Wyoming Enacts Genetic Data Privacy Act

On March 8, 2022, Wyoming Governor Mark Gordon signed the Wyoming Genetic Data Privacy Act (“HB 0086” or “Act”) into law. 

Provisions of the Act

Under the Act, any person who conducts an individual’s genetic testing, or obtains, retains, or discloses the information stemming from of individuals will be required to:

• Safeguard the individual consumer’s privacy, confidentiality, security and integrity by:

  • Providing the consumer with clear and complete information on the organization’s policies and procedures governing the collection, use, and disclosure of individual’s genetic data;

  • Providing individuals with a public privacy notice that provides information on the “company's data collection, consent, use, access, disclosure, transfer, security and retention and deletion practices”;

  • Obtaining the following forms of consumer consent regarding the “collection, use, or disclosure” of their genetic data:

    • Initial express consent that explains the use of the data and who may access  genetic testing results and whether those data results may be shared;

    • Separate express consent if the company intends to transfer or disclose the consumer’s genetic data to any person other than the company’s vendors or service provides or use the data for any purpose other than the “inherent contextual uses”;

    • Separate express consent if the company intends to retain the consumer’s biological samples after the initial testing service requested by the consumer is completed;

    • Informed consent in accordance to federal policy, 45 C.F.R. § 46, if the company  intends to transfer or disclose the consumer’s genetic data to third party persons to conduct research or to utilize the data for “publication or generalizable knowledge”; and

    • Separate express consent for marketing to another consumer by use of the consumer’s genetic data. 

  • Developing and maintaining a comprehensive security program to protect the consumer’s genetic data from unauthorized access, use, or disclosure;

  • Providing a consumer the right to access the consumer's genetic data, delete the consumer's account and the stored genetic data, and request and obtain the destruction of the consumer's biological sample;

The Act permits individuals who have their rights violated under these provisions to bring a civil action to enjoin or restrain violations from continuing and seek damages for violations committed. Prior to bringing an action against the violating company, the individual is required to notify the company about the alleged violation, and the company will have 60 days to cure the violation and, as a result of the cure, prevent the individual from filing suit.

In addition, the attorney general of Wyoming (“AG”)  may bring an action on behalf of the state or the consumer who has been violated. If the AG determines that a violation has occurred, a civil penalty of $2,500