Bill > H0639

This bill, titled the "Genetic Information Privacy Act," establishes new protections for genetic data for Vermont residents, defining key terms like "affirmative authorization" (a clear decision by a consumer), "biological sample" (any human material containing DNA), "biometric data" (unique physical identifiers like fingerprints), "consumer" (a Vermont resident), "dark pattern" (deceptive user interface design), "direct-to-consumer genetic testing company" (companies offering genetic testing directly to consumers), "disclose" (to share or trade data), "express consent" (explicit permission after clear notice), "genetic data" (information derived from biological samples concerning genetic material), "genetic testing" (tests to determine genetic information), "person" (any individual or entity), "publicly available information" (data accessible to the general public), and "service provider" (entities handling samples or data on behalf of testing companies). The act mandates that direct-to-consumer genetic testing companies provide clear privacy notices and obtain explicit consent for the collection, use, and disclosure of genetic data, including separate consent for storage of biological samples, uses beyond the initial testing, transfers to third parties, and marketing. It also requires companies to offer easy ways to revoke consent and destroy data or samples within 30 days, implement reasonable security measures, allow consumers to access and delete their data, and ensure biological samples and genetic data are not stored in sanctioned countries or transferred outside the U.S. without express consent. Contracts with service providers must prohibit them from retaining or using genetic data for their own commercial purposes or associating it with other data. The bill also prohibits discrimination against consumers for exercising their privacy rights and restricts disclosure of genetic data to entities involved in health or life insurance decisions, or to government entities without a warrant or express consumer consent. Enforcement is handled by the Attorney General as an unfair and deceptive trade practice, and the act includes a cure period for alleged violations before a civil action can be filed, with this cure period provision set to be repealed on June 30, 2028. The bill does not apply to protected health information covered by HIPAA or to certain scientific research conducted by educational institutions, and it prioritizes the law that offers the greatest privacy protection in case of conflict.