H.B. No. 2545

	AN ACT
	relating to an individual's genetic data, including the use of that
	data by certain genetic testing companies for commercial purposes
	and the individual's property right in DNA; authorizing a civil
	penalty.
	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
	SECTION 1.  Subtitle A, Title 11, Business & Commerce Code,
	is amended by adding Chapter 503A to read as follows:
	CHAPTER 503A. DIRECT-TO-CONSUMER GENETIC TESTING COMPANIES; RIGHTS
	REGARDING DNA
	Sec. 503A.001.  DEFINITIONS. In this chapter:
	(1)  "Biological sample" means a material part of the
	human body, or a discharge or derivative part of the body, including
	tissue, blood, urine, or saliva that is known to contain DNA.
	(2)  "Deidentified data" means data not reasonably
	linked to and that cannot reasonably be used to infer information
	about an identifiable individual.
	(3)  "Direct-to-consumer genetic testing company"
	means an entity that:
	(A)  offers genetic testing products or services
	directly to individuals as consumers of those products or services;
	or
	(B)  collects, uses, or analyzes genetic data
	that:
	(i)  results from a direct-to-consumer
	genetic testing product or service; and
	(ii)  an individual rather than a health
	care provider provides to the entity.
	(4)  "DNA" means deoxyribonucleic acid.
	(5)  "Express consent" means an individual's
	affirmative response to a clear and meaningful notice regarding the
	collection, use, or disclosure of genetic data for a specific
	purpose.
	(6)  "Genetic data" means any data, regardless of
	format, concerning an individual's genetic characteristics. The
	term:
	(A)  includes:
	(i)  raw sequence data derived from
	sequencing all or a portion of an individual's extracted DNA;
	(ii)  genotypic and phenotypic information
	obtained from analyzing an individual's raw sequence data; and
	(iii)  health information regarding the
	health conditions that an individual self-reports to a company and
	that the company:
	(a)  uses for scientific research or
	product development; and
	(b)  analyzes in connection with the
	individual's raw sequence data; and
	(B)  does not include deidentified data.
	(7)  "Genetic testing" means a laboratory test of an
	individual's complete DNA, regions of DNA, chromosomes, genes, or
	gene products to determine the presence of the individual's genetic
	characteristics.
	(8)  "Person" means an individual, partnership,
	corporation, association, business, or business trust or the legal
	representative of an organization.
	Sec. 503A.002.  APPLICABILITY. (a) This chapter applies to
	a direct-to-consumer genetic testing company that:
	(1)  offers its products or services to individuals who
	are residents of this state; or
	(2)  collects, uses, or analyzes genetic data that:
	(A)  results from the company's products or
	services; and
	(B)  was provided to the company by an individual
	who is a resident of this state rather than by or at the direction of
	a health care provider.
	(b)  This chapter does not apply to:
	(1)  an entity only when they are engaged in
	collecting, using, or analyzing genetic data or biological samples
	in the context of research, as defined by 45 C.F.R. Section 164.501,
	that is conducted in accordance with:
	(A)  the federal policy for the protection of
	human subjects (45 C.F.R. Part 46);
	(B)  the good clinical practice guidelines issued
	by the International Council for Harmonisation of Technical
	Requirements for Pharmaceuticals for Human Use (ICH); or
	(C)  the United States Food and Drug
	Administration policy for the protection of human subjects (21
	C.F.R. Parts 50 and 56);
	(2)  genetic data that is protected health information
	collected by a covered entity or business associate, as defined by
	45 C.F.R. Part 160, subject to the privacy, security, and breach
	notification rules under the Health Insurance Portability and
	Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.);
	(3)  an institution of higher education or a private or
	independent institution of higher education, as those terms are
	defined by Section 61.003, Education Code;
	(4)  an entity when the entity is offering genetic
	testing products or services through a health care provider; or
	(5)  the collection, use, or analysis of genetic data
	by a health care provider.
	Sec. 503A.003.  EXCLUSIVE PROPERTY RIGHT IN DNA;
	CONFIDENTIALITY.  An individual has a property right in, and
	retains the right to exercise exclusive control over, the
	individual's biological sample that is provided to or used by a
	direct-to-consumer genetic testing company and the results of
	genetic testing or analysis conducted on the individual's DNA by a
	direct-to-consumer genetic testing company, including to the
	collection, use, retention, maintenance, disclosure, or
	destruction of the sample or results.  The results of the genetic
	testing of an individual's DNA are confidential and may not be
	disclosed to another person without the individual's express
	consent.
	Sec. 503A.004.  REQUIREMENTS FOR CERTAIN USES OF
	DEIDENTIFIED DATA. (a) Except as otherwise provided by this
	chapter or other law, a direct-to-consumer genetic testing company
	that possesses an individual's deidentified data shall:
	(1)  implement administrative and technical measures
	to ensure the data is not associated with a particular individual;
	and
	(2)  publicly commit to maintaining and using data in
	deidentified form and refraining from making any attempt to
	identify an individual using the individual's deidentified data.
