Law / United States / 
Virginia
Genetic Data Privacy
Officially Genetic Data Privacy: direct-to-consumer genetic testing companies
Va. Code Ann. §§ 59.1-593 to 59.1-602
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Security, Retention
As of .
What it requires
- If you are a direct-to-consumer genetic testing company, give Virginia consumers, in plain language with any genetic testing product and on your website, a summary of your policies and procedures on the collection, use, maintenance, retention, disclosure, transfer, deletion and security of genetic data and on access to it, a summary of your privacy practices, information on the express-consent requirement and the process for revoking consent, notice that deidentified genetic or phenotypic data may be shared with third parties for research, and the process for filing a complaint alleging a violation (section 59.1-595).
- Obtain a consumer's express consent for the collection, use and disclosure of genetic data, never inferred from inaction, with separate and express consent for the use of the data collected (including who receives access, how it is shared and the purposes), for storing the biological sample after the initial testing, for each use of the data or sample beyond the primary purpose and inherent contextual uses, for each transfer or disclosure to a third party other than a service provider (naming the third party), and for any marketing or facilitation of marketing based on the data, except marketing on your own website or mobile application that meets the three conditions of section 59.1-596(B)(5).
- Give a consumer a mechanism to revoke express consent, including through the primary medium through which you communicate with consumers, honor a revocation as soon as practicable and in all cases within 30 days of receipt, and destroy the consumer's biological sample within 30 days of receiving revocation of consent to store it (section 59.1-596(C) and (D)).
- Implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure (section 59.1-597).
- Develop procedures and practices that let a consumer easily access the consumer's genetic data, delete it (except data that state or federal law requires you to retain, and any account the consumer created), and revoke express consent to storage of the biological sample and request its destruction (section 59.1-597).
- Bind every service provider that handles a consumer's biological sample, extracted genetic material, genetic data or identity information by contract not to retain, use or disclose them for any purpose other than the specific services in the contract, and not to associate or combine them with information the provider receives from or on behalf of another person or collects from its own interaction with consumers (section 59.1-598).
- Do not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health insurance, life insurance, long-term care insurance, disability insurance or employment, or to an entity that advises such an entity, without the consumer's express consent (section 59.1-599).
- Do not discriminate against a consumer for exercising rights under the chapter, whether by denying or changing goods, services or benefits, charging a different price or rate, providing a different level or quality, suggesting any of these, or treating the exercise of rights as a basis or suspicion of criminal wrongdoing or unlawful conduct. This duty binds a person or a public entity (section 59.1-600).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 59.1-601(D): a civil penalty not to exceed $1,000 plus reasonable attorney fees, expenses and court costs for a violation, and not less than $1,000 and not more than $10,000 plus the same fees, expenses and costs for a willful violation; the penalties are paid into the Literary Fund. Each violation is a separate violation (section 59.1-601(E)). The willful ceiling is recorded as per_violation_amount.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Virginia Attorney General, who has exclusive authority to enforce the chapter, may issue a civil investigative demand on reasonable cause, and may bring an action in circuit court in the name of the Commonwealth to enjoin a violation without proving damages.
Settledness
- As of
- Open questions
- Does an entity that analyzes only raw genetic data a consumer uploads, with no testing product of its own, fall within clause (ii) of the definition of a direct-to-consumer genetic testing company, which reaches genetic data "collected or derived from a direct-to-consumer genetic testing product or service" that is "directly provided by a consumer"?
What this law does
Binds a direct-to-consumer genetic testing company, an entity that offers consumer-initiated genetic testing products or services directly to a consumer or collects, uses or analyzes genetic data collected or derived from such a product or service and directly provided by a consumer.
The chapter does not apply to protected health information collected, maintained, used or disclosed by a covered entity or business associate governed by the federal Health Insurance Portability and Accountability Act (HIPAA) privacy, security and breach notification rules.
A company must obtain a consumer's express consent for the collection, use and disclosure of genetic data, with separate express consent for the use of the data collected, for storing the biological sample after the initial testing, for each use beyond the primary purpose, for each transfer to a third party other than a service provider, and for marketing.
On revocation of consent a company must honor the revocation within 30 days of receipt and destroy the consumer's biological sample within 30 days of receipt of revocation of consent to store it. A company must keep reasonable security procedures and practices and procedures that let a consumer access and delete the consumer's genetic data and request destruction of the biological sample.
A company may not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health, life, long-term care or disability insurance or employment without the consumer's express consent. Only the Attorney General may enforce the chapter. A violation carries a civil penalty of up to $1,000, and a willful violation a civil penalty of $1,000 to $10,000, each plus attorney fees, expenses and court costs. The chapter took effect on .
When LexLint raises it
When your app profile says your app processes biometric data or trains models.