Law / United States / 
Virginia
Genetic Data Privacy chapter, deidentified data
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- To treat genetic information as deidentified, take reasonable measures to ensure that it cannot be associated with a consumer or household (section 59.1-593, definition of deidentified data, clause (i)).
- Publicly commit to maintain and use the information only in deidentified form and not to attempt to reidentify it, except solely to test whether your deidentification processes satisfy the definition, and then neither use nor disclose any information reidentified in that test and destroy it when the assessment is complete (section 59.1-593, clause (ii)).
- Contractually obligate every recipient of the information to take reasonable measures to ensure that it cannot be associated with a consumer or household and to commit to using it only in deidentified form and not to reidentify it (section 59.1-593, clause (iii)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 59.1-593 states the conditions for treating data as deidentified. It states no log or record duty.
- Kind
- None
- As of
What this law does
Virginia's genetic data privacy chapter defines deidentified data as data that cannot be used to infer information about, or otherwise be linked to, a particular individual, and it treats data as deidentified only if the direct-to-consumer genetic testing company takes reasonable measures to ensure the information cannot be associated with a consumer or household, publicly commits to keep it in deidentified form and not to reidentify it, and contractually obligates any recipients to do the same.
A direct-to-consumer genetic testing company may attempt to reidentify the information solely to test whether its deidentification processes satisfy the definition, and must not use or disclose any information reidentified in that test and must destroy it when the assessment ends. Under Virginia's genetic data privacy chapter, deidentified data is not genetic data.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .