to 
 comply with any other applicable legal or regulatory 
 requirement.

    (b) Enforcement.--

    (1) Unfair or deceptive acts or practices.--A violation of 
 this section or a regulation promulgated thereunder shall be 
 treated as a violation of a rule defining an unfair or 
 deceptive act or practice under 

section 18

    (a)

    (1)
        (B) of the 
 Federal Trade Commission Act (15 U.S.C. 57a

    (a)

    (1)
        (B) ).

    (2) Powers of the commission.--
        (A) In general.--The Commission shall enforce this 
 section in the same manner, by the same means, and with 
 the same jurisdiction, powers, and duties as though all 
 applicable terms and provisions of the Federal Trade 
 Commission Act (15 U.S.C. 41 et seq.) were incorporated 
 into and made a part of this section.
        (B) Privileges and immunities.--Any person who 
 violates this section or a regulation promulgated 
 thereunder shall be subject to the penalties and 
 entitled to the privileges and immunities provided in 
 the Federal Trade Commission Act (15 U.S.C. 41 et 
 seq.).
            (C) Authority preserved.--Nothing in this section 
 shall be construed to limit the authority of the 
 Commission under any other provision of law.
            (D) Rulemaking.--Not later than 1 year after the 
 date of enactment of this section, the Commission may 
 promulgate in accordance with 

section 553 of title 5, 
 United States Code, such rules as may be necessary to 
 carry out this section.
            (c) === Definitions. ===
-In this section:

    (1) Biological sample.--The term ``biological sample'' 
 means any material part of the human, discharge therefrom, or 
 derivative thereof, such as tissue, blood, urine, or saliva, 
 known to contain deoxyribonucleic acid

    (DNA) .

    (2) Commission.--The term ``Commission'' means the Federal 
 Trade Commission.

    (3) Consumer.--The term ``consumer'' means an individual 
 who provides a biological sample to a direct-to-consumer 
 genomic testing company.

    (4) Deidentified genomic data.--The term ``deidentified 
 genomic data'' means data that cannot be used to infer 
 information about, or otherwise be linked to, a particular 
 individual, provided that the business that possesses the 
 information does all of the following:
        (A) Takes reasonable measures to ensure that the 
 information cannot be associated with a particular 
 individual.
        (B) Publicly commits to maintain and use the 
 information only in deidentified form and not to 
 attempt to reidentify the information, except that the 
 business may attempt to reidentify the information 
 solely for the purpose of determining whether its 
 deidentification processes satisfy the requirements of 
 this subparagraph, provided that the business does not 
 use or disclose any information reidentified in this 
 process and destroys the reidentified information upon 
 completion of that assessment.
            (C) Contractually obligates any recipients of the 
 information to take reasonable measures to ensure that 
 the information cannot be associated with a particular 
 individual and to commit to maintaining and using the 
 information only in deidentified form and not to 
 reidentify the information.

    (5) Direct-to-consumer genomic testing company.--
        (A) In general.--The term ``direct-to-consumer 
 genomic testing company'' means a person that does any 
 of the following:
            (i) Manufactures or develops genomic 
 testing products or services for sale directly 
 to consumers.
            (ii) Analyzes or interprets genomic data 
 obtained from a consumer.
            (iii) Collects, uses, maintains, or 
 discloses genomic data collected or derived 
 from a direct-to-consumer genomic testing 
 product or service.
            (iv) Purchases or acquires genomic data 
 from a direct-to-consumer genomic testing 
 company.
        (B) Exclusion for health care professionals.--The 
 term ``direct-to-consumer genomic testing company'' 
 shall not include a health care professional (as 
 defined in 

section 225 of the Public Health Service Act 
 (42 U.S.C. 234)) that performs an action described in 
 subparagraph
        (A) for purposes of diagnosis or treatment 
 of a medical condition.

    (6) Genomic data.--
        (A) In general.--The term ``genomic data''--
            (i) means any data, regardless of its 
 format or whether the data has been 
 deidentified, that results from the analysis of 
 a biological sample from a consumer and 
 concerns genomic material; and
            (ii) includes--
            (I) deoxyribonucleic acids

    (DNA) , 
 ribonucleic acids

    (RNA) , genes, 
 chromosomes, alleles, genomes, 
 alterations or modifications to DNA or 
 RNA, and single nucleotide 
 polymorphisms

    (SNPs) ;
            (II) uninterpreted data that 
 results from the analysis of the 
 biological sample; or
            (III) any information extrapolated, 
 derived, or inferred therefrom.
        (B) Exclusion of deidentified genomic data.--The 
 term ``genomic data'' shall not include the 
 deidentified genomic data of a consumer to the extent 
 that such data is used to conduct medical or scientific 
 research, consistent with the privacy regulations 
 promulgated under 

section 264
            (c) of the Health 
 Insurance Portability and Accountability Act of 1996 
 (42 U.S.C. 1320d-2 note).

    (7) Genomic testing product or service.--The term ``genomic 
 testing product or service'' means any testing product or 
 service that analyzes or interprets the genomic data or 
 biological sample of a consumer.
            (d) Relationship to Federal and State Laws.--

    (1) Federal law preservation.--Nothing in this Act, or a 
 regulation promulgated under this Act, shall be construed to 
 limit any other provision of Federal law, except as 
 specifically provided in this Act.

    (2) State law preservation.--Nothing in this Act, or a 
 regulation promulgated under this Act, shall be construed to 
 preempt, displace, or supplant any State law, except to the 
 extent that a provision of State law conflicts with a provision 
 of this Act, or a regulation promulgated under this Act, and 
 then only to the extent of the conflict.
 <all>