I 

116TH CONGRESS 

1ST SESSION H. R. 2155 

To provide for certain requirements with respect to the treatment of 

personally identifiable information by genetic testing services. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 9, 2019 

Mr. RUSH introduced the following bill; which was referred to the Committee 

on Energy and Commerce 

A BILL 

To provide for certain requirements with respect to the treatment of personally identifiable information by genetic 

testing services. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Genetic Information 

5 Privacy Act of 2019’’. 

6 SEC. 2. TREATMENT OF PERSONALLY IDENTIFIABLE IN7 FORMATION BY GENETIC TESTING SERVICES. 

8 (a) CONSENT REQUIRED.— 

9 (1) EXPRESS CONSENT FOR DISCLOSURE.— 


kjohnson on DSK79L0C42 with BILLS
2 

•HR 2155 IH

1 (A) IN GENERAL.—A genetic testing serv2 ice may not disclose personally identifiable in3 formation of a customer to a third party unless 

4 the service obtains the express consent of the 

5 customer. 

6 (B) RELATIONSHIP TO INFORMED CON7 SENT REQUIREMENT.—In the case of the disclo8 sure of genetic information for medical re9 search, paragraph (2) applies instead of sub10 paragraph (A). 

11 (2) INFORMED CONSENT FOR USE OR DISCLO12 SURE OF GENETIC INFORMATION FOR MEDICAL RE13 SEARCH.—A genetic testing service may not use ge14 netic information of a customer for medical research, 

15 or disclose such information to a third party for 

16 medical research, unless the service— 

17 (A) obtains the informed consent of the 

18 customer in accordance with section 46.116 of 

19 title 45, Code of Federal Regulations, as in ef20 fect on the date of the enactment of this Act; 

21 and 

22 (B) documents the consent of the customer 

23 in accordance with section 46.117 of title 45, 

24 Code of Federal Regulations, as in effect on the 

25 date of the enactment of this Act. 


kjohnson on DSK79L0C42 with BILLS
3 

•HR 2155 IH

1 (3) OPTION REGARDING GENETIC INFORMA2 TION.—In seeking the consent of a customer under 

3 paragraph (1) or (2) for the disclosure of personally 

4 identifiable information, a genetic testing service 

5 shall give the customer the option of providing con6 sent for the disclosure of the genetic information of 

7 the customer while withholding consent for the dis8 closure of any other personally identifiable informa9 tion of the customer. 

10 (4) PROHIBITION ON CONDITIONING SERVICE

11 ON CONSENT.—A genetic testing service may not 

12 condition the provision of service to a customer on 

13 obtaining the consent of the customer required by 

14 paragraph (1) or (2), except to the extent that dis15 closure of personally identifiable information is nec16 essary to provide the service. 

17 (b) NOTIFICATION.— 

18 (1) NEW CUSTOMERS.—In the case of an agree19 ment for service entered into between a genetic test20 ing service and a customer on or after the effective 

21 date described in section 6, the genetic testing serv22 ice shall notify the customer of the rights of the cus23 tomer under subsection (a)— 

24 (A) at the time when the agreement is en25 tered into; 


kjohnson on DSK79L0C42 with BILLS
4 

•HR 2155 IH

1 (B) using the same method of communica2 tion by which the agreement is entered into; 

3 and 

4 (C) in a manner that is— 

5 (i) clear and conspicuous; and 

6 (ii) separate from any privacy policy, 

7 data use policy, or other similar document. 

8 (2) EXISTING CUSTOMERS.— 

9 (A) IN GENERAL.—In the case of an agree10 ment for service entered into between a genetic 

11 testing service and a customer before the effec12 tive date described in section 6, the genetic 

13 testing service shall notify the customer of the 

14 rights of the customer under subsection (a)— 

15 (i) not later than the date that is 1 

16 year after such effective date; 

17 (ii) using the primary method of com18 munication of the genetic testing service 

19 with the customer; and 

20 (iii) in a manner that is— 

21 (I) clear and conspicuous; and 

22 (II) separate from any privacy 

23 policy, data use policy, or other simi24 lar document. 


kjohnson on DSK79L0C42 with BILLS
5 

•HR 2155 IH

1 (B) INABILITY TO CONTACT.—A genetic 

2 testing service may not be considered to be in 

3 violation of subparagraph (A) by reason of 

4 being unable to contact a customer, if the serv5 ice sends the notification required by such sub6 paragraph— 

7 (i) if the primary method of commu8 nication of the service with the customer is 

9 in writing, to the last known home mailing 

10 address of the customer in the records of 

11 the service; and 

12 (ii) if the primary method of commu13 nication of the service with the customer is 

14 email or other electronic means, to the last 

15 known email address, or using the last 

16 known other electronic contact informa17 tion, as the case may be, of the customer 

18 in the records of the service. 

