Law / United States / 
Rhode Island
Genetic Information Privacy Act
Officially Genetic Information Privacy Act: direct-to-consumer genetic testing companies
P.L. 2026, ch. 223 (Genetic Information Privacy Act), R.I. Gen. Laws secs. 6-63-1 to 6-63-7
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Security, Retention
- Audit expectation
- none
As of .
What it requires
- If you are a direct-to-consumer genetic testing company, give Rhode Island consumers a plain-language summary of your privacy practices and a prominent, easily accessible privacy notice covering your data collection, consent, use, access, disclosure, maintenance, transfer, security, retention and deletion practices and how to file a complaint alleging a violation of the chapter, plus a notice that deidentified genetic or phenotypic information may be shared with third parties for research (section 6-63-3(a)(1)).
- Obtain a consumer's express consent, in response to a clear, meaningful and prominent notice and never by inaction or through a dark pattern, before you collect, use or disclose their genetic data, and obtain separate and express consent for each use of the data collected through the product or service (including who has access to it, how it may be shared and the specific purposes), for storing the biological sample after the initial testing, for each use beyond the primary purpose and inherent contextual uses, for each transfer or disclosure to a third party other than a service provider (naming the third party), and for marketing, or facilitating marketing, based on the data (section 6-63-3(a)(2)).
- Give a consumer effective mechanisms, without unnecessary steps and at least one through your primary medium of communication, to revoke consent. Honor a revocation as soon as practicable and no later than 30 days after it, and destroy the biological sample within 30 days of receiving a revocation of consent to store it (section 6-63-3(a) and (b)).
- Implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure (section 6-63-3(c)(1)).
- Develop procedures and practices that let a consumer easily access their genetic data, delete their account and genetic data (except data you must retain to comply with legal and regulatory requirements) and have their biological sample destroyed (section 6-63-3(c)(2)).
- Do not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health insurance, life insurance, long-term care insurance, disability insurance or employment, or to an entity that advises one, unless section 6-63-3(e)(2) applies: the entity is not primarily engaged in those functions, receives the data in a different capacity, and bars any part of it that administers, advises on or decides those matters from accessing the data or sample.
- Do not discriminate against a consumer for exercising rights under the chapter, whether by denying goods, services or benefits, charging different prices or rates, providing a different level or quality, suggesting any of these, or treating the exercise of rights as a basis for suspicion of criminal wrongdoing or unlawful conduct. This duty binds a person or a public entity (section 6-63-3(d)).
- Contract with a service provider that collects, transports or analyzes a consumer's biological sample or genetic data for you so that it may not retain, use or disclose the sample, extracted genetic material, genetic data or any information about the consumer's identity for any purpose other than the contracted services, and may not associate or combine them with information it receives from or collects for others (section 6-63-2(10)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 6-63-4(a) and (b): a civil penalty of up to $1,000 plus court costs for a negligent violation, and of not less than $1,000 and not more than $10,000 plus court costs for a willful violation; each violation is a separate and actionable violation (section 6-63-4(f)). The willful ceiling is recorded as per_violation_amount.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Rhode Island Attorney General, who prosecutes actions for relief under the chapter exclusively (section 6-63-4(c)).
Settledness
- As of
- Open questions
- Does a company that analyzes genetic data only through a clinician-ordered test fall outside section 6-63-2(5)(ii), which excepts analysis performed by a person licensed in the healing arts for diagnosis or treatment of a medical condition?
What this law does
Public Law 2026, chapter 223 (H 7639), the Genetic Information Privacy Act, was enacted on . Chapter 63 of title 6 of the General Laws, added by section 2 of the act, may be cited as the Genetic Information Privacy Act. The Genetic Information Privacy Act took effect upon passage.
Section 6-63-2(5) of the Genetic Information Privacy Act defines a direct-to-consumer genetic testing company as an entity that sells, markets, interprets or otherwise offers consumer-initiated genetic testing products or services directly to consumers, analyzes genetic data obtained from a consumer, or collects, uses, maintains or discloses genetic data from such a product or service or provided directly by a consumer.
Section 6-63-3(a)(1) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to make available to a consumer a plain-language summary of its privacy practices, a prominent and easily accessible privacy notice, and a notice that the consumer's deidentified genetic or phenotypic information may be shared with third parties for research.
Section 6-63-3(a)(2) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to obtain a consumer's express consent for the collection, use and disclosure of genetic data, with separate and express consent for the use of the data collected, for storing the biological sample after the initial testing, for each use beyond the primary purpose, for each transfer to a third party other than a service provider, and for marketing based on the data.
Section 6-63-3(a) and (b) of the Genetic Information Privacy Act require a company to give a consumer effective mechanisms to revoke consent, at least one through the primary medium through which the company communicates with consumers, to honor a revocation as soon as practicable and not later than thirty days after it, and to destroy the consumer's biological sample within thirty days of receipt of a revocation of consent to store it.
Section 6-63-3(c) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to implement and maintain reasonable security procedures and practices, and to develop procedures that let a consumer access the genetic data, delete the account and genetic data, and have the biological sample destroyed.
Section 6-63-3(d) of the Genetic Information Privacy Act bars a person or public entity from discriminating against a consumer because the consumer exercised a right under the chapter, including by denying goods, services or benefits, charging different prices or rates, or treating the exercise of rights as a basis for suspicion of criminal wrongdoing.
Section 6-63-3(e)(1) of the Genetic Information Privacy Act bars a direct-to-consumer genetic testing company from disclosing a consumer's genetic data to an entity responsible for administering or making decisions about health insurance, life insurance, long-term care insurance, disability insurance or employment, or to an entity that advises such an entity, except as subsection (e)(2) provides.
Section 6-63-6(a)(1) of the Genetic Information Privacy Act excludes medical information governed by chapter 37.3 of title 5 and protected health information held by a covered entity or business associate under the federal health privacy rules. Section 6-63-4(a) and (b) of the Genetic Information Privacy Act assess a civil penalty of up to $1,000 plus court costs on a person who negligently violates the chapter and of $1,000 to $10,000 plus court costs on a person who willfully violates it.
Section 6-63-4(c) of the Genetic Information Privacy Act provides that actions for relief under the chapter are prosecuted exclusively in a court of competent jurisdiction by the attorney general. Section 6-63-4(f) of the Genetic Information Privacy Act makes each violation of the chapter a separate and actionable violation.
When LexLint raises it
When your app profile says your app processes biometric data or trains models.