Enter to open, tab to navigate, enter to select
Wyoming Amends Genetic Data Privacy Law
Practical Law Legal Update w-034-8410 (Approx. 3 pages)
Wyoming Amends Genetic Data Privacy Law
by Practical Law Data Privacy & Cybersecurity
| Published on 16 Mar 2022 • Wyoming |
Wyoming has amended its genetic information privacy law to include enhanced notice, consent, and consumer rights requirements for direct to consumer genetic testing companies collecting, using, and analyzing genetic data.
On March 8, 2022, Wyoming Governor Mark Gordon signed HB 86, which amends Wyoming's genetic information privacy law (Wyo. Stat. Ann. §§ 35-32-101 to 35-32-104) to add requirements on express consent, secondary uses of genetic data, privacy policies, and consumer rights, among others. The amendments apply to direct to consumer genetic testing companies, defined as any companies that offer consumer genetic testing products or services directly to consumers or that collect, use, or analyze genetic data provided by a consumer (Wyo. Stat. Ann § 35-32-101(a)(x)).
The genetic information privacy law currently requires informed consent for genetic data collection, testing, retention, or disclosure (Wyo. Stat. Ann. § 35-32-102) and does not contain any consumer rights provisions. The amendments require direct to consumer genetic testing companies to follow enhanced notice and consent procedures when collecting genetic data from a consumer, including:
- Issuing privacy notices containing specific information, including a high-level privacy policy overview.
- Providing processes for consumers to access and delete their genetic data and request and obtain destruction of their biological sample.
- Obtaining initial express consent to collect genetic data after informing the consumer how it will use and share the data and who will access the test results.
- Obtaining separate express consent to:
- disclose genetic data to a third party that is not the company's service provider or vendor;
- use genetic data for secondary purposes or purposes beyond the inherent contextual uses;
- retain genetic data after completing the initial testing service;
- market to the consumer based on their genetic data, other than by providing customized content or offers through its website or app; or
- allow a third party to market to the consumer based on their genetic data or their purchase of a genetic testing product or service.
- Obtaining informed consent in compliance with the federal policy protecting human research subjects (45 C.F.R. § 46) to:
- use a consumer's genetic data for its own research for publication or general knowledge; or
- transfer a consumer's genetic data to a third party for research.
The amendments also:
- Clarify that genetic data includes consumer reported health information when used for research or product development along with the consumer's DNA sequence data.
- Prohibit direct to consumer genetic testing companies from disclosing a consumer's genetic data to insurers or to a consumer's employers without the consumer's written consent.
- Prohibit waiving the law's requirements.
- Mandate companies to require valid legal process before disclosing a consumer's genetic data to law enforcement or any other government agency without the consumer's express written consent.
- Impose a 60-day right to cure period on the private right of action.
- Allow the Attorney General to enforce the law and seek civil penalties of $2,500 per violation plus actual damages incurred by consumers, attorneys' fees, and costs.
- Exclude protected health information collected by a covered entity or business associate governed by the Health Insurance Portability and Accountability Act (Pub. L. No. 104-191 (1996)) (HIPAA).
The amendments will become effective July 1, 2022 and apply to direct to consumer genetic testing contracts entered into on or after that date.