19 (3) WEBSITE NOTIFICATION.—In addition to 

20 the notifications required by paragraphs (1) and (2), 

21 a genetic testing service shall provide clear and con22 spicuous notification of the rights of customers 

23 under subsection (a) on the internet website of the 

24 service (if the service maintains such a website). 


kjohnson on DSK79L0C42 with BILLS
6 

•HR 2155 IH

1 Such notification shall be separate from any privacy 

2 policy, data use policy, or other similar document. 

3 (4) CONTENTS.—The Commission shall include 

4 in the regulations promulgated under subsection (d) 

5 requirements for the contents of the notifications re6 quired by this subsection. 

7 (c) INFORMATION SECURITY REQUIREMENTS.—The 

8 Commission shall promulgate regulations that require a 

9 genetic testing service to implement policies and proce10 dures to secure the personally identifiable information of 

11 customers of the service against unauthorized access. 

12 (d) REGULATIONS.— 

13 (1) IN GENERAL.—Not later than 1 year after 

14 the date of the enactment of this Act, the Commis15 sion shall promulgate, under section 553 of title 5, 

16 United States Code— 

17 (A) regulations to implement subsections 

18 (a) and (b); and 

19 (B) the regulations required by subsection 

20 (c). 

21 (2) CONSIDERATIONS.—In promulgating regu22 lations under paragraph (1), the Commission shall 

23 take into consideration— 

24 (A) the size of, and the nature, scope, and 

25 complexity of the activities engaged in by, difVerDate Sep 11 2014 04:19 Apr 17, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H2155.IH H2155

kjohnson on DSK79L0C42 with BILLS
7 

•HR 2155 IH

1 ferent types or categories of genetic testing 

2 services; 

3 (B) the cost of implementing the require4 ments of subsections (a) and (b) and such regu5 lations; and 

6 (C) in the case of the regulations required 

7 by subsection (c), the current state of the art 

8 in administrative, technical, and physical safe9 guards to secure information against unauthor10 ized access. 

11 SEC. 3. ENFORCEMENT. 

12 (a) ENFORCEMENT BY FEDERAL TRADE COMMIS13 SION.— 

14 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC15 TICES.—A violation of section 2 or a regulation pro16 mulgated under such section shall be treated as an 

17 unfair or deceptive act or practice in violation of a 

18 regulation under section 18(a)(1)(B) of the Federal 

19 Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) re20 garding unfair or deceptive acts or practices. 

21 (2) POWERS OF COMMISSION.—The Commis22 sion shall enforce section 2 and the regulations pro23 mulgated under such section in the same manner, by 

24 the same means, and with the same jurisdiction, 

25 powers, and duties as though all applicable terms 


kjohnson on DSK79L0C42 with BILLS
8 

•HR 2155 IH

1 and provisions of the Federal Trade Commission Act 

2 (15 U.S.C. 41 et seq.) were incorporated into and 

3 made a part of this Act. Any person who violates 

4 such section or such a regulation shall be subject to 

5 the penalties and entitled to the privileges and im6 munities provided in the Federal Trade Commission 

7 Act. 

8 (b) ENFORCEMENT BY STATE ATTORNEYS GEN9 ERAL.— 

10 (1) CIVIL ACTION.—In any case in which the 

11 attorney general of a State, or an official or agency 

12 of a State, has reason to believe that an interest of 

13 the residents of that State has been or is threatened 

14 or adversely affected by any person who violates sec15 tion 2 or a regulation promulgated under such sec16 tion, the attorney general, official, or agency of the 

17 State, as parens patriae, may bring a civil action on 

18 behalf of the residents of the State in a district 

19 court of the United States of appropriate jurisdic20 tion— 

21 (A) to enjoin further violation of such sec22 tion or such regulation by the defendant; 

23 (B) to compel compliance with such section 

24 or such regulation; or 


kjohnson on DSK79L0C42 with BILLS
9 

•HR 2155 IH

1 (C) to obtain civil penalties in the same 

2 amount as the civil penalties that may be ob3 tained by the Commission under section 5(m) of 

4 the Federal Trade Commission Act (15 U.S.C. 

