An act relating to genetic data privacy

The official version removes the warrant requirement that prohibited genetic testing companies from disclosing any information about a consumer (including genetic data or name) to a government entity without a search warrant issued on probable cause or the consumer's express consent. The nondisclosure section is now limited only to prohibiting disclosure to insurance and employment decision-makers.

The detailed definition of 'biometric data' (including sub-parts listing iris scans, fingerprints, facial mapping, vein patterns, voice prints, gait patterns, and exclusions for photographs and recordings) was removed from the definitions section. The terms 'biometric data' and 'biometric samples' still appear in the requirements section but are no longer defined in this act.

The service provider definition was narrowed by changing 'collection, transportation, or analysis' to 'collection, transportation, and analysis,' meaning an entity must be involved in all three activities (rather than any one of them) to qualify as a service provider under this act.

A new exception for 'inherent contextual uses' was added to the consent requirement. Companies no longer need separate express consent for each use of genetic data beyond the primary purpose if that use qualifies as an 'inherent contextual use,' though this term is not defined in the act.

The standard for consent revocation mechanisms changed from requiring the mechanism to be 'at least as easy as the mechanism by which the consumer provided the consent' to requiring 'effective mechanisms, without any unnecessary steps.' The word 'withdraw' was also changed to 'revoke.'

Provisions requiring service providers to immediately destroy all retained genetic data upon contract termination and prohibiting them from disclosing, transferring, or selling genetic data before destruction were removed.

The official version adds a full introduction page listing all 24 sponsoring representatives, committee referral information, subject classification, and a statement of purpose. Section numbering was reorganized from 2421a through 2421d to 2411 through 2414.

A new definition for 'biometric data' was added, covering iris/retina scans, fingerprints, facial or hand mapping, vein patterns, voice prints, and gait patterns, with exclusions for photographs and audio/video recordings. This expands the types of data covered by the act.

The definition of 'service provider' was changed from entities involved in 'collection, transportation, and analysis' to 'collection, transportation, or analysis,' broadening which entities qualify as service providers subject to the act's contract requirements.

The consent revocation standard was changed. The official version required mechanisms 'without any unnecessary steps,' while the unofficial version requires mechanisms that are 'at least as easy as the mechanism by which the consumer provided the consent.' This shifts from a general ease-of-use standard to a symmetry standard.

The express consent requirement in subsection (a)(2)(C) was narrowed in scope: the official version required consent for uses 'beyond the primary purpose of the genetic testing or service and inherent contextual uses,' while the unofficial version removes 'and inherent contextual uses,' meaning consumers must give express consent for a broader range of secondary uses.

Section numbers were renumbered from 2411-2414 to 2421a-2421d (and presumably 2421c-2421d) to fit within the existing 9 V.S.A. chapter 61 structure rather than creating standalone sections.

A new government warrant requirement prohibits direct-to-consumer genetic testing companies from disclosing any information about a consumer (including genetic data or name) to a government entity without either a search warrant issued by a court on probable cause or the consumer's express consent after being notified of the request.

A new 30-day cure period requires consumers to send written notice of an alleged violation to the company before filing a private civil action. The company has 30 days to cure the violation. This provision is temporary and will be repealed on June 30, 2028.

The consent revocation standard was changed from requiring 'effective mechanisms, without any unnecessary steps' to requiring the revocation mechanism be 'at least as easy as the mechanism by which the consumer provided the consent.' This ties the ease of opting out directly to the ease of opting in.

A new requirement obligates companies to notify any third party that received a consumer's genetic data or biological sample within 30 days when the consumer requests deletion of their data or destruction of their sample.

A new definition for 'biometric data' was added, covering iris/retina scans, fingerprints, facial or hand mapping, vein patterns, voice prints, and gait patterns, with exclusions for photographs and audio/video recordings unless generated to identify a specific consumer.

The service provider definition was broadened by changing 'collection, transportation, and analysis' to 'collection, transportation, or analysis,' meaning an entity involved in only one of those activities now qualifies as a service provider subject to the bill's contract requirements.

A new definition of 'biometric data' was added covering iris/retina scans, fingerprints, facial or hand mapping, vein patterns, voice prints, and gait patterns. It also clarifies what is excluded (photographs, audio/video recordings) unless used to identify a specific consumer.

The 'service provider' definition was broadened by changing 'collection, transportation, and analysis' to 'collection, transportation, or analysis,' meaning an entity involved in only one of those activities now qualifies as a service provider.

A new express consent requirement (subdivision E) was added requiring separate consent for marketing to a consumer based on their genetic data, or for third-party marketing based on the consumer having ordered, purchased, received, or used a genetic testing product or service.

New advertising labeling rules require that third-party ads shown to consumers be prominently labeled as advertising, include the name of any third party that contributed to placement, and clearly state if the advertised product has not been vetted or endorsed by the genetic testing company.

The consent revocation standard was changed from 'without any unnecessary steps' to a more specific requirement that the withdrawal mechanism be 'at least as easy as the mechanism by which the consumer provided the consent.'

The storage location restriction in subdivision (d)(2) was changed from protecting 'genetic data and biometric samples' to 'genetic data and biological samples,' aligning the protected category with the defined term used elsewhere in the bill.

A new government access requirement was added: a company shall not disclose any information about a consumer (including genetic data or name) to a government entity without either a search warrant issued on probable cause or the consumer's express consent after being notified by the company. The section title was changed from 'Nondisclosure' to 'Nondisclosure and warrant requirement.'

All section numbers were renumbered from 2411-2414 to 2421a-2421d, indicating the bill was placed in a different part of Title 9.