Genomic Data Protection Act

Summary

Requires direct-to-consumer genomic testing companies to give consumers clear rights and easy tools to access their genomic data, delete their accounts and genomic data, and request destruction of biological samples, with required notices about sharing of deidentified genomic data. It imposes 30-day deadlines to fulfill deletion/destruction requests, requires acquiring companies to honor outstanding requests after a sale, allows exceptions for legal retention obligations, and makes violations enforceable as unfair or deceptive acts by the FTC, which may issue rules within one year.

• Direct-to-consumer genomic companies must give consumers easy access to their genomic data and tools to delete data and request sample destruction.
• Companies must clearly notify consumers about rights and possible sharing of deidentified genomic data for research consistent with HIPAA.
• Deletion and destruction requests must be completed and confirmed within 30 days of the consumer's request.
• An acquiring company must honor outstanding deletion/destruction requests from the prior owner; the 30-day clock starts at the original request date.
• Companies can refuse deletion/destruction only to comply with lawful warrants, subpoenas, court orders, or other legal/regulatory retention duties.
• Violations are treated as unfair or deceptive acts enforceable by the FTC, which may issue implementing rules within one year.
• The bill defines terms needed for a genomic-data privacy regime, including 'biological sample' and 'deidentified genomic data.'
• The law focuses on private-sector genomic testing companies and does not change HIPAA or create a new federal benefits program.