Moses & Singer LLP

Washington State Proposes New DTC Genetic Privacy Legislation

January 27, 2020

By: Linda A. Malek, Jill E. Anderson, and Nora Lawrence Schmitt

On January 15, Washington state lawmakers introduced H.B. 2485, proposed legislation that would impose privacy and informed consent requirements on direct-to-consumer (DTC) genetic-testing companies for their collection, use and disclosure of genetic data.  If enacted, H.B. 2485 (available here) would require DTC genetic-testing companies offering products or services to Washington residents to have specific language in their informed consent forms, privacy policies and third-party contracts and provide Washington consumers certain rights with respect to their genetic data and biological samples.

Applicability and Scope

H.B. 2485 would apply to any entity, regardless of its location, that offers genetic testing products or services directly to Washington residents without requiring the involvement of a healthcare provider. The law strives to protect consumers’ genetic data, which includes raw sequence data resulting from DNA sequencing, genotypic and phenotypic information resulting from analysis of the raw sequence data and self-reported health data that consumers submit to the DTC genetic-testing company regarding his/her health conditions and that is used for scientific research or product development and analyzed in connection with consumer’s raw sequence data.

H.B. 2485 would not apply to "de-identified” genetic data, which the bill defines as data that cannot reasonably be used to infer information about, or otherwise be linked to, an identifiable consumer. Importantly, under H.B. 2485, merely stripping genetic data of identifiable information would be insufficient to be considered “de-identified” under the definition of the term. In order to be de-identified, the genetic data would also need to be subject to (i) administrative and technical measures to ensure it cannot be associated with a particular consumer; (ii) public commitment by the company to maintain and use data in de-identified form and not to attempt to re-identify it; and (iii) legally enforceable contractual obligations with any third-party recipients of the data prohibiting those recipients from attempting to re-identify it.

Informed Consent Requirements

The proposed law seeks to require DTC genetic-testing companies to obtain robust informed consent from consumers for the collection, use, or disclosure of their genetic information. In addition to requiring written consent for the collection of genetic data, the law would also require separate consent for certain types of third-party disclosures, as well as for marketing to a consumer based on his/her genetic data or purchase history. Additionally, if enacted, H.B. 2485 would be the first genetic privacy law to require DTC genetic-testing companies to obtain informed consent consistent with the Federal Policy for the Protection of Human Subjects (the “Common Rule”) in order to use identifiable genetic data for research purposes, or to transfer or disclose such data to third parties for research purposes.

Consumer Rights

H.B. 2485 would provide consumers with various rights with respect to their genetic data, including the right to request access, correction and deletion of their genetic data and the destruction of their biological sample, as well as the right to specify the period of retention for their genetic data and biological sample. As currently drafted, the bill provides no exceptions to these rights, meaning the DTC genetic-testing company would be required to comply with all such requests. In order to meet these consumer rights, DTC genetic-testing companies would be required to add specific language to their informed consent forms, privacy policies and/or terms of use. Additionally, DTC genetic-testing companies would be prohibited from disclosing genetic data to a consumer’s employer or to any entity offering health or life insurance.

Privacy Policies and Practices

DTC genetic-testing companies would be required under the law to provide “clear and complete information” regarding their policies and procedures for the collection, use and disclosure of genetic data. Specifically, companies would be required to provide consumers with a high-level privacy policy overview that includes basic, essential information about the company’s practices with respect to genetic data, as well as a more detailed privacy notice that includes, at a minimum, information about the company’s data collection, consent, use, access, disclosure, transfer, security and retention and deletion practices. DTC genetic-testing companies would also be required to have in place a comprehensive security program to protect consumer’s genetic data against unauthorized access, disclosure, or use.

Implications for DTC Genetic-Testing Companies

Washington is just one of several states that have recently enacted robust genetic privacy laws and we expect other states to propose genetic privacy requirements. Lawmakers will need to clarify a number of ambiguous terms and concepts in the current draft of H.B. 2485, including the definition of the terms “offer” and “directly” and the requirements for operationalizing certain informed consent elements, such as the right to specify the retention period for one’s genetic data.

While some DTC genetic-testing companies offering products or services to Washington residents may find that they are already in compliance with certain aspects of H.B. 2485 under existing state law, the proposed law presents a number of unique requirements that must be considered. For example, companies that utilize de-identified data will need to ensure compliance with all requirements for de-identification under H.B. 2485, including confirming that all third-party contracts prohibit the re-identification of genetic data. Additionally, DTC genetic-testing companies that disclose or otherwise use identifiable genetic data for research purposes will need to pay close attention to the overlapping Common Rule informed consent requirements, as these are generally not included in consumer-facing informed consent documents. It will also be critical to ensure all privacy policies and terms of use are current and accurate.

In anticipation of H.B. 2485 potentially becoming law and in order to ensure compliance with other state genetic privacy laws, we encourage DTC genetic-testing companies to carefully analyze their informed consent forms, third-party contracts, privacy policies and terms of use to determine what, if any, actions they will need to take to comply with these laws.

 

© 2020 Moses & Singer LLP. All Rights Reserved.