Law / United States / 
Oregon
Oregon genetic privacy statutes: consent, retention, destruction, access and disclosure limits for genetic information and DNA samples
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Data subject rights, Retention, Prohibition
- Audit expectation
- none
As of .
What it requires
- If you obtain genetic information from an individual or from an individual's DNA sample (by performing or getting the results of a genetic test), first obtain the informed consent of the individual or the individual's representative, unless an exception in ORS 192.535(1) applies (ORS 192.535(1)).
- Maintain the confidentiality of an individual's genetic information and DNA sample, and protect them from unauthorized disclosure or misuse, if you are authorized to obtain, retain or use them (ORS 192.537(1)).
- Do not retain another individual's genetic information or DNA sample without first obtaining authorization from the individual or the individual's representative, unless an exception in ORS 192.537(3) applies; subsections (3) to (8) of ORS 192.537 apply only to a DNA sample or genetic information that is coded, identified or identifiable (ORS 192.537(3), (10)).
- Destroy a DNA sample from which genetic information has been obtained promptly on the individual's specific request, subject to the exceptions in ORS 192.537(4), and destroy a research sample (other than for anonymous research) promptly on completion of the project or withdrawal of the individual (ORS 192.537(4), (5)).
- Use an individual's DNA sample or genetic information derived from a biological specimen or clinical health information for anonymous or coded research only if the individual consented to the specific project or to genetic research generally, or was notified under ORS 192.538 and did not object (ORS 192.537(2)).
- Let an individual or the individual's representative, promptly on request, inspect, request correction of and obtain genetic information from the individual's records (ORS 192.537(7)).
- Do not disclose, or comply with a subpoena to disclose, the identity of an individual on whom a genetic test was performed, or genetic information that permits identification of the individual or a blood relative, unless an exception in ORS 192.539(1) applies, including the individual's signed consent on the form the Oregon Health Authority prescribes; the bar applies to any redisclosure (ORS 192.539(1), (2)).
- If you are a health care provider that is a covered entity, notify an individual no later than when you obtain a biological specimen or clinical health information that it may be disclosed or retained for anonymous or coded research, and let the individual mark a request that it not be (ORS 192.538(1), (3), (4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
ORS 192.543: a person who knowingly, recklessly or with criminal negligence obtains, retains or discloses genetic information in violation of ORS 192.531 to 192.549 commits a Class A misdemeanor.
Statutory damages
ORS 192.541(2) and (3): the court awards the greater of actual damages or a stated sum that depends on the section violated. For a violation of ORS 192.537 or 192.547 the sums are $100 for an inadvertent violation that does not arise out of the defendant's negligence, $500 for a negligent violation, $10,000 for a knowing or reckless violation, $15,000 for a knowing violation based on a fraudulent misrepresentation and $25,000 for a knowing violation committed with intent to sell, transfer or use for commercial advantage, personal gain or malicious harm. For a violation of ORS 192.535 or 192.539 the sums are $1,000, $5,000, $100,000, $150,000 and $250,000 in the same order. The lowest sum in either ladder is $100, $500 and $10,000 for the first three tiers. It is an affirmative defense to the two lowest tiers that the defendant corrected the violation within 120 days after it knew or should have known of it (ORS 192.541(4)), and a plaintiff may recover damages for each violation by a defendant (ORS 192.541(8)).
- As of
- Currency
- USD
- Per person minimum
- 100
- Per person reckless
- 10,000
- Per person negligent
- 500
Who enforces it
Enforcement body
The Attorney General or a district attorney, who may bring an action against a person who violates ORS 192.535, 192.537, 192.539 or 192.547 and recover the costs of the investigation (ORS 192.545(1)).
What this law does
ORS 192.535 bars a person from obtaining genetic information from an individual, or from an individual's DNA sample, without first obtaining the informed consent of the individual or the individual's representative, unless an exception applies. Genetic information is information about an individual or the individual's blood relatives obtained from a genetic test. To obtain genetic information is to perform or get the results of a genetic test.
ORS 192.537 requires any person authorized by law or by an individual to obtain, retain or use an individual's genetic information or DNA sample to maintain its confidentiality and to protect it from unauthorized disclosure or misuse. ORS 192.537 bars a person from retaining another individual's genetic information or DNA sample without first obtaining authorization from the individual or the individual's representative, unless an exception applies.
ORS 192.537 requires the DNA sample of an individual from which genetic information has been obtained to be destroyed promptly on the specific request of the individual or the individual's representative, unless an exception applies. ORS 192.537 lets an individual or the individual's representative, promptly on request, inspect, request correction of and obtain genetic information from the records of the individual.
ORS 192.539 bars a person from disclosing, or being compelled by subpoena or any other means to disclose, the identity of an individual on whom a genetic test has been performed, or genetic information about the individual in a manner that permits identification, unless an exception applies.
A health care provider that is a covered entity and obtains an individual's biological specimen or clinical individually identifiable health information must notify the individual that it may be disclosed or retained by the provider for anonymous research or coded research. The history note of ORS 192.531 lists former ORS 659.700, section 1 of chapter 333, Oregon Laws 2003, section 1 of chapter 678, Oregon Laws 2005, and section 6 of chapter 800, Oregon Laws 2007.
ORS 192.531 defines the genetic privacy statutes as ORS 192.531 to 192.549, 659A.303 and 746.135 and the provisions of ORS 659A.300 relating to genetic testing. An individual or the individual's blood relative, representative or estate may bring a civil action against any person who violates ORS 192.535, 192.537, 192.539 or 192.547.
For a violation of ORS 192.535 or 192.539 the court awards the greater of actual damages or an amount from $1,000 for an inadvertent violation to $250,000 for a knowing violation committed with intent to sell, transfer or use for commercial advantage, personal gain or malicious harm.
For a violation of ORS 192.537 or 192.547 the court awards the greater of actual damages or an amount from $100 for an inadvertent violation to $25,000 for a knowing violation committed with intent to sell, transfer or use for commercial advantage, personal gain or malicious harm. Unlawfully obtaining, retaining or disclosing genetic information in violation of ORS 192.531 to 192.549 is a Class A misdemeanor.
The Attorney General or a district attorney may bring an action against a person who violates ORS 192.535, 192.537, 192.539 or 192.547, and the court awards the costs of the investigation.
When LexLint raises it
When your app profile says your app crawls the web, deploys a chatbot, processes biometric data or trains models.