Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Florida: Genetic privacy law enters into effect

House Bill ('HB') 833 for the Protecting DNA Privacy Act entered into effect on 1 October 2021. In particular, the Protecting DNA Privacy Act modifies the state's previous DNA privacy legislation by expanding definitions and broadening the scope of unlawful practices.

Shutter2U / Essentials collection / istockphoto.com

Introduction

Florida has, in recent years, been leading the way in genetic privacy laws. At the federal level, there is limited guidance on the use of genetic information including permitted disclosures. There was an important step when the government passed the Genetic Information Nondiscrimination Act of 2008 ('GINA'). GINA was enacted to prohibit discrimination on the basis of genetic information with respect to health insurance and employment. Then last year, on 1 July 2020, Florida enacted HB 1189 for An act relating to genetic information for insurance purposes. Notably, absent from the scope of GINA was life insurers and long-term care insurers, with HB 1189 changing that and prohibiting these companies from using genetic data for life, disability, and long-term care coverage decisions. The Act applied to all policies entered into or renewed on or after 1 January 2021.

Scope

Florida's Protecting DNA Privacy Act amends Florida's genetic privacy law by introducing new definitions that expand upon the principles of HB 1189. More specifically, the previous genetic privacy law was based on implicit consent which has now been changed to express consent. Under the Protecting DNA Privacy Act, express consent is defined as the 'authorization by the person whose DNA is to be extracted or analyzed, or such person's legal guardian or authorized representative, evidenced by an affirmative action demonstrating an intentional decision, after the person receives a clear and prominent disclosure regarding the manner of collection, use, retention, maintenance, or disclosure of a DNA sample or results of a DNA analysis for specified purposes. A single express consent may authorize every instance of a specified purpose or use.'

In addition, the Protecting DNA Privacy Act establishes the concept of treating DNA as property, by introducing a new definition of 'exclusive property' which 'means the right of the person whose DNA has been extracted or analyzed to exercise control over his or her DNA sample and any results of his or her DNA analysis with regard to the collection, use, retention, maintenance, disclosure, or destruction of such sample or analysis results.'

Furthermore, the Protecting DNA Privacy Act makes it unlawful for a person wilfully, and without express consent to:

  • collect or retain another person's DNA sample with the intent to perform DNA analysis;
  • submit another person's DNA sample for DNA analysis or conduct or procure the conducting of another person's DNA analysis;
  • disclose another person's DNA analysis results to a third party; or
  • sell or otherwise transfer another person's DNA sample or the results of another person's DNA sample or DNA analysis to a third party, regardless of whether the DNA sample was originally collected, retained, or analysed with express consent.

Importantly, each instance of collection or retention, submission or analysis, or disclosure in violation of the Protecting DNA Privacy Act constitutes a separate violation for which a separate penalty is authorised. Such violations are punishable by up to five years imprisonment and fines of up to $5,000 per violation.

State trends

With a legislative gap at the federal level, many states have acted similarly to Florida in enacting genetic privacy laws that go beyond the scope of laws such as GINA. More specifically, Utah enacted Senate Bill ('SB') 227 for the Genetic Information Privacy Act with provisions similar to that of Florida's Protecting DNA Privacy Act. Equally, Arizona enacted HB 2069 for the Genetic Information Privacy Act and California recently passed SB 41 for its Genetic Information Privacy Act. Many of the states' laws focus on topics including consent, anonymisation, and third party use of genetic information.

Looking forward

While Florida has extensive sector specific laws regarding privacy, it lacks a comprehensive state data protection law. However, HB 969 for the Florida Privacy Protection Act, which failed to pass in the last legislative session, signalled that genetic privacy protections continue to be a legislative priority for the state. In particular, DNA was categorised as biometric information under HB 969, which would have afforded certain protections. Lastly, in under two years, Florida has enacted two far-reaching laws regulating genetic privacy and continues to be one of the states that are leading the way in establishing stronger rules regarding how genetic data is used by organisations.

Edidiong Udoh Privacy Analyst
[email protected]

Feedback