I 
116TH CONGRESS 
1ST SESSION H. R. 2155 
To provide for certain requirements with respect to the treatment of 
personally identifiable information by genetic testing services. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 9, 2019 
Mr. RUSH introduced the following bill; which was referred to the Committee 
on Energy and Commerce 
A BILL 
To provide for certain requirements with respect to the treat-
ment of personally identifiable information by genetic 
testing services. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Genetic Information 
Privacy Act of 2019’’. 
SEC. 2. TREATMENT OF PERSONALLY IDENTIFIABLE IN-
FORMATION BY GENETIC TESTING SERVICES. 
(a) CONSENT REQUIRED.— 
(1) EXPRESS CONSENT FOR DISCLOSURE.— 
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
(A) IN GENERAL.—A genetic testing serv-
ice may not disclose personally identifiable in-
formation of a customer to a third party unless 
the service obtains the express consent of the 
customer. 
(B) RELATIONSHIP
TO
INFORMED
CON-
SENT REQUIREMENT.—In the case of the disclo-
sure of genetic information for medical re-
search, paragraph (2) applies instead of sub-
paragraph (A). 
(2) INFORMED CONSENT FOR USE OR DISCLO-
SURE OF GENETIC INFORMATION FOR MEDICAL RE-
SEARCH.—A genetic testing service may not use ge-
netic information of a customer for medical research, 
or disclose such information to a third party for 
medical research, unless the service— 
(A) obtains the informed consent of the 
customer in accordance with section 46.116 of 
title 45, Code of Federal Regulations, as in ef-
fect on the date of the enactment of this Act; 
and 
(B) documents the consent of the customer 
in accordance with section 46.117 of title 45, 
Code of Federal Regulations, as in effect on the 
date of the enactment of this Act. 
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
(3) OPTION
REGARDING
GENETIC
INFORMA-
TION.—In seeking the consent of a customer under 
paragraph (1) or (2) for the disclosure of personally 
identifiable information, a genetic testing service 
shall give the customer the option of providing con-
sent for the disclosure of the genetic information of 
the customer while withholding consent for the dis-
closure of any other personally identifiable informa-
tion of the customer. 
(4) PROHIBITION
ON
CONDITIONING
SERVICE 
ON CONSENT.—A genetic testing service may not 
condition the provision of service to a customer on 
obtaining the consent of the customer required by 
paragraph (1) or (2), except to the extent that dis-
closure of personally identifiable information is nec-
essary to provide the service. 
(b) NOTIFICATION.— 
(1) NEW CUSTOMERS.—In the case of an agree-
ment for service entered into between a genetic test-
ing service and a customer on or after the effective 
date described in section 6, the genetic testing serv-
ice shall notify the customer of the rights of the cus-
tomer under subsection (a)— 
(A) at the time when the agreement is en-
tered into; 
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
(B) using the same method of communica-
tion by which the agreement is entered into; 
and 
(C) in a manner that is— 
(i) clear and conspicuous; and 
(ii) separate from any privacy policy, 
data use policy, or other similar document. 
(2) EXISTING CUSTOMERS.— 
(A) IN GENERAL.—In the case of an agree-
ment for service entered into between a genetic 
testing service and a customer before the effec-
tive date described in section 6, the genetic 
testing service shall notify the customer of the 
rights of the customer under subsection (a)— 
(i) not later than the date that is 1 
year after such effective date; 
(ii) using the primary method of com-
munication of the genetic testing service 
with the customer; and 
(iii) in a manner that is— 
(I) clear and conspicuous; and 
(II) separate from any privacy 
policy, data use policy, or other simi-
lar document. 
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
(B) INABILITY
TO
CONTACT.—A genetic 
testing service may not be considered to be in 
violation of subparagraph (A) by reason of 
being unable to contact a customer, if the serv-
ice sends the notification required by such sub-
paragraph— 
(i) if the primary method of commu-
nication of the service with the customer is 
in writing, to the last known home mailing 
address of the customer in the records of 
the service; and 
(ii) if the primary method of commu-
nication of the service with the customer is 
email or other electronic means, to the last 
known email address, or using the last 
known other electronic contact informa-
tion, as the case may be, of the customer 
in the records of the service. 
(3) WEBSITE
NOTIFICATION.—In addition to 
the notifications required by paragraphs (1) and (2), 
a genetic testing service shall provide clear and con-
spicuous notification of the rights of customers 
under subsection (a) on the internet website of the 
service (if the service maintains such a website). 
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
Such notification shall be separate from any privacy 
policy, data use policy, or other similar document. 
