Law / United States / 
Tennessee
Genetic Information Privacy Act: direct-to-consumer genetic testing companies
Tenn. Code Ann. secs. 47-18-4901 to 47-18-4906
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Security
- Audit expectation
- none
As of .
What it requires
- If you are a direct-to-consumer genetic testing company, give a Tennessee consumer essential information about your collection, use, and disclosure of genetic data and a prominent, publicly available privacy notice covering your data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices (section 47-18-4904(a)(1)).
- Obtain a consumer's initial express consent for collection, use, or disclosure of the consumer's genetic data, clearly describing your use of the data you collect through your genetic testing product or service, who has access to test results, and how you may share the data (section 47-18-4904(a)(2)).
- If you transfer or disclose genetic data to a person other than your vendors and service providers, use it beyond the primary purpose of your product or service, or keep a biological sample after the initial testing, obtain the consumer's separate express consent for each; obtain informed consent under the federal human-subjects rules, 45 CFR Part 46, before transferring or disclosing genetic data to a third party for research, or for your own research for publication or generalizable knowledge; and obtain express consent before marketing to a consumer based on the consumer's genetic data, or before a third party markets to a consumer based on the consumer having ordered or purchased a genetic testing product or service (section 47-18-4904(a)(3)).
- Require valid legal process before you disclose a consumer's genetic data to law enforcement or a government entity without the consumer's express written consent (section 47-18-4904(a)(4)).
- Develop, implement, and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use, or disclosure (section 47-18-4904(a)(5)).
- Provide a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and destroy the consumer's biological sample (section 47-18-4904(a)(6)).
- Do not disclose a consumer's genetic data to an entity that offers health insurance, life insurance, or long-term care insurance, or to an employer of the consumer, without first obtaining the consumer's written consent (section 47-18-4905).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Division of consumer affairs in the office of the attorney general and reporter, which enforces the part, establishes a complaint process, and promulgates rules (section 47-18-4906).
Settledness
- As of
What this law does
House Bill 1310, assigned Public Chapter Number 324 by the Secretary of State, enacts the Genetic Information Privacy Act and amends title 47 of the Tennessee Code.
Section 47-18-4902(4) of the Genetic Information Privacy Act defines a direct-to-consumer genetic testing company as an entity that offers consumer genetic testing products or services directly to a consumer, or collects, uses, or analyzes genetic data that resulted from a direct-to-consumer genetic testing product or service and was provided to the company by a consumer, and excludes a law enforcement agency and an entity engaged in research conducted in accordance with the federal human-subjects rules.
Section 47-18-4903 of the Genetic Information Privacy Act provides that the part does not apply to protected health information collected by a covered entity or business associate, a public or private institution of higher education, an entity owned or operated by one, biomedical or academic research conducted by a research hospital, academic medical center or affiliated entity that is not a direct-to-consumer genetic testing company, genetic data shared with or by such an entity for biomedical or academic research or to find causes of or cures for a disease or medical condition, or the sharing of genetic data that does not require consent under the federal human-subjects rules.
Section 47-18-4904(a)(1) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to provide a consumer essential information about its collection, use, and disclosure of genetic data and a prominent, publicly available privacy notice covering its data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices.
Section 47-18-4904(a)(2) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to obtain a consumer's initial express consent for collection, use, or disclosure of genetic data that clearly describes the company's use of the data, specifies who has access to test results, and specifies how the company may share the data.
Section 47-18-4904(a)(3) of the Genetic Information Privacy Act requires a company that engages in the listed conduct to obtain a consumer's separate express consent for transfer of genetic data to a person other than its vendors and service providers, for use beyond the primary purpose and for retention of a biological sample after the initial testing, informed consent under the federal human-subjects rules for transfer to a third party for research, and express consent for marketing based on the genetic data.
Section 47-18-4904(a)(4) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to require valid legal process for its disclosure of a consumer's genetic data to law enforcement or a government entity without the consumer's express written consent.
Section 47-18-4904(a)(5) and (6) of the Genetic Information Privacy Act require a direct-to-consumer genetic testing company to develop, implement, and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use, or disclosure, and to provide a process for a consumer to access the genetic data, delete the account and genetic data, and destroy the biological sample.
Section 47-18-4904(b) of the Genetic Information Privacy Act allows a company with a first-party relationship to a consumer to provide customized content or offers on its website or through its application or service without the consumer's express consent to marketing.
Section 47-18-4905 of the Genetic Information Privacy Act bars a direct-to-consumer genetic testing company from disclosing a consumer's genetic data to an entity that offers health insurance, life insurance, or long-term care insurance, or to an employer of the consumer, without first obtaining the consumer's written consent.
Section 47-18-4906 of the Genetic Information Privacy Act makes the division of consumer affairs in the office of the attorney general and reporter responsible for enforcing the part, requires the division to establish a means for a consumer to submit a complaint, and requires it to promulgate rules. Section 2 of the act that enacted the Genetic Information Privacy Act provides that the Act takes effect , and applies to conduct occurring on or after that date.
Public Chapter 324 was signed by the Governor on . The House adopted Amendment 1 (HA0269) on . The Senate withdrew Senate Amendment 1 (SA0282) on , substituted the House bill for its companion Senate bill, and passed it on . Amendment 1 to HB1310 in House Commerce deletes all language after the enacting clause and substitutes the Genetic Information Privacy Act.
When LexLint raises it
When your app profile says your app processes biometric data or trains models.