Law / United States / 
Nebraska
Genetic Information Privacy Act: direct-to-consumer genetic testing companies
Genetic Information Privacy Act, Neb. Rev. Stat. §§ 87-901 to 87-904
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Security
- Audit expectation
- none
As of .
What it requires
- If you are a direct-to-consumer genetic testing company, make available to a Nebraska consumer a high-level privacy policy overview and a prominent, publicly available privacy notice that covers at least your data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices (Neb. Rev. Stat. 87-903(1)(a)).
- Obtain a consumer's initial express consent that clearly states the uses for which the genetic data collected through the product or service is intended, names the parties who have access to test results, and states the means by which the data may be shared (87-903(1)(b)(i)).
- Obtain separate express consent before transferring or disclosing a consumer's genetic data to any person other than your vendors and service providers, or before using it for purposes not stated in the initial consent and inherent contextual uses (87-903(1)(b)(ii)).
- Obtain separate express consent before retaining any biological sample provided by the consumer after the initial testing service the consumer requested (87-903(1)(b)(iii)).
- Obtain informed consent under the Federal Policy for the Protection of Human Research Subjects, 45 C.F.R. part 46, before transferring or disclosing a consumer's genetic data to third parties for research, or before research under your control for publication or generalizable knowledge (87-903(1)(b)(iv)).
- Obtain express consent before marketing to a consumer based on the consumer's genetic data, or before a third party markets to the consumer based on the consumer's order or purchase of a genetic testing product or service. Customized content on your own websites, applications or services is not marketing (87-903(1)(b)(v)).
- Require a court order before disclosing genetic data to any government agency, including law enforcement, unless the consumer gives express written consent (87-903(1)(c)).
- Develop, implement and maintain a comprehensive security program to protect a consumer's genetic data from unauthorized access, use or disclosure (87-903(1)(d)).
- Provide a process for a consumer to access the consumer's genetic data, to delete the consumer's account and genetic data, and to request and obtain written documentation verifying destruction of the consumer's biological sample (87-903(1)(e)).
- Do not disclose a consumer's genetic data to an entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's written consent (87-903(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Neb. Rev. Stat. 87-903(3): a violation of the Act is subject to a civil penalty of $2,500 for each violation, in addition to actual damages incurred by the consumer and the costs and reasonable attorney's fees incurred by the Attorney General.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 2,500
Who enforces it
Enforcement body
Nebraska Attorney General, who may bring an action to enforce the Act (Neb. Rev. Stat. 87-903(3)).
What this law does
A direct-to-consumer genetic testing company must make available to a consumer a high-level privacy policy overview and a prominent, publicly available privacy notice.
A company must obtain a consumer's initial express consent to the uses of the genetic data, separate express consent for transferring or disclosing it to any person other than the company's vendors and service providers or for using it for other purposes, separate express consent for retaining a biological sample after the initial testing, informed consent under the Federal Policy for the Protection of Human Research Subjects for disclosure to third parties for research, and express consent for marketing based on the data.
A company must require a court order before disclosing genetic data to any government agency, including law enforcement, without the consumer's express written consent. A company must develop, implement and maintain a comprehensive security program to protect a consumer's genetic data and must provide a process for the consumer to access the data, delete the account and data, and obtain written documentation verifying destruction of the biological sample.
A company may not disclose a consumer's genetic data to an entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's written consent. The Attorney General may bring an action to enforce the Act, and a violation is subject to a civil penalty of $2,500 for each violation, in addition to actual damages incurred by the consumer and the costs and reasonable attorney's fees of the Attorney General.
When LexLint raises it
When your app profile says your app processes biometric data or trains models.