Sends faxes, in Virginia

Va. Code Ann. § 59.1-443.2 · Read the law's page

• Except as otherwise specifically provided by law, do not intentionally communicate another individual's social security number to the general public (section 59.1-443.2(A)(1)).
• Do not print an individual's social security number on any card required for the individual to access or receive products or services you provide (section 59.1-443.2(A)(2)).
• Do not require an individual to use a social security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required to access the site (section 59.1-443.2(A)(3)).
• Do not send or cause to be sent or delivered a letter, envelope or package that displays a social security number on the face of the mailing envelope or package, or from which one is visible, whether on the outside or inside (section 59.1-443.2(A)(4)).
• Do not embed an encrypted or unencrypted social security number in or on a card or document, including by a bar code, chip, magnetic strip or other technology, in place of removing it as the section requires (section 59.1-443.2(E)).

Va. Code Ann. §§ 59.1-593 to 59.1-602 · Read the law's page

• If you are a direct-to-consumer genetic testing company, give Virginia consumers, in plain language with any genetic testing product and on your website, a summary of your policies and procedures on the collection, use, maintenance, retention, disclosure, transfer, deletion and security of genetic data and on access to it, a summary of your privacy practices, information on the express-consent requirement and the process for revoking consent, notice that deidentified genetic or phenotypic data may be shared with third parties for research, and the process for filing a complaint alleging a violation (section 59.1-595).
• Obtain a consumer's express consent for the collection, use and disclosure of genetic data, never inferred from inaction, with separate and express consent for the use of the data collected (including who receives access, how it is shared and the purposes), for storing the biological sample after the initial testing, for each use of the data or sample beyond the primary purpose and inherent contextual uses, for each transfer or disclosure to a third party other than a service provider (naming the third party), and for any marketing or facilitation of marketing based on the data, except marketing on your own website or mobile application that meets the three conditions of section 59.1-596(B)(5).
• Give a consumer a mechanism to revoke express consent, including through the primary medium through which you communicate with consumers, honor a revocation as soon as practicable and in all cases within 30 days of receipt, and destroy the consumer's biological sample within 30 days of receiving revocation of consent to store it (section 59.1-596(C) and (D)).
• Implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure (section 59.1-597).
• Develop procedures and practices that let a consumer easily access the consumer's genetic data, delete it (except data that state or federal law requires you to retain, and any account the consumer created), and revoke express consent to storage of the biological sample and request its destruction (section 59.1-597).
• Bind every service provider that handles a consumer's biological sample, extracted genetic material, genetic data or identity information by contract not to retain, use or disclose them for any purpose other than the specific services in the contract, and not to associate or combine them with information the provider receives from or on behalf of another person or collects from its own interaction with consumers (section 59.1-598).
• Do not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health insurance, life insurance, long-term care insurance, disability insurance or employment, or to an entity that advises such an entity, without the consumer's express consent (section 59.1-599).
• Do not discriminate against a consumer for exercising rights under the chapter, whether by denying or changing goods, services or benefits, charging a different price or rate, providing a different level or quality, suggesting any of these, or treating the exercise of rights as a basis or suspicion of criminal wrongdoing or unlawful conduct. This duty binds a person or a public entity (section 59.1-600).