Nebraska lawmaker proposes stronger protections for consumer genetic testing

LINCOLN — Nebraskans would have greater control of their genetic information used in testing services such as 23andMe and Ancestry through a legislative proposal.

Legislative Bill 308, proposed by State Sen. Eliot Bostar of Lincoln, would create the Genetic Information Privacy Act. The bill would add consumer protections for Nebraskans, addressing how companies collect, analyze, store, share or sell genetic information.

Bostar told the Banking, Commerce and Insurance Committee on Tuesday that policymakers and top companies drafted model language in 2018 for direct-to-consumer testing services. He said his bill would require express consent before genetic information is shared.

Arizona, California, Kentucky, Maryland, Utah and Wyoming have adopted similar legislation.

“Companies like Ancestry and 23andMe have good reason to support increased consumer privacy protections,” Bostar said. “Their business models depend on consumer trust.”

Consumers would be in control of their genetic data “at all times,” Bostar said of his bill, and companies would need to allow consumers to delete their data and close their accounts “without unnecessary steps.”

The consumer’s biological sample would need to be deleted within 30 days of a request, and companies would need to detail their complete privacy practices and protocols. Companies would also be prohibited from sharing data with employers or insurance providers.

“As direct-to-consumer genetic testing grows in popularity, it is becoming increasingly important to pass regulatory guardrails to protect the privacy of Nebraska consumers,” Bostar said.

Ritchie Engelhardt, head of government affairs for Ancestry, told the committee Ancestry and 23andMe have adhered to strict collection, processing and sharing of data. He said Bostar’s bill would ensure every testing service is held to those same standards.

“If people do not trust that we are employing privacy safeguards and data protection safeguards, they simply won’t use our services,” Engelhardt said.

Engelhardt added privacy violations are shared multiple times creeping into the millions, not just once, and Bostar’s bill would allow the Nebraska Attorney General’s Office to investigate and level a civil penalty of $2,500 for each violation.

Jane Seu, legal and policy counsel for the ACLU of Nebraska, said there is “nothing more private” than personal medical or genetic information, and control has become increasingly important as more people sequence their data and as records become digitized.

She said the bill would provide “an extra layer of protection” for consumers.

Bostar said one in five Americans has taken a genetic test, which includes family health, ethnic and cultural backgrounds.

Engelhardt told the committee the easiest way for consumers to know whether their information has been stolen or sold is through targeted advertising.

Genetic information, such as DNA, has also been used to solve cold cases, such as the Golden State Killer, and led to the arrest of the man suspected of the November killings of four University of Idaho students.

Neither Ancestry nor 23andMe has a way to upload a genetic profile or allow law enforcement to do searches on the databases, and Engelhardt said consumers would need to opt in for law enforcement to have access without a warrant or subpoena.

“All of the data that law enforcement uses in cold case investigations is consented data for that purpose,” he said. “The people to whom that data pertains and said, ‘I am OK with you using it for this purpose if it gets a bad guy off the streets.’”

Bostar’s bill would address growing privacy concerns with commercial services, whereas traditional genetic testing administered by health care providers is extensively regulated already.

“I think it’s a common-sense protection for Nebraskans,” Bostar said.