Genomic Data Protection Act

The Genomic Data Protection Act (S 5433) gives consumers who use direct-to-consumer genetic testing services (like 23andMe or AncestryDNA) greater control over their genomic data and biological samples. It requires companies to provide clear options for consumers to access their data, delete their accounts (including associated genomic data), and request destruction of physical samples like saliva, with responses required within 30 days. Companies must also notify consumers clearly about data-sharing practices - especially regarding deidentified data used for research - and give advance notice (30+ days) if the company is sold or acquired. The Federal Trade Commission enforces these rules under existing laws, with exceptions for legally required data retention (e.g., court orders), and explicitly excludes healthcare providers performing medical diagnoses from the law's scope.