HB1530, titled the Genetic Information Privacy Act, regulates direct-to-consumer genetic testing companies that collect, analyze, use, or disclose consumers’ genetic data in Pennsylvania. The bill requires these companies to provide clear privacy information, including a high-level overview and a public privacy notice describing collection, consent, disclosure, retention, deletion, and security practices. It also requires express consumer consent for key uses and disclosures of genetic data, including sharing with third parties beyond vendors/service providers, using data beyond the primary testing purpose, retaining biological samples after testing, research-related disclosures, and marketing based on genetic data.
The bill further limits disclosure of genetic data to law enforcement or government entities unless there is valid legal process or the consumer gives express written consent. It gives consumers the right to access their genetic data, delete their account and data, and request destruction of their biological sample. The measure also bars disclosure of genetic data to health, life, or long-term care insurers and to employers without written consent, and it authorizes the Attorney General to enforce the law through civil actions and penalties of $2,500 per violation, plus actual damages and fees. The act would take effect 60 days after enactment and does not apply to HIPAA-covered health information, certain law-enforcement crime-scene samples, or unidentified deceased persons used for identification.
The bill’s impact on state law would be to create a new privacy framework specifically for direct-to-consumer genetic testing firms operating in Pennsylvania, adding statutory duties around notice, consent, security, retention, deletion, and disclosure limits. It would also establish a state enforcement mechanism through the Office of Attorney General and create civil liability for violations. In practical terms, it would affect genetic testing companies, consumers who use at-home DNA services, insurers, employers, researchers receiving data, and government agencies seeking access to genetic information.
The overall sentiment reflected in the voting history is strongly supportive and noncontroversial. The bill advanced unanimously in the House Consumer Protection, Technology & Utilities Committee, unanimously again in House Appropriations, and then passed the House floor with 203 yeas and no nays. There is no committee transcript available, but the recorded votes suggest broad bipartisan agreement that genetic data deserves heightened privacy protections.
The main points of contention, based on the bill text rather than recorded debate, would likely concern the scope of consent requirements, limits on research and marketing uses, and restrictions on disclosure to law enforcement, insurers, and employers. Companies in the direct-to-consumer genetics industry may view the bill as imposing significant compliance obligations, while consumer privacy advocates would likely support the added safeguards. The bill also draws a clear line between consumer genetic testing services and HIPAA-regulated health information, which helps narrow its reach but may raise questions about edge cases involving research, data sharing, and deidentification.
HB1530 would add a new chapter of consumer privacy obligations for direct-to-consumer genetic testing companies in Pennsylvania, requiring notice, express consent, security safeguards, consumer access and deletion rights, and limits on disclosure of genetic data. It would prohibit disclosure to insurers and employers without written consent, restrict government access absent valid legal process or consent, and authorize the Attorney General to enforce the law through civil actions, penalties, damages, and attorney fees. The bill would not apply to HIPAA-covered protected health information, certain law-enforcement samples, or unidentified deceased persons used for identification.
No formal debate transcript is available, so specific objections are not recorded. Based on the bill’s provisions, the most likely areas of contention are the breadth of consent requirements, restrictions on sharing genetic data for research or marketing, and the limits on disclosure to law enforcement, insurers, and employers. Direct-to-consumer genetic testing companies may also be concerned about compliance costs and enforcement exposure, while privacy advocates would likely favor the bill’s stronger restrictions and consumer control provisions.