Law / United States / 
Arizona
Genetic Information Privacy Act: direct-to-consumer genetic testing companies
Genetic Information Privacy Act, sections 44-8001 to 44-8004
In force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Arizona Attorney General, who may bring an action to enforce the chapter.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Disclosure, Consent, Security, Data subject rights, Prohibition
- Audit expectation
- none
What it requires
- If you are a direct-to-consumer genetic testing company, make available to a consumer both a high-level privacy policy overview and a prominent, publicly available privacy notice covering your data collection, consent, use, access, disclosure, transfer, security, retention and deletion practices (section 44-8002(A)(1)).
- Obtain a consumer's initial express consent that clearly describes the uses of the genetic data collected and specifies who has access to test results and how the data may be shared, and separate express consent to transfer or disclose the data to anyone other than your vendors and service providers, to use it beyond the primary purpose of the product or service and inherent contextual uses, and to retain a biological sample after the initial testing (section 44-8002(A)(2)(a) and (b)).
- Obtain informed consent in compliance with 45 CFR part 46 before transferring or disclosing a consumer's genetic data to third-party persons for research, or for research under your control for the purpose of publication or generalizable knowledge (section 44-8002(A)(2)(c)).
- Obtain a consumer's express consent for marketing to the consumer based on the consumer's genetic data, and for marketing by a third-party person based on the consumer having ordered or purchased a genetic testing product or service; customized content or offers within your own websites, applications or services are not marketing for this purpose (section 44-8002(A)(2)(d)).
- Require a valid legal process before disclosing genetic data to law enforcement or any other government agency, unless the consumer gives express written consent (section 44-8002(A)(3)).
- Develop, implement and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use or disclosure (section 44-8002(A)(4)).
- Provide a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request and obtain the destruction of the consumer's biological sample (section 44-8002(A)(5)).
- Disclose genetic data only in accordance with section 12-2802, and never disclose a consumer's genetic data to any entity offering health insurance, life insurance or long-term care insurance or to any employer of the consumer (section 44-8002(A)(6) and (B)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Penalty structure
Section 44-8004: a civil penalty of up to $2,500 for each violation, the payment of actual damages incurred by consumers, and the costs and reasonable attorney fees incurred by the office of the attorney general.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 2,500
What it makes you log
Logging duty
The chapter states duties of notice, consent, legal process, security and consumer access and deletion, and states no duty to keep, show or file a record of them.
- Kind
- None
- As of
What this law does
Binds a direct-to-consumer genetic testing company, an entity that offers genetic testing products or services directly to consumers that involve collecting from a consumer of either genetic data or biological samples and from which the company derives genetic data for analysis.
A company must make available a high-level privacy policy overview and a prominent, publicly available privacy notice covering its collection, consent, use, access, disclosure, transfer, security, retention and deletion practices.
A company must obtain a consumer's initial express consent describing the uses of the genetic data and who has access to test results, and separate express consent to transfer or disclose the data beyond its vendors and service providers, to use it beyond the primary purpose, and to retain a biological sample after the initial testing.
A company must obtain informed consent under the federal policy for the protection of human research subjects, 45 CFR part 46, before transferring or disclosing genetic data to third-party persons for research or for research under its own control for publication or generalizable knowledge.
A company must obtain express consent for marketing to a consumer based on the consumer's genetic data, and for marketing by a third-party person to a consumer based on the consumer having ordered or purchased a genetic testing product or service. A company must require a valid legal process before disclosing genetic data to law enforcement or any other government agency without a consumer's express written consent.
A company must develop, implement and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use or disclosure. A company may not disclose a consumer's genetic data to any entity offering health insurance, life insurance or long-term care insurance or to any employer of the consumer.
The chapter does not apply to protected health information collected by a covered entity or business associate governed by the federal health privacy, security and breach notification rules, to biological samples or genetic data generated for an individual's medical screening, treatment or diagnosis, or to an institution of higher education or an entity it owns or operates, among its exceptions.
The Attorney General may bring an action to enforce the chapter, and a person who violates it is subject to a civil penalty of up to $2,500 for each violation, actual damages incurred by consumers, and the Attorney General's costs and reasonable attorney fees. House Bill 2069, chapter 254 of the Laws of 2021, added the chapter and was approved by the Governor on . The general effective date for acts of the 2021 First Regular Session is .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .