Law note · Utah
Genetic Information Privacy Act
Binds a direct-to-consumer genetic testing company, an entity that offers genetic testing products or services to consumers or that collects, uses, or analyzes genetic data a consumer provides. Requires a public privacy notice and the consumer's initial express consent to collect, use, or disclose genetic data, plus separate express consent to transfer or disclose the data beyond the company's vendors, to use it beyond the primary testing purpose, or to retain a biological sample after testing.
Requires valid legal process for law-enforcement disclosure absent express written consent, a comprehensive security program, and a process for a consumer to access their genetic data, delete their account and data, and have their biological sample destroyed. Bars disclosure to health, life, or long-term-care insurers or to the consumer's employer without written consent. Originally enacted in 2021 (Chapter 361), renumbered and amended into its current Part 1 structure in 2023 (Chapter 327).
What it asks of an app
- Obtain a Utah consumer's initial express consent before collecting, using, or disclosing their genetic data through a direct-to-consumer genetic testing product or service, and give them a public privacy notice describing your data practices.
- Obtain separate express consent before transferring genetic data outside your vendors, using it beyond the primary testing purpose, or retaining a biological sample after testing.
- Let a Utah consumer access their genetic data, delete their account and genetic data, and have their biological sample destroyed on request.
- Do not disclose a Utah consumer's genetic data to a health, life, or long-term-care insurer, or to the consumer's employer, without the consumer's written consent.
When LexLint raises it
Declared activities: processes_biometrics, trains_models
Primary source: official Utah Code text, Utah State Legislature