BUSINESS AND COMMERCE CODE

TITLE 11.  PERSONAL IDENTITY INFORMATION

SUBTITLE A.  IDENTIFYING INFORMATION

CHAPTER 503A. DIRECT-TO-CONSUMER GENETIC TESTING COMPANIES; RIGHTS REGARDING DNA

Sec. 503A.001.  DEFINITIONS.  In this chapter:
(1)  "Biological sample" means a material part of the human body, or a discharge or derivative part of the body, including tissue, blood, urine, or saliva that is known to contain DNA.
(2)  "Deidentified data" means data not reasonably linked to and that cannot reasonably be used to infer information about an identifiable individual.
(3)  "Direct-to-consumer genetic testing company" means an entity that:
(A)  offers genetic testing products or services directly to individuals as consumers of those products or services; or
(B)  collects, uses, or analyzes genetic data that:
(i)  results from a direct-to-consumer genetic testing product or service; and
(ii)  an individual rather than a health care provider provides to the entity.
(4)  "DNA" means deoxyribonucleic acid.
(5)  "Express consent" means an individual's affirmative response to a clear and meaningful notice regarding the collection, use, or disclosure of genetic data for a specific purpose.
(6)  "Genetic data" means any data, regardless of format, concerning an individual's genetic characteristics.  The term:
(A)  includes:
(i)  raw sequence data derived from sequencing all or a portion of an individual's extracted DNA;
(ii)  genotypic and phenotypic information obtained from analyzing an individual's raw sequence data; and
(iii)  health information regarding the health conditions that an individual self-reports to a company and that the company:
(a)  uses for scientific research or product development; and
(b)  analyzes in connection with the individual's raw sequence data; and
(B)  does not include deidentified data.
(7)  "Genetic testing" means a laboratory test of an individual's complete DNA, regions of DNA, chromosomes, genes, or gene products to determine the presence of the individual's genetic characteristics.
(8)  "Person" means an individual, partnership, corporation, association, business, or business trust or the legal representative of an organization.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.

Sec. 503A.002.  APPLICABILITY.  (a) This chapter applies to a direct-to-consumer genetic testing company that:
(1)  offers its products or services to individuals who are residents of this state; or
(2)  collects, uses, or analyzes genetic data that:
(A)  results from the company's products or services; and
(B)  was provided to the company by an individual who is a resident of this state rather than by or at the direction of a health care provider.
(b)  This chapter does not apply to:
(1)  an entity only when they are engaged in collecting, using, or analyzing genetic data or biological samples in the context of research, as defined by 45 C.F.R. Section 164.501, that is conducted in accordance with:
(A)  the federal policy for the protection of human subjects (45 C.F.R. Part 46);
(B)  the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH); or 
(C)  the United States Food and Drug Administration policy for the protection of human subjects (21 C.F.R. Parts 50 and 56);
(2)  genetic data that is protected health information collected by a covered entity or business associate, as defined by 45 C.F.R. Part 160, subject to the privacy, security, and breach notification rules under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.);
(3)  an institution of higher education or a private or independent institution of higher education, as those terms are defined by Section 61.003, Education Code;
(4)  an entity when the entity is offering genetic testing products or services through a health care provider; or
(5)  the collection, use, or analysis of genetic data by a health care provider.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.

Sec. 503A.003.  EXCLUSIVE PROPERTY RIGHT IN DNA; CONFIDENTIALITY.  An individual has a property right in, and retains the right to exercise exclusive control over, the individual's biological sample that is provided to or used by a direct-to-consumer genetic testing company and the results of genetic testing or analysis conducted on the individual's DNA by a direct-to-consumer genetic testing company, including to the collection, use, retention, maintenance, disclosure, or destruction of the sample or results.  The results of the genetic testing of an individual's DNA are confidential and may not be disclosed to another person without the individual's express consent.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.

