Law / United States / 
Kentucky
Genetic Information Privacy Act: direct-to-consumer genetic testing companies
Genetic Information Privacy Act, 2022 Ky. Acts ch. 169, sec. 1
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Security, Retention
As of .
What it requires
- If you are a direct-to-consumer genetic testing company, make available to a Kentucky consumer a high-level privacy policy overview and a prominent, publicly available privacy notice that covers at least your data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices (KRS 311.705(2)(a)).
- Obtain a consumer's initial express consent that clearly describes the uses of the genetic data collected through the product or service and says who has access to the results and how the data may be shared (KRS 311.705(2)(b)1.).
- Obtain separate express consent before transferring or disclosing a consumer's genetic data to any person other than your vendors and service providers, or using it beyond the primary purpose of the testing and inherent contextual uses (KRS 311.705(2)(b)2.).
- Obtain separate express consent before retaining any biological sample after the initial testing service the consumer requested (KRS 311.705(2)(b)3.).
- Obtain informed consent in compliance with the Federal Policy for the Protection of Human Subjects before transferring or disclosing a consumer's genetic data to third parties for research, or using it in research under your control for publication or generalizable knowledge (KRS 311.705(2)(b)4.).
- Obtain express consent before marketing to a consumer based on the consumer's genetic data, or before a third party markets to a consumer because the consumer ordered or bought a genetic testing product or service. Customized content on your own websites, applications or services is not marketing (KRS 311.705(2)(b)5.).
- Require valid legal process before disclosing a consumer's genetic data to law enforcement or any other government agency, unless the consumer gives express written consent (KRS 311.705(2)(c)).
- Develop, implement and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use or disclosure (KRS 311.705(2)(d)).
- Let a consumer access their genetic data, delete their account and genetic data, and request and obtain destruction of their biological sample (KRS 311.705(2)(e)).
- Do not disclose a consumer's genetic data to an entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's written consent (KRS 311.705(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
KRS 311.705(4): in an action brought by the Attorney General, a violation is subject to a civil penalty of $2,500 for each violation, plus the recovery of actual damages incurred by the consumers on whose behalf the action was brought and the costs and expenses of the Attorney General.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 2,500
Who enforces it
Enforcement body
Kentucky Attorney General, who may bring an action in the name of the Commonwealth, or as parens patriae on behalf of consumers, to enforce the section (KRS 311.705(4)).
What this law does
Binds a direct-to-consumer genetic testing company, an entity that offers genetic testing products or services directly to a consumer, or that collects, uses or analyzes genetic data that resulted from such a product or service and was provided to the company by a consumer. A company must make a high-level privacy policy overview and a prominent, publicly available privacy notice available to a consumer.
A company must obtain initial express consent to the collection, use or disclosure of a consumer's genetic data, separate express consent for transferring or disclosing it to any person other than the company's vendors and service providers or for using it beyond the primary purpose of the testing, separate express consent for retaining a biological sample after the initial testing, informed consent under the Federal Policy for the Protection of Human Subjects for disclosure to third parties for research, and express consent for marketing based on the data.
A company must require valid legal process before disclosing genetic data to law enforcement or another government agency without the consumer's express written consent, and must develop, implement and maintain a comprehensive security program to protect the data. A company may not disclose a consumer's genetic data to an entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's written consent.
The Attorney General may bring an action in the name of the Commonwealth, or as parens patriae on behalf of consumers, and a violation is subject to a civil penalty of $2,500 for each violation, the recovery of actual damages incurred by the consumers, and the costs and expenses of the Attorney General. The section does not apply to protected health information collected by a covered entity or business associate governed by the federal health privacy rules.
An entity is not a direct-to-consumer genetic testing company only when it is engaged in collecting, using or analyzing genetic data or biological samples in the context of the research the definition names. The section took effect on .
When LexLint raises it
When your app profile says your app processes biometric data or trains models.