5 45(m)). 

6 (2) INTERVENTION BY FTC.— 

7 (A) NOTICE AND INTERVENTION.—The 

8 State shall provide prior written notice of any 

9 action under paragraph (1) to the Commission 

10 and provide the Commission with a copy of its 

11 complaint, except in any case in which such 

12 prior notice is not feasible, in which case the 

13 State shall serve such notice immediately upon 

14 instituting such action. The Commission shall 

15 have the right— 

16 (i) to intervene in the action; 

17 (ii) upon so intervening, to be heard 

18 on all matters arising therein; and 

19 (iii) to file petitions for appeal. 

20 (B) LIMITATION ON STATE ACTION WHILE

21 FEDERAL ACTION IS PENDING.—If the Commis22 sion has instituted a civil action for violation of 

23 section 2 or a regulation promulgated under 

24 such section, no State attorney general, or offi25 cial or agency of a State, may bring an action 


kjohnson on DSK79L0C42 with BILLS
10 

•HR 2155 IH

1 under paragraph (1) during the pendency of the 

2 action of the Commission against any defendant 

3 named in the complaint of the Commission for 

4 any violation of such section or such regulation 

5 alleged in the complaint. 

6 (3) RULE OF CONSTRUCTION.—For purposes of 

7 bringing any civil action under paragraph (1), noth8 ing in this Act or the regulations promulgated under 

9 this Act shall be construed to prevent an attorney 

10 general of a State from exercising the powers con11 ferred on the attorney general by the laws of that 

12 State to— 

13 (A) conduct investigations; 

14 (B) administer oaths or affirmations; or 

15 (C) compel the attendance of witnesses or 

16 the production of documentary and other evi17 dence. 

18 SEC. 4. EFFECT ON OTHER LAWS. 

19 (a) PREEMPTION OF CERTAIN STATE LAWS RELAT20 ING TO GENETIC TESTING.—This Act and the regulations 

21 promulgated under this Act supersede any provision of a 

22 statute, regulation, or rule of a State or political subdivi23 sion of a State, with respect to an entity to the extent 

24 this Act and the regulations promulgated under this Act 

25 apply to such entity, that expressly provides for requireVerDate Sep 11 2014 04:19 Apr 17, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H2155.IH H2155

kjohnson on DSK79L0C42 with BILLS
11 

•HR 2155 IH

1 ments relating to treatment of personal information by 

2 services providing genetic testing that are similar to any 

3 requirements contained in section 2 or a regulation pro4 mulgated under such section. 

5 (b) PRESERVATION OF CERTAIN STATE LAWS.—This 

6 Act and the regulations promulgated under this Act may 

7 not be construed to preempt the applicability of— 

8 (1) State trespass, contract, or tort law; or 

9 (2) other State laws to the extent that those 

10 laws relate to acts of fraud. 

11 (c) ADDITIONAL PREEMPTION.— 

12 (1) IN GENERAL.—No person other than the at13 torney general of a State, or another official or 

14 agency of a State, may bring a civil action under the 

15 laws of any State if such action is premised in whole 

16 or in part upon the defendant violating any provision 

17 of this Act or a regulation promulgated under this 

18 Act. 

19 (2) PRESERVATION OF CONSUMER PROTECTION

20 LAWS.—This subsection may not be construed to 

21 limit the enforcement of any State consumer protec22 tion law by an attorney general of a State, or an23 other official or agency of a State. 

24 (d) PRESERVATION OF FTC AUTHORITY.—Nothing 

25 in this Act may be construed in any way to limit the auVerDate Sep 11 2014 04:19 Apr 17, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H2155.IH H2155

kjohnson on DSK79L0C42 with BILLS
12 

•HR 2155 IH

1 thority of the Commission under any other provision of 

2 law. 

3 SEC. 5. DEFINITIONS. 

4 In this Act: 

5 (1) COMMISSION.—The term ‘‘Commission’’ 

6 means the Federal Trade Commission. 

