Law / United States / 
Connecticut
Direct-to-consumer genetic testing companies: consumer property right, consent, disclosure limits and security
Public Act 26-64, sections 17 to 19
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Security, Retention, Prohibition
As of .
What it requires
- If you are a direct-to-consumer genetic testing company, at all times conduct your business consistently with the consumer's property right in, and exclusive control over, the biological sample and the genetic test results, including their collection, use, retention, maintenance, disclosure and destruction (sections 18 and 19(a)(1)).
- Before accepting any biological sample, genetic data or payment from a consumer, disclose your policies and procedures on the collection, use and disclosure of genetic data, and display a privacy notice in a prominent and publicly accessible place on your website covering collection, use, access, disclosure, transfer, security, retention and deletion of the consumer's data and the consumer's consent (section 19(a)(2) and (3)).
- Before collecting, using or disclosing a consumer's genetic data, obtain the consumer's express consent after disclosing your policies on use of the data, the identity of each person who may access the test results, including any vendor or service provider, and the manner in which you may disclose the data (section 19(a)(4)).
- Separately obtain the consumer's express consent before disclosing or transferring genetic data to any person other than your vendor or service provider, before using it for any purpose other than the primary purpose for which you offered testing, and before retaining the biological sample after the testing is complete (section 19(a)(5)).
- Obtain informed consent under 45 CFR 46 before disclosing or transferring genetic data to a third party for research, or for research you control that is for publication or generalizable knowledge (section 19(a)(6)).
- Do not disclose the results of genetic testing to anyone other than the consumer unless the consumer has expressly consented or the disclosure is to a person acting under a court order, warrant or subpoena (section 19(a)(7)).
- Do not disclose a consumer's genetic data to the consumer's employer, to a person who offers health, life or long-term care insurance coverage or who gives an insurer, health care center or fraternal benefit society data for underwriting or rating, or to a third party you know or reasonably should know intends to use it for marketing, including targeted advertising (section 19(a)(8)).
- Implement reasonable security measures to protect a consumer's biological sample and genetic data from unauthorized access, destruction, use, modification or disclosure (section 19(a)(9)).
- Implement a process for a consumer to access the consumer's genetic data, require you to delete it, require you to destroy the biological sample and confirm that you have, and revoke consent for use of the data for research by you or by any third party you gave it to (section 19(a)(10)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 19(b) makes a violation an unfair or deceptive trade practice under section 42-110b(a), enforced solely by the Attorney General. In an action under section 42-110m the Attorney General may recover a civil penalty of not more than $5,000 for each wilful violation of section 42-110b (section 42-110o(b)).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Connecticut Attorney General, who alone enforces section 19(a) as an unfair or deceptive trade practice under section 42-110b(a) and may seek a civil penalty under section 42-110o(b).
Settledness
- As of
- Open questions
- Does a company that analyzes only raw genetic data a consumer uploads, with no test of its own, fall within clause (ii) of the definition, which reaches a person who collects, uses or analyzes genetic data a consumer has provided?
What this law does
Under Public Act 26-64, a direct-to-consumer genetic testing company is any person doing business in Connecticut who in the ordinary course of business offers genetic testing directly to a consumer, or collects, uses or analyzes genetic data a consumer has provided to that person. Under Public Act 26-64, the definition does not include an individual who is licensed by the state to provide health care services and, within the scope of that practice, orders genetic testing for a medical purpose.
Under Public Act 26-64, a consumer has a property right in, and keeps the right to exercise exclusive control over, any biological sample provided to or used by such a company and the results of genetic testing it conducts on the consumer's DNA.
Under Public Act 26-64, before collecting, using or disclosing a consumer's genetic data, the company must obtain the consumer's express consent after disclosing its policies on use of the data, the identity of each person who may access the results, and the manner in which it may disclose the data.
Under Public Act 26-64, the company must separately obtain express consent before transferring genetic data to anyone other than its vendor or service provider, before using it for another purpose, and before retaining the biological sample after testing.
Under Public Act 26-64, the company must obtain informed consent under the federal policy for the protection of human subjects, 45 CFR 46, before disclosing or transferring a consumer's genetic data to a third party for research, or for research it controls for publication or generalizable knowledge.
Under Public Act 26-64, the company may not disclose a consumer's genetic data to the consumer's employer, to a person who offers health, life or long-term care insurance coverage, or to a third party it knows or should know intends to use the data for marketing. Under Public Act 26-64, the company must implement reasonable security measures to protect a consumer's biological sample or genetic data from unauthorized access, destruction, use, modification or disclosure.
Under Public Act 26-64, a violation is an unfair or deceptive trade practice under section 42-110b(a) of the Connecticut General Statutes and is enforced solely by the Attorney General. Under Public Act 26-64, in an action under section 42-110m the Attorney General may recover a civil penalty of not more than $5,000 for each wilful violation of section 42-110b. Sections 17 to 19 take effect on .
When LexLint raises it
When your app profile says your app processes biometric data or trains models.