	(b)  If a direct-to-consumer genetic testing company shares
	an individual's deidentified data with another person, the company
	shall enter into a legally enforceable contractual obligation
	prohibiting the person from attempting to identify an individual
	using the individual's deidentified data.
	Sec. 503A.005.  REQUIREMENTS FOR CERTAIN USES OR DISCLOSURE
	OF GENETIC DATA AND BIOLOGICAL SAMPLE. (a) A direct-to-consumer
	genetic testing company shall:
	(1)  develop, implement, and maintain a comprehensive
	security program to protect an individual's genetic data against
	unauthorized access, use, or disclosure; and
	(2)  make publicly available:
	(A)  a high-level privacy policy overview that
	includes basic, essential information about the company's
	collection, use, or disclosure of genetic data; and
	(B)  a prominent privacy notice that includes
	information about the company's data collection, consent, use,
	access, disclosure, transfer, security, retention, and deletion
	practices.
	(b)  Before collecting, using, or disclosing an individual's
	genetic data, a direct-to-consumer genetic testing company shall
	provide to the individual information about the company's
	collection, use, and disclosure of genetic data the company
	collects through a genetic testing product or service, including
	information that:
	(1)  clearly describes the company's use of the genetic
	data;
	(2)  specifies the persons who have access to test
	results; and
	(3)  specifies the manner in which the company may
	share the genetic data.
	(c)  A direct-to-consumer genetic testing company shall
	provide a process for an individual to:
	(1)  access the individual's genetic data;
	(2)  delete the individual's account and genetic data;
	and
	(3)  destroy or require the destruction of the
	individual's biological sample.
	Sec. 503A.006.  REQUIRED CONSENT. (a)  A direct-to-consumer
	genetic testing company engaging in any of the following activities
	must obtain:
	(1)  an individual's separate express consent for:
	(A)  the transfer or disclosure of the
	individual's genetic data to any person other than the company's
	vendors and service providers;
	(B)  the use of genetic data for a purpose other
	than the primary purpose of the company's genetic testing product
	or service; or
	(C)  the retention of any biological sample
	provided by the individual following the company's completion of
	the initial testing service requested by the individual;
	(2)  an individual's informed consent in accordance
	with guidelines for the protection of human subjects issued under
	45 C.F.R. Part 46, for transfer or disclosure of the individual's
	genetic data to a third party for:
	(A)  research purposes; or
	(B)  research conducted under the control of the
	company for the purpose of publication or generalizable knowledge;
	and
	(3)  an individual's express consent for:
	(A)  marketing by the company to the individual
	based on the individual's genetic data; or
	(B)  marketing by a third party to the individual
	based on the individual's ordering or purchasing of a genetic
	testing product or service.
	(b)  For purposes of Subsection (a), "marketing" does not
	include providing customized content or offers to an individual
	with whom a direct-to-consumer genetic testing company has a
	first-party relationship on the company's Internet website or
	through an application or service provided by the company to the
	individual.
	Sec. 503A.007.  PROHIBITED DISCLOSURES. (a) A
	direct-to-consumer genetic testing company may not disclose an
	individual's genetic data to a law enforcement entity or other
	governmental body unless:
	(1)  the company first obtains the individual's express
	written consent; or
	(2)  the entity or body obtains a warrant or complies
	with another valid legal process required by the company.
	(b)  A direct-to-consumer genetic testing company may not
	disclose, without first obtaining an individual's written consent,
	the individual's genetic data to:
	(1)  an entity that offers health insurance, life
	insurance, or long-term care insurance; or
	(2)  an employer of the individual.
	Sec. 503A.008.  CIVIL PENALTY. (a)  A direct-to-consumer
	genetic testing company that violates this chapter is liable to
	this state for a civil penalty in an amount not to exceed $2,500 for
	each violation.
	(b)  The attorney general may bring an action to recover a
	civil penalty imposed under Subsection (a) and to restrain and
	enjoin a violation of this chapter.  The attorney general may
	recover reasonable attorney's fees and court costs incurred in
	bringing the action.
	SECTION 2.  The changes in law made by this Act apply only to
	genetic information obtained on or after the effective date of this
	Act.
	SECTION 3.  This Act takes effect September 1, 2023.
	______________________________	______________________________
	President of the Senate	Speaker of the House
	I certify that H.B. No. 2545 was passed by the House on April
	28, 2023, by the following vote:  Yeas 144, Nays 0, 2 present, not
	voting; and that the House concurred in Senate amendments to H.B.
	No. 2545 on May 17, 2023, by the following vote:  Yeas 146, Nays 0,
	1 present, not voting.
	______________________________
	Chief Clerk of the House
	I certify that H.B. No. 2545 was passed by the Senate, with
	amendments, on May 15, 2023, by the following vote:  Yeas 31, Nays
	0.
	______________________________
	Secretary of the Senate
	APPROVED: __________________
	Date
	__________________
	Governor