Law / United States / 
Maryland
Maryland Genetic Information Privacy Act
Officially Maryland Genetic Information Privacy Act: direct-to-consumer genetic testing companies
Md. Code Ann., Com. Law §§ 14-4401 to 14-4408 (Title 14, Subtitle 44)
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Disclosure, Consent, Security, Data subject rights
As of .
What it requires
- If you are a direct-to-consumer genetic testing company, give each consumer a high-level overview of your privacy policy and a privacy notice covering your data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices, made publicly available and placed in a prominent area of your website (Com. Law 14-4403).
- Obtain the consumer's initial express consent, before you collect, use or disclose genetic data, that clearly describes the uses of the data collected and specifies who has access to the results and how the data may be shared (Com. Law 14-4404(1)).
- Obtain separate express consent before you transfer or disclose genetic data to anyone other than your vendors and service providers, before you use it beyond the primary purpose of the product or service the consumer requested, before you keep a biological sample after the initial testing is completed, and before you market to the consumer based on the data or let a third party market based on the consumer's order or purchase (Com. Law 14-4404(2)-(5)).
- Obtain informed consent that complies with the federal policy for the protection of human research subjects before you transfer or disclose genetic data to third parties for research, or for research under your control conducted to publish or produce generalizable knowledge (Com. Law 14-4404(6)).
- Establish legal policies and processes for disclosing genetic data to law enforcement or another government agency without the consumer's express written consent (Com. Law 14-4405(a)).
- Develop, implement and maintain a comprehensive security program to protect consumers' genetic data against unauthorized access, use or disclosure (Com. Law 14-4405(b)).
- Establish a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request destruction of the consumer's biological sample (Com. Law 14-4405(c)).
- Do not, without the consumer's written consent, disclose a consumer's genetic data to an entity offering health insurance, life insurance, disability insurance or long-term care insurance, or to an employer of the consumer (Com. Law 14-4405(d)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 13-411 of the Commercial Law Article makes a violation of any provision of Title 13 a misdemeanor punishable by a fine not exceeding $1,000 or imprisonment not exceeding one year or both, unless another criminal penalty is specifically provided elsewhere, in addition to civil penalties.
Penalty structure
Section 13-410 subjects a merchant who violates Title 13 to a fine not exceeding $10,000 for each violation and, after a finding of a violation, to a fine not exceeding $25,000 for each subsequent repeat of the same violation. The fines are civil penalties recoverable by the State in a civil action or an administrative cease and desist action.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Maryland Attorney General, Consumer Protection Division, under the enforcement and penalty provisions of Title 13 of the Commercial Law Article; an individual who sustains injury or loss may sue under section 13-408.
Settledness
- As of
- Open questions
- Does a company that analyzes genetic data a consumer uploads from a test taken with another company fall within the definition of a direct-to-consumer genetic testing company in section 14-4401(d)(2), which reaches genetic data that resulted from a direct-to-consumer product 'provided to the company by a consumer'?
What this law does
Binds a direct-to-consumer genetic testing company, meaning an entity that offers genetic testing products or services directly to a consumer, or that collects, uses or analyzes genetic data that resulted from a direct-to-consumer genetic testing product or service provided to the company by a consumer.
A direct-to-consumer genetic testing company must provide a high-level overview of its privacy policy and a privacy notice covering its data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices, made publicly available and placed in a prominent area of its website.
A direct-to-consumer genetic testing company must obtain a consumer's express consent before collecting, using or disclosing genetic data, with separate express consent for transfer to anyone other than its vendors and service providers, for use beyond the primary purpose of the product or service, for keeping a biological sample after the initial testing, and for marketing.
A direct-to-consumer genetic testing company must also obtain informed consent that complies with the federal policy for the protection of human research subjects before transferring or disclosing genetic data to third parties for research.
A direct-to-consumer genetic testing company must establish legal policies and processes for disclosing genetic data to law enforcement or another government agency without a consumer's express written consent, and must develop, implement and maintain a comprehensive security program to protect consumers' genetic data against unauthorized access, use or disclosure.
A direct-to-consumer genetic testing company must establish a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request destruction of the consumer's biological sample. Without the consumer's written consent, a direct-to-consumer genetic testing company may not disclose a consumer's genetic data to an entity offering health, life, disability or long-term care insurance, or to an employer of the consumer.
Subtitle 44 of Title 14 does not apply to protected health information collected by a covered entity or business associate, or to genetic data or biological samples collected for research conducted under the federal human-subjects policy, the Good Clinical Practice Guidelines of the International Council for Harmonisation, or the human-subject rules of the Food and Drug Administration.
Title 13 of the Commercial Law Article lists a violation of Title 14, Subtitle 44 among its unfair, abusive or deceptive trade practices. Section 14-4406 makes a violation of that section an unfair, abusive or deceptive trade practice subject to the enforcement and penalty provisions of Title 13, and leaves an individual free to pursue any other remedy provided by law. The Maryland Genetic Information Privacy Act took effect on .
When LexLint raises it
When your app profile says your app processes biometric data or trains models.