NATIONAL LAW REVIEW MAY 22, 2022
Kentucky passed HB 502, the Genetic Information Privacy Act (the Act), was recently signed into law. The Act sets specific requirements for direct-to-consumer genetic testing companies. Direct-to-consumer genetic companies are “entit[ies] that offer genetic testing products or services” or “collect, use, or analyze genetic testing data from a direct-to-consumer testing product or service.”
These companies are required to obtain consent before collecting, using, or disclosing the consumer’s genetic data. The Act also requires these companies to provide an accessible privacy notice and upkeep a comprehensive security program. The Act also grants consumers the ability to recover damages. On April 8, Kentucky Governor Andrew Beshear (D) signed House Bill 502 into law.
The bill, introduced mid-February by a Republican-leaning bipartisan group of representatives (Rachel Roberts being the sole Democrat), defines a biological sample as items, such as tissue, blood, urine, or saliva known to contain DNA. The legislation requires consumers to have a process to access their genetic data, delete their account and genetic data, and request and obtain the destruction of their biological samples. It would also restrict how law enforcement personnel use DNA records voluntarily submitted to eliminate suspects.
Similar bills seeking to grant consumers greater control over their genetic materials have been introduced this year in Hawaii ( SB2032), Maryland ( SB766, HB866), and Minnesota ( SF2817, SF4182, HF4439). Maryland's HB866 passed in both the House and the Senate earlier this month; the governor now has until May 30 to veto the bill. The Kentucky bill, however, is the only one so far to be signed into law. California's own version of a genetic privacy bill, SB41, went into effect on January 1 of this year after being signed into law in October 2021.
Kentucky's HB502 will go into effect on June 1.
