In this subtitle the following words have the meanings indicated. “Biological sample” means a material part or a derivative of or discharge from a material part of a human known to contain DNA. “Biological sample” includes human tissue, blood, urine, and saliva. “Deidentified data” means data that: Cannot reasonably be: Used to infer information about a consumer; or Linked to an identifiable consumer; and Is subject to: Administrative and technical measures to ensure that the data cannot be associated with a particular consumer; Public commitment by the company to maintain and use data in a deidentifiable form and not attempt to reidentify data; and Legally enforceable contractual obligations that prohibit a recipient of the data from attempting to reidentify the data. “Direct–to–consumer genetic testing company” means an entity that: Offers genetic testing products or services directly to a consumer; or Collects, uses, or analyzes genetic data that resulted from a direct–to–consumer genetic testing product or service that was provided to the company by a consumer. “DNA” means deoxyribonucleic acid. “Express consent” means an affirmative response by a consumer to a specific, discrete, freely given, and unambiguous notice regarding the collection, use, or disclosure of the consumer’s genetic data for a specific purpose. “Genetic data” means data, in any format, that concerns the genetic characteristics of a consumer. “Genetic data” includes: Raw sequence data that result from sequencing of a consumer’s complete extracted DNA or a portion of the consumer’s complete extracted DNA; Genotypic and phenotypic information that results from analyzing raw sequence data; Information extrapolated, derived, or inferred from the analysis of raw sequence data; and Self–reported health information submitted to a direct–to–consumer genetic testing company by a consumer regarding the consumer’s health conditions: That is used for scientific research or product development; and Analyzed in connection with the consumer’s raw sequence data. “Genetic data” does not include deidentified data. “Genetic testing” means a laboratory test of the complete DNA, regions of DNA, chromosomes, genes, or gene products of a consumer to determine the genetic characteristics of the consumer. “Marketing” does not include the providing of customized content or offers on the websites or through the applications or services provided by the direct–to–consumer genetic testing company with the first–party relationship to the consumer.

This subtitle does not apply to: Protected health information that is collected by a covered entity or business associate as defined in 45 C.F.R. Parts 160 and 164; or Genetic data or biological samples collected for the purpose of research, as defined in 45 C.F.R. 164.501, that is conducted in accordance with: The federal policy for the protection of human subjects established in 45 C.F.R. Part 46; The Good Clinical Practice Guidelines issued by the International Council for Harmonisation; or The U.S. Food and Drug Administration Protection of Human Subjects under 21 C.F.R. Parts 50 and 56.

A direct–to–consumer genetic testing company shall provide a consumer with clear and complete information regarding the company’s policies and procedures for collecting, using, or disclosing genetic data, including: A high–level overview of the company’s privacy policy that includes basic and essential information about how the company collects, uses, and discloses genetic data; and A privacy notice that, at a minimum, includes information about the company’s data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices. The information required to be provided under subsection (a) of this section shall be: Made publicly available; and Placed in a prominent area of the direct–to–consumer genetic testing company’s website.

A direct–to–consumer genetic testing company, at a minimum, shall obtain the following consents from a consumer before collecting, using, or disclosing the consumer’s genetic data: Initial express consent that clearly: Describes the uses of the genetic data collected through the genetic testing product or service; and Specifies: Who has access to the results of the genetic testing; and How the genetic data may be shared; Express consent for transferring or disclosing the consumer’s genetic data to a person other than the company’s vendors and service providers; Express consent for using genetic data beyond the primary purpose of the genetic testing product or service requested by the consumer; Express consent for the retention of a biological sample provided by the consumer after the initial testing service requested by the consumer is completed; Express consent to be marketed to by: The direct–to–consumer genetic testing company based on the consumer’s genetic data; and A third party based on the consumer having ordered or purchased a genetic testing product or service; and Informed consent in compliance with the federal policy for the protection of human research subjects for transfer or disclosure of the consumer’s genetic data to third parties for research purposes or research conducted under the control of the company for the purpose of publication or generalizable knowledge.

A direct–to–consumer genetic testing company shall establish legal policies and processes for disclosing genetic data to law enforcement or another government agency without a consumer’s express written consent. A direct–to–consumer genetic testing company shall develop, implement, and maintain a comprehensive security program to protect consumers’ genetic data against unauthorized access, use, or disclosure. A direct–to–consumer genetic testing company shall establish a process for a consumer to: Access the consumer’s genetic data; Delete the consumer’s account and genetic data; and Request the destruction of the consumer’s biological sample. Notwithstanding any other provisions of law, a direct–to–consumer genetic testing company may not, without the consumer’s written consent, disclose a consumer’s genetic data to: An entity offering health insurance, life insurance, disability insurance, or long–term care insurance; or An employer of the consumer.

A violation of this section is an unfair, abusive, or deceptive trade practice within the meaning of Title 13 of this article and is subject to the enforcement and penalty provisions contained in Title 13 of this article. This section does not prevent an individual from pursuing any other remedy provided by law.

The disclosure of genetic data in accordance with this subtitle shall comply with all State and federal laws for the protection of privacy and security.

This subtitle may be known and cited as the Maryland Genetic Information Privacy Act.