7 (2) GENETIC INFORMATION.—The term ‘‘ge8 netic information’’— 

9 (A) has the meaning given such term in 

10 section 201 of the Genetic Information Non11 discrimination Act of 2008 (42 U.S.C. 2000ff); 

12 and 

13 (B) includes a physical sample, such as 

14 fluid or tissue, obtained from a customer for 

15 purposes of performing a genetic test. 

16 (3) GENETIC TEST.—The term ‘‘genetic test’’ 

17 has the meaning given such term in section 201 of 

18 the Genetic Information Nondiscrimination Act of 

19 2008 (42 U.S.C. 2000ff). 

20 (4) GENETIC TESTING SERVICE.—The term 

21 ‘‘genetic testing service’’ means any entity that— 

22 (A) offers genetic tests directly to con23 sumers; or 

24 (B) analyzes genetic information obtained 

25 from a genetic test offered directly to conVerDate Sep 11 2014 04:19 Apr 17, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H2155.IH H2155

kjohnson on DSK79L0C42 with BILLS
13 

•HR 2155 IH

1 sumers, except to the extent that the analysis is 

2 performed by a medical professional for diag3 nosis or treatment of a medical condition. 

4 (5) MEDICAL RESEARCH.—The term ‘‘medical 

5 research’’ means the conduct of investigations, ex6 periments, and studies to discover, develop, or verify 

7 knowledge relating to the causes, diagnosis, treat8 ment, prevention, or control of physical or mental 

9 diseases and impairments of humans. 

10 (6) PERSONALLY IDENTIFIABLE INFORMA11 TION.— 

12 (A) DEFINITION.—The term ‘‘personally 

13 identifiable information’’ means any of the fol14 lowing of an individual: 

15 (i) Name. 

16 (ii) Address. 

17 (iii) Social Security number. 

18 (iv) Phone number. 

19 (v) Online identifier, such as an email 

20 address or user ID. 

21 (vi) Genetic information. 

22 (vii) Information, other than genetic 

23 information, that— 


kjohnson on DSK79L0C42 with BILLS
14 

•HR 2155 IH

1 (I) relates to the past, present, or 

2 future physical or mental health or 

3 condition of the individual; and 

4 (II) either— 

5 (aa) identifies the individual; 

6 or 

7 (bb) there is a reasonable 

8 basis to believe can be used to 

9 identify the individual. 

10 (B) MODIFIED DEFINITION BY RULE11 MAKING.—The Commission may, by regulation 

12 promulgated under section 553 of title 5, 

13 United States Code, modify the definition of 

14 ‘‘personally identifiable information’’ under sub15 paragraph (A) to the extent that such modifica16 tion is necessary to accommodate changes in 

17 technology or practices, will not unreasonably 

18 impede interstate commerce, and will accom19 plish the purposes of this Act. 

20 (7) STATE.—The term ‘‘State’’ means each 

21 State of the United States, the District of Columbia, 

22 each commonwealth, territory, or possession of the 

23 United States, and each federally recognized Indian 

24 Tribe. 


kjohnson on DSK79L0C42 with BILLS
15 

•HR 2155 IH

1 (8) THIRD PARTY.—The term ‘‘third party’’ 

2 means, with respect to a genetic testing service, an 

3 entity (including an entity that controls, is controlled 

4 by, or is under common control with the service) 

5 that holds itself out to the public as separate from 

6 the service such that a customer of the service act7 ing reasonably under the circumstances would not 

8 expect the entity to be related to the service or to 

9 have access to personally identifiable information 

10 that the customer provides to the service. 

11 SEC. 6. EFFECTIVE DATE. 

12 Except for subsections (c) and (d) of section 2, sec13 tion 5(6)(B), this section, and section 7, this Act and the 

14 regulations required by subsections (c) and (d) of section 

15 2 shall apply beginning on the date that is 30 days after 

16 the date on which the Commission promulgates such regu17 lations. 

18 SEC. 7. AUTHORIZATION OF APPROPRIATIONS. 

19 There is authorized to be appropriated to the Com20 mission $5,000,000 for each of the fiscal years 2020 

21 through 2029 to carry out this Act. 

Æ 


kjohnson on DSK79L0C42 with BILLS