1.1 	A bill for an act
1.2 	relating to consumer data protection; requiring direct-to-consumer genetic testing 
1.3 	companies to provide disclosure notices and obtain consent;proposing coding for 
1.4 	new law in Minnesota Statutes, chapter 325F.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. [325F.995] GENETIC INFORMATION PRIVACY ACT.
1.7 		Subdivision 1.Definitions. (a) For purposes of this section, the following terms have 
1.8 	the meanings given them.
1.9 	(b) "Biological sample" means any material part of a human, discharge therefrom, or 
1.10 	derivative thereof, such as tissue, blood, urine, or saliva, known to contain deoxyribonucleic 
1.11 	acid (DNA).
1.12 	(c) "Consumer" means an individual who is a Minnesota resident.
1.13 	(d) "Deidentified data" means data that cannot reasonably be used to infer information 
1.14 	about, or otherwise be linked to, an identifiable consumer and that is subject to:
1.15 	(1) administrative and technical measures to ensure the data cannot be associated with 
1.16 	a particular consumer;
1.17 	(2) public commitment by the company to (i) maintain and use data in deidentified form, 
1.18 	and (ii) not attempt to reidentify the data; and
1.19 	(3) legally enforceable contractual obligations that prohibit any recipients of the data 
1.20 	from attempting to reidentify the data.
2.1 	(e) "Direct-to-consumer genetic testing company" or "company" means an entity that 
2.2 	(1) offers consumer genetic testing products or services directly to consumers, or (2) collects, 
2.3 	uses, or analyzes genetic data provided to the entity by a consumer.
2.4 	(f) "Express consent" means a consumer's affirmative response to a clear, meaningful, 
2.5 	and prominent notice regarding the collection, use, or disclosure of genetic data for a specific 
2.6 	purpose.
2.7 	(g) "Genetic data" means any data, regardless of the data's format, that concerns a 
2.8 	consumer's genetic characteristics. Genetic data includes but is not limited to:
2.9 	(1) raw sequence data that results from sequencing a consumer's complete extracted 
2.10 	DNA or a portion of the extracted DNA;
2.11 	(2) genotypic and phenotypic information that results from analyzing the raw sequence 
2.12 	data; and
2.13 	(3) self-reported health information that a consumer submits to a company regarding 
2.14 	the consumer's health conditions and that is used for scientific research or product 
2.15 	development and analyzed in connection with the consumer's raw sequence data.
2.16 	Genetic data does not include deidentified data.
2.17 	(h) "Genetic testing" means any laboratory test of a consumer's complete DNA, regions 
2.18 	of a consumer's DNA, chromosomes, genes, or gene products to determine the presence of 
2.19 	genetic characteristics.
2.20 	(i) "Person" means an individual, partnership, corporation, association, business, business 
2.21 	trust, or legal representative of an organization.
2.22 		Subd. 2.Disclosure and consent requirements. (a) To safeguard the privacy, 
2.23 	confidentiality, security, and integrity of a consumer's genetic data, a direct-to-consumer 
2.24 	genetic testing company must:
2.25 	(1) provide clear and complete information regarding the company's policies and 
2.26 	procedures governing the collection, use, maintenance, and disclosure of genetic data by 
2.27 	making available to a consumer:
2.28 	(i) a high-level privacy policy overview that includes basic, essential information about 
2.29 	the company's collection, use, or disclosure of genetic data; and
2.30 	(ii) a prominent, publicly available privacy notice that includes at a minimum information 
2.31 	about the company's data collection, consent, use, access, disclosure, maintenance, transfer, 
2.32 	security, retention, and deletion practices;
3.1 	(2) obtain a consumer's consent to collect, use, and disclose the consumer's genetic data, 
3.2 	including at a minimum:
3.3 	(i) initial express consent that clearly (A) describes the uses of the genetic data collected 
3.4 	through the genetic testing product service, and (B) specifies who has access to the test 
3.5 	results and how the genetic data may be shared;
3.6 	(ii) separate express consent to (A) transfer or disclose the consumer's genetic data to 
3.7 	any person other than the company's vendors and service providers, or (B) use genetic data 
3.8 	beyond the primary purpose of the genetic testing product or service and inherent contextual 
3.9 	uses;
3.10 	(iii) separate express consent to retain any biological sample provided by the consumer 
3.11 	following completion of the initial testing service requested by the consumer;
3.12 	(iv) informed consent in compliance with federal policy for the protection of human 
3.13 	research subjects, as specified in Code of Federal Regulations, title 45, section 46, to transfer 
3.14 	or disclose the consumer's genetic data to third-party persons for research purposes or 
3.15 	research conducted under the control of the company for the purpose of publication or 
3.16 	generalizable knowledge; and
3.17 	(v) express consent for marketing by (A) the direct-to-consumer genetic testing company 
3.18 	to a consumer based on the consumer's genetic data, or (B) a third party to a consumer based 
3.19 	on the consumer having ordered or purchased a genetic testing product or service. For 
3.20 	purposes of this clause, "marketing" does not include the provision of customized content 
3.21 	or offers on the websites or through the applications or services provided by the 
3.22 	direct-to-consumer genetic testing company with the first-party relationship to the customer;
3.23 	(3) require valid legal process to disclose genetic data to law enforcement or any other 
3.24 	governmental agency without a consumer's express written consent;
3.25 	(4) develop, implement, and maintain a comprehensive security program to protect a 
3.26 	consumer's genetic data against unauthorized access, use, or disclosure; and
3.27 	(5) provide a process for a consumer to:
3.28 	(i) access the consumer's genetic data;
3.29 	(ii) delete the consumer's account and genetic data; and
3.30 	(iii) request and obtain the destruction of the consumer's biological sample.
3.31 	(b) Notwithstanding any other provisions in this section, a direct-to-consumer genetic 
3.32 	testing company is prohibited from disclosing a consumer's genetic data to any entity offering 
4.1 	health insurance, life insurance, or long-term care insurance or to any employer of the 
4.2 	consumer without the consumer's written consent.
4.3 		Subd. 3.Attorney general enforcement. The attorney general may enforce this section 
4.4 	under section 8.31.
4.5 		Subd. 4.Limitations. This section does not apply to:
4.6 	(1) protected health information that is collected by a covered entity or business associate, 
4.7 	as those terms are defined in Code of Federal Regulations, title 45, parts 160 and 164;
4.8 	(2) a public or private institution of higher education; or
4.9 	(3) an entity owned or operated by a public or private institution of higher education.