Summary

Requires companies that sell direct-to-consumer genetic tests to give people clear access to and control over their genomic data and biological samples, including the ability to request deletion or destruction. Companies must notify consumers about those rights and about possible sharing of deidentified genomic data; they must comply with deletion/destruction requests within 30 days (subject to narrow legal or regulatory retention exceptions). The Federal Trade Commission enforces the rules and may issue implementing regulations within a year.

Key Points

• Direct-to-consumer genomic testing companies must give consumers easy access to their genomic data and biological samples.
• Consumers can request deletion of genomic data and destruction of biological samples; companies must comply within 30 days unless retention is required by law.
• Companies must notify consumers about their rights and about potential sharing or sale of deidentified genomic data.
• Companies must provide at least 30 days' notice to consumers before selling or transferring ownership of the company or its assets.
• The Federal Trade Commission enforces the law using FTC Act authorities and may issue implementing rules under the APA within one year.
• Key terms (consumer, genomic data, biological sample, deidentified genomic data, direct-to-consumer testing company) are defined in the statute.
• The law preserves other federal and state legal requirements except where they conflict with the statute; legal retention requirements take precedence over deletion requests.
• Covered businesses will need new compliance systems for access, deletion, sample destruction, notices, and transaction reporting.

Categories & Tags