Law / United States / 
Alabama
Alabama Genetic Data Privacy Act
Officially Alabama Genetic Data Privacy Act: consent, access, destruction and disclosure duties of genetic testing companies
Alabama Genetic Data Privacy Act, Ala. Code secs. 8-43-1 to 8-43-6
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Retention
- Audit expectation
- none
As of .
What it requires
- As a genetic testing company, display to the consumer in plain language your policies and procedures for the collection, use, maintenance and disclosure of genetic data: a privacy policy overview, the full privacy policy notice, a notice that genetic data may be included in deidentified data shared with a third party for research, and a description of how to file a complaint.
- Obtain the consumer's initial express consent to use of the biological sample and resulting genetic data to provide the ordered product or service, to who may have access (including a contractor), and to retention for future testing for other products or services, and tell the consumer you may later seek consent to transfer the sample or disclose the data to a third party other than a contractor.
- Obtain the consumer's express consent every time you transfer the biological sample or disclose genetic data to a third party other than a contractor for a reason other than fulfilling an order, use them for a purpose other than the ordered product or service, or market to the consumer based on genetic data (customized content on your own site or app is not marketing).
- Obtain the consumer's informed consent, in compliance with the federal rules for the protection of human subjects at 45 C.F.R. Part 46, before you transfer a biological sample or disclose genetic data for independent research by a third party or for research you sponsor.
- Provide a process for the consumer to access genetic data, delete the account, request destruction of the biological sample and genetic data, and revoke any express or informed consent given.
- Destroy the biological sample and genetic data as soon as reasonably possible and no more than 30 days after a destruction request, and secure the return of a sample and data transferred or disclosed on a consent the consumer revokes as soon as reasonably possible and no more than 60 days after the revocation.
- Do not disclose a consumer's genetic data to a person issuing health, life, disability or long-term care insurance, or to an employer or prospective employer of the consumer, without the consumer's express written consent.
- When law enforcement requests data under valid legal process, do not disclose the existence of the process or the fact of your compliance to the person it concerns (you may still publish a transparency report of the number and types of requests).
- Bind each contractor by contract not to use, retain or disclose a biological sample, extracted genetic material, genetic data or identifying information for any purpose other than the contracted service, and hold the contractor to the same confidentiality obligation as your own.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 8-43-6(b): the Consumer Interest Division of the Office of the Attorney General may recover a civil penalty of up to $3,000 for each violation by a civil action in circuit court, and the penalty may be waived under section 8-43-6(c) if the company or contractor has made full restitution or paid actual damages to an injured consumer.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 3,000
Who enforces it
Enforcement body
Consumer Interest Division of the Office of the Attorney General, by civil action in circuit court to enjoin a violation or recover a civil penalty (section 8-43-6(b)); a consumer may report a violation to the Division (section 8-43-6(a)).
Settledness
- As of
- Open questions
- Does a company that returns results from raw DNA data a consumer uploads, without directly soliciting a biological sample, fall within "genetic testing company" in section 8-43-2(9)?
What this law does
A genetic testing company is any person, other than a health care provider, who directly solicits a biological sample from a consumer for analysis in order to provide products or services to the consumer. A consumer is any individual who is an Alabama resident. A genetic testing company must prominently display to a consumer, in plain language, complete information about its policies and procedures for the collection, use, maintenance and disclosure of genetic data.
A genetic testing company must obtain the consumer's initial express consent to use of the biological sample and resulting genetic data to provide the product or service the consumer ordered. A genetic testing company must obtain the consumer's express consent every time it transfers the sample or discloses the genetic data to a third party other than a contractor for a reason other than fulfilling an order, uses them for another purpose, or markets to the consumer based on the genetic data.
A genetic testing company must provide a process for the consumer to access the genetic data, delete the account, request destruction of the biological sample and genetic data, and revoke any consent given. A genetic testing company must comply with a destruction request as soon as reasonably possible and no more than 30 days after the request is made.
A genetic testing company may not disclose a consumer's genetic data to a health, life, disability or long-term care insurer, or to an employer or prospective employer of the consumer, without the consumer's express written consent.
Chapter 43 of Title 8 of the Code of Alabama does not apply to a covered entity or business associate as defined in the federal health privacy regulations, to noncommercial research and instruction by an institution of higher learning, or to samples and data lawfully obtained by law enforcement in a criminal investigation.
The Consumer Interest Division of the Office of the Attorney General may sue in circuit court to enjoin a violation or to recover a civil penalty of up to $3,000 for each violation. The Alabama Genetic Data Privacy Act took effect on .
When LexLint raises it
When your app profile says your app processes biometric data or trains models.