Bill > S0248

This bill, titled the "Genetic Information Privacy Act," establishes new protections for the genetic data of Vermont residents collected by direct-to-consumer genetic testing companies. It mandates that these companies must obtain "express consent," which means a consumer's clear and affirmative agreement, before collecting, using, or sharing their genetic data, and requires separate consent for various actions like storing biological samples or transferring data to third parties. The bill defines "genetic data" broadly to include DNA, RNA, and any derived or inferred information, but excludes de-identified data and certain research or medical contexts. Companies must provide plain-language privacy notices, implement robust data security measures, and allow consumers to easily access, delete, or request the destruction of their genetic data and biological samples. Consumers also gain the right to revoke consent, which companies must honor promptly, and are protected from discrimination for exercising their privacy rights. Furthermore, contracts with service providers will prohibit them from using genetic data for their own commercial purposes or combining it with other data. The bill also explicitly prevents the disclosure of genetic data to entities involved in health insurance, life insurance, long-term care insurance, disability insurance, or employment decisions, and sets restrictions on storing or transferring genetic data outside the United States. The Attorney General will be responsible for enforcement, and the provisions will take effect on July 1, 2026, with the law aiming to provide the greatest protection for consumer privacy in case of conflicts with other laws.

Housing and Urban Affairs

https://legislature.vermont.gov/bill/status/2026/S.248