On March 6, 2024, the French data protection authority (CNIL) published guidance on the sale of genetic testing kits. In particular, CNIL highlighted the large amounts of personal and sensitive data collected, including information related to the genome of individuals such as ethnic origin, phenotypic data, and data relating to the health of individuals, alongside data collected to order and send tests including names, address, and email address. In addition, CNIL detailed that genetic data has a particular impact because it is shared between descendants and close family.

More specifically, CNIL clarified that genetic tests can only be carried out in France for:

• judicial investigation;
• medical care; or
• research purposes.

Outside of such circumstances, CNIL provided that the consent of individuals must be obtained. Nonetheless, CNIL detailed that the carrying out of genetic tests is prohibited in France, even with the consent of the person concerned. The purchase of a genetic test on the internet by people in France is therefore punishable by a fine of €3,750 and the carrying out of a genetic test outside the medical and scientific field is prohibited and punishable by a fine of €15,000 and one year in prison for individuals or companies offering these tests.

You can read the press release, only available in French, here.