(4) CONTENTS.—The Commission shall include 
in the regulations promulgated under subsection (d) 
requirements for the contents of the notifications re-
quired by this subsection. 
(c) INFORMATION SECURITY REQUIREMENTS.—The 
Commission shall promulgate regulations that require a 
genetic testing service to implement policies and proce-
dures to secure the personally identifiable information of 
customers of the service against unauthorized access. 
(d) REGULATIONS.— 
(1) IN GENERAL.—Not later than 1 year after 
the date of the enactment of this Act, the Commis-
sion shall promulgate, under section 553 of title 5, 
United States Code— 
(A) regulations to implement subsections 
(a) and (b); and 
(B) the regulations required by subsection 
(c). 
(2) CONSIDERATIONS.—In promulgating regu-
lations under paragraph (1), the Commission shall 
take into consideration— 
(A) the size of, and the nature, scope, and 
complexity of the activities engaged in by, dif-
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
ferent types or categories of genetic testing 
services; 
(B) the cost of implementing the require-
ments of subsections (a) and (b) and such regu-
lations; and 
(C) in the case of the regulations required 
by subsection (c), the current state of the art 
in administrative, technical, and physical safe-
guards to secure information against unauthor-
ized access. 
SEC. 3. ENFORCEMENT. 
(a) ENFORCEMENT BY FEDERAL TRADE COMMIS-
SION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 2 or a regulation pro-
mulgated under such section shall be treated as an 
unfair or deceptive act or practice in violation of a 
regulation under section 18(a)(1)(B) of the Federal 
Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) re-
garding unfair or deceptive acts or practices. 
(2) POWERS
OF
COMMISSION.—The Commis-
sion shall enforce section 2 and the regulations pro-
mulgated under such section in the same manner, by 
the same means, and with the same jurisdiction, 
powers, and duties as though all applicable terms 
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
and provisions of the Federal Trade Commission Act 
(15 U.S.C. 41 et seq.) were incorporated into and 
made a part of this Act. Any person who violates 
such section or such a regulation shall be subject to 
the penalties and entitled to the privileges and im-
munities provided in the Federal Trade Commission 
Act. 
(b) ENFORCEMENT
BY STATE ATTORNEYS GEN-
ERAL.— 
(1) CIVIL ACTION.—In any case in which the 
attorney general of a State, or an official or agency 
of a State, has reason to believe that an interest of 
the residents of that State has been or is threatened 
or adversely affected by any person who violates sec-
tion 2 or a regulation promulgated under such sec-
tion, the attorney general, official, or agency of the 
State, as parens patriae, may bring a civil action on 
behalf of the residents of the State in a district 
court of the United States of appropriate jurisdic-
tion— 
(A) to enjoin further violation of such sec-
tion or such regulation by the defendant; 
(B) to compel compliance with such section 
or such regulation; or 
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
(C) to obtain civil penalties in the same 
amount as the civil penalties that may be ob-
tained by the Commission under section 5(m) of 
the Federal Trade Commission Act (15 U.S.C. 
45(m)). 
(2) INTERVENTION BY FTC.— 
(A) NOTICE
AND
INTERVENTION.—The 
State shall provide prior written notice of any 
action under paragraph (1) to the Commission 
and provide the Commission with a copy of its 
complaint, except in any case in which such 
prior notice is not feasible, in which case the 
State shall serve such notice immediately upon 
instituting such action. The Commission shall 
have the right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Commis-
sion has instituted a civil action for violation of 
section 2 or a regulation promulgated under 
such section, no State attorney general, or offi-
cial or agency of a State, may bring an action 
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
under paragraph (1) during the pendency of the 
action of the Commission against any defendant 
named in the complaint of the Commission for 
any violation of such section or such regulation 
alleged in the complaint. 
(3) RULE OF CONSTRUCTION.—For purposes of 
bringing any civil action under paragraph (1), noth-
ing in this Act or the regulations promulgated under 
this Act shall be construed to prevent an attorney 
general of a State from exercising the powers con-
ferred on the attorney general by the laws of that 
State to— 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
SEC. 4. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF CERTAIN STATE LAWS RELAT-
ING TO GENETIC TESTING.—This Act and the regulations 
promulgated under this Act supersede any provision of a 
statute, regulation, or rule of a State or political subdivi-
sion of a State, with respect to an entity to the extent 
this Act and the regulations promulgated under this Act 
apply to such entity, that expressly provides for require-
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
ments relating to treatment of personal information by 
services providing genetic testing that are similar to any 
requirements contained in section 2 or a regulation pro-
mulgated under such section. 
(b) PRESERVATION OF CERTAIN STATE LAWS.—This 
Act and the regulations promulgated under this Act may 
not be construed to preempt the applicability of— 
(1) State trespass, contract, or tort law; or 
(2) other State laws to the extent that those 
laws relate to acts of fraud. 
(c) ADDITIONAL PREEMPTION.— 
(1) IN GENERAL.—No person other than the at-
torney general of a State, or another official or 
agency of a State, may bring a civil action under the 
laws of any State if such action is premised in whole 
or in part upon the defendant violating any provision 
of this Act or a regulation promulgated under this 
Act. 
(2) PRESERVATION OF CONSUMER PROTECTION 
LAWS.—This subsection may not be construed to 
limit the enforcement of any State consumer protec-
tion law by an attorney general of a State, or an-
other official or agency of a State. 
(d) PRESERVATION OF FTC AUTHORITY.—Nothing 
in this Act may be construed in any way to limit the au-
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
thority of the Commission under any other provision of 
law. 
SEC. 5. DEFINITIONS. 
In this Act: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) GENETIC
INFORMATION.—The term ‘‘ge-
netic information’’— 
(A) has the meaning given such term in 
section 201 of the Genetic Information Non-
discrimination Act of 2008 (42 U.S.C. 2000ff); 
and 
(B) includes a physical sample, such as 
fluid or tissue, obtained from a customer for 
purposes of performing a genetic test. 
(3) GENETIC TEST.—The term ‘‘genetic test’’ 
has the meaning given such term in section 201 of 
the Genetic Information Nondiscrimination Act of 
2008 (42 U.S.C. 2000ff). 
(4) GENETIC
TESTING
SERVICE.—The term 
‘‘genetic testing service’’ means any entity that— 
(A) offers genetic tests directly to con-
sumers; or 
(B) analyzes genetic information obtained 
from a genetic test offered directly to con-
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
sumers, except to the extent that the analysis is 
performed by a medical professional for diag-
nosis or treatment of a medical condition. 
(5) MEDICAL RESEARCH.—The term ‘‘medical 
research’’ means the conduct of investigations, ex-
periments, and studies to discover, develop, or verify 
knowledge relating to the causes, diagnosis, treat-
ment, prevention, or control of physical or mental 
diseases and impairments of humans. 
(6) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.— 
(A) DEFINITION.—The term ‘‘personally 
identifiable information’’ means any of the fol-
lowing of an individual: 
(i) Name. 
(ii) Address. 
(iii) Social Security number. 
(iv) Phone number. 
(v) Online identifier, such as an email 
address or user ID. 
(vi) Genetic information. 
(vii) Information, other than genetic 
information, that— 
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
(I) relates to the past, present, or 
future physical or mental health or 
condition of the individual; and 
(II) either— 
(aa) identifies the individual; 
or 
(bb) there is a reasonable 
basis to believe can be used to 
identify the individual. 
(B) MODIFIED
DEFINITION
BY
RULE-
MAKING.—The Commission may, by regulation 
promulgated under section 553 of title 5, 
United States Code, modify the definition of 
‘‘personally identifiable information’’ under sub-
paragraph (A) to the extent that such modifica-
tion is necessary to accommodate changes in 
technology or practices, will not unreasonably 
impede interstate commerce, and will accom-
plish the purposes of this Act. 
(7) STATE.—The term ‘‘State’’ means each 
State of the United States, the District of Columbia, 
each commonwealth, territory, or possession of the 
United States, and each federally recognized Indian 
Tribe. 
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS
(8) THIRD
PARTY.—The term ‘‘third party’’ 
means, with respect to a genetic testing service, an 
entity (including an entity that controls, is controlled 
by, or is under common control with the service) 
that holds itself out to the public as separate from 
the service such that a customer of the service act-
ing reasonably under the circumstances would not 
expect the entity to be related to the service or to 
have access to personally identifiable information 
that the customer provides to the service. 
SEC. 6. EFFECTIVE DATE. 
Except for subsections (c) and (d) of section 2, sec-
tion 5(6)(B), this section, and section 7, this Act and the 
regulations required by subsections (c) and (d) of section 
2 shall apply beginning on the date that is 30 days after 
the date on which the Commission promulgates such regu-
lations. 
SEC. 7. AUTHORIZATION OF APPROPRIATIONS. 
There is authorized to be appropriated to the Com-
mission $5,000,000 for each of the fiscal years 2020 
through 2029 to carry out this Act. 
Æ 
VerDate Sep 11 2014 
04:19 Apr 17, 2019
Jkt 089200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6301
E:\BILLS\H2155.IH
H2155
kjohnson on DSK79L0C42 with BILLS