Sec. 503A.004.  REQUIREMENTS FOR CERTAIN USES OF DEIDENTIFIED DATA.  (a)  Except as otherwise provided by this chapter or other law, a direct-to-consumer genetic testing company that possesses an individual's deidentified data shall:
(1)  implement administrative and technical measures to ensure the data is not associated with a particular individual; and
(2)  publicly commit to maintaining and using data in deidentified form and refraining from making any attempt to identify an individual using the individual's deidentified data.
(b)  If a direct-to-consumer genetic testing company shares an individual's deidentified data with another person, the company shall enter into a legally enforceable contractual obligation prohibiting the person from attempting to identify an individual using the individual's deidentified data.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.

Sec. 503A.005.  REQUIREMENTS FOR CERTAIN USES OR DISCLOSURE OF GENETIC DATA AND BIOLOGICAL SAMPLE.  (a)  A direct-to-consumer genetic testing company shall:
(1)  develop, implement, and maintain a comprehensive security program to protect an individual's genetic data against unauthorized access, use, or disclosure; and
(2)  make publicly available:
(A)  a high-level privacy policy overview that includes basic, essential information about the company's collection, use, or disclosure of genetic data; and
(B)  a prominent privacy notice that includes information about the company's data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices.
(b)  Before collecting, using, or disclosing an individual's genetic data, a direct-to-consumer genetic testing company shall provide to the individual information about the company's collection, use, and disclosure of genetic data the company collects through a genetic testing product or service, including information that:
(1)  clearly describes the company's use of the genetic data;
(2)  specifies the persons who have access to test results; and
(3)  specifies the manner in which the company may share the genetic data.
(c)  A direct-to-consumer genetic testing company shall provide a process for an individual to:
(1)  access the individual's genetic data;
(2)  delete the individual's account and genetic data; and
(3)  destroy or require the destruction of the individual's biological sample.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.

Sec. 503A.006.  REQUIRED CONSENT.  (a)  A direct-to-consumer genetic testing company engaging in any of the following activities must obtain:
(1)  an individual's separate express consent for:
(A)  the transfer or disclosure of the individual's genetic data to any person other than the company's vendors and service providers;
(B)  the use of genetic data for a purpose other than the primary purpose of the company's genetic testing product or service; or
(C)  the retention of any biological sample provided by the individual following the company's completion of the initial testing service requested by the individual;
(2)  an individual's informed consent in accordance with guidelines for the protection of human subjects issued under 45 C.F.R. Part 46, for transfer or disclosure of the individual's genetic data to a third party for:
(A)  research purposes; or
(B)  research conducted under the control of the company for the purpose of publication or generalizable knowledge; and
(3)  an individual's express consent for:
(A)  marketing by the company to the individual based on the individual's genetic data; or
(B)  marketing by a third party to the individual based on the individual's ordering or purchasing of a genetic testing product or service.
(b)  For purposes of Subsection (a), "marketing" does not include providing customized content or offers to an individual with whom a direct-to-consumer genetic testing company has a first-party relationship on the company's Internet website or through an application or service provided by the company to the individual.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.

Sec. 503A.007.  PROHIBITED DISCLOSURES.  (a)  A direct-to-consumer genetic testing company may not disclose an individual's genetic data to a law enforcement entity or other governmental body unless:
(1)  the company first obtains the individual's express written consent; or
(2)  the entity or body obtains a warrant or complies with another valid legal process required by the company.
(b)  A direct-to-consumer genetic testing company may not disclose, without first obtaining an individual's written consent, the individual's genetic data to:
(1)  an entity that offers health insurance, life insurance, or long-term care insurance; or
(2)  an employer of the individual.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.

Sec. 503A.008.  CIVIL PENALTY.  (a)  A direct-to-consumer genetic testing company that violates this chapter is liable to this state for a civil penalty in an amount not to exceed $2,500 for each violation. 
(b)  The attorney general may bring an action to recover a civil penalty imposed under Subsection (a) and to restrain and enjoin a violation of this chapter.  The attorney general may recover reasonable attorney's fees and court costs incurred in bringing the action.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.