Law / United States / 
Minnesota
Genetic Information Privacy Act: direct-to-consumer genetic testing companies
In force.
A sensitive categories rule binding private bodies.
- Enforcement body
- The commissioner of commerce, under section 45.027.
- Obligation class
- Consent, Disclosure, Security, Data subject rights, Retention
As of .
What it requires
- If you are a direct-to-consumer genetic testing company, make available in plain language a high-level privacy policy overview, a prominent public privacy notice covering your collection, consent, use, access, disclosure, maintenance, transfer, security, retention and deletion practices for genetic data, and information on how to file a complaint under section 45.027.
- Obtain a consumer's express consent to collect, use and disclose genetic data: initial consent describing the uses and who has access, separate consent naming the recipient for each transfer to a person other than your vendors and service providers, separate consent for each use beyond the primary purpose, separate consent to retain a biological sample after testing, informed consent under the federal human-subjects rules to transfer data for research, and express consent for marketing based on genetic data.
- Do not disclose genetic data to law enforcement or any other governmental agency without the consumer's express written consent unless the disclosure is made under a valid search warrant or court order.
- Do not disclose a consumer's genetic data without the consumer's written consent, clearly identifying the recipient, to any entity offering health insurance, life insurance, disability insurance or long-term care insurance, or to the consumer's employer.
- Develop, implement and maintain a comprehensive security program and measures to protect a consumer's genetic data against unauthorized access, use or disclosure.
- Provide a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request and obtain destruction of the consumer's biological sample.
- Provide effective mechanisms for a consumer to revoke any consent, honor a revocation as soon as practicable and not later than 30 days after it, and destroy a biological sample within 30 days of receipt of revocation of consent to store it.
- Give a consumer clear and complete notice that deidentified data may be shared with or disclosed to third parties for research purposes.
- Bind each service provider by contract not to retain, use or disclose a biological sample, extracted genetic material, genetic data or identity information for any purpose other than the contracted services, and not to associate or combine it with information from another source.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 45.027, subdivision 6 lets the commissioner impose a civil penalty not to exceed $10,000 per violation; section 325F.995, subdivision 4 lets the commissioner of commerce enforce the section under section 45.027.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
What this law does
Section 325F.995 is titled the Genetic Information Privacy Act. A direct-to-consumer genetic testing company is an entity that offers consumer genetic testing products or services directly to consumers, or that collects, uses or analyzes genetic data collected through such a product or service and provided to it by a consumer.
The section does not apply to protected health information collected by a covered entity or business associate, to a public or private institution of higher education, or to an entity owned or operated by one. A company must obtain a consumer's express consent to collect, use and disclose the consumer's genetic data, including separate express consent naming the recipient for each transfer to a person other than its vendors and service providers.
A company may not disclose genetic data to law enforcement or any other governmental agency without the consumer's express written consent unless the disclosure is made under a valid search warrant or court order. A company may not disclose a consumer's genetic data without the consumer's written consent to an entity offering health insurance, life insurance, disability insurance or long-term care insurance, or to the consumer's employer.
A company must develop, implement and maintain a comprehensive security program and measures to protect a consumer's genetic data against unauthorized access, use or disclosure. A company must provide a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request and obtain destruction of the consumer's biological sample.
A company must honor a consumer's revocation of consent as soon as practicable, but not later than 30 days after the consumer revokes it, and must destroy a biological sample within 30 days of receipt of revocation of consent to store the sample.
A contract between a company and a service provider must prohibit the service provider from retaining, using or disclosing any biological sample, extracted genetic material, genetic data or consumer identity information for any purpose other than the specific services in the contract. The commissioner of commerce may enforce the section under section 45.027.
Section 45.027, subdivision 6 lets the commissioner impose a civil penalty not to exceed $10,000 per violation upon a person who violates any law, rule or order related to the commissioner's duties unless a different penalty is specified.
When LexLint raises it
When your app profile says your app processes biometric data or trains models.