An act relating to genetic data privacy
H.639 creates the “Genetic Information Privacy Act” and establishes a new privacy framework for direct-to-consumer genetic testing companies and related service providers. The bill requires these companies to give Vermonters clear, plain-language disclosures about how genetic data is collected, used, stored, shared, transferred, and deleted, and to obtain express, separate consent for key activities such as use beyond the primary testing purpose, storage of biological samples, third-party disclosures, and marketing based on genetic data. It also requires easy mechanisms to revoke consent, access or delete genetic data, and request destruction of biological samples.
The bill further limits how genetic data may be shared or stored, including restrictions on storage in sanctioned or foreign-adversary countries and on transfer outside the United States without express consent. It bars disclosure of genetic data to insurers, employers, and certain government entities except under narrow conditions, and it prohibits discrimination against consumers for exercising their rights under the act. Enforcement is tied to Vermont’s unfair-and-deceptive-acts-in-commerce law, with authority given to the Attorney General and a private right of action for consumers after notice and an opportunity to cure. The bill also includes exemptions for HIPAA-covered entities, certain research and educational activities, disease-diagnostic testing, and workplace safety compliance, and it gives the stricter privacy rule control in the event of conflict with other laws.
H.639 would add a new subchapter to Title 9 governing genetic information privacy and would directly regulate direct-to-consumer genetic testing companies, their service providers, and any other entities handling consumer genetic data from those services. It would create new statutory duties around notice, consent, data security, deletion, sample destruction, marketing disclosures, cross-border transfers, nondiscrimination, and limits on disclosure to insurers, employers, and government entities. Violations would be treated as unfair and deceptive acts in commerce, expanding the Attorney General’s enforcement tools and allowing consumer lawsuits after a statutory notice-and-cure process. The bill’s exemptions preserve existing federal privacy regimes like HIPAA and research protections, while making Vermont’s law the controlling standard where it offers greater privacy protection.
The bill’s overall posture is strongly privacy-protective and consumer-focused, with the stated purpose of safeguarding Vermonters’ genetic information from misuse and unwanted sharing. The text reflects an intent to give consumers meaningful control over highly sensitive data and to impose clear obligations on companies operating in the direct-to-consumer genetics market. No committee transcripts or recorded votes were provided, so there is no documented floor or committee sentiment beyond the bill’s protective framing and the breadth of its sponsor list.
The main points of potential contention are the bill’s broad consent and disclosure requirements, its restrictions on marketing and third-party data sharing, and its limits on storage and transfer outside the United States. Companies in the direct-to-consumer genetics industry may view the compliance obligations as burdensome, especially the separate-consent structure, deletion and destruction requirements, and the prohibition on certain disclosures to insurers, employers, and government entities absent a warrant or consent. Another likely area of debate is the private right of action and notice-and-cure mechanism, which can affect litigation exposure and enforcement leverage. At the same time, the bill contains significant carve-outs for HIPAA-regulated entities, research institutions, and diagnostic testing, suggesting an effort to balance privacy protections with medical, research, and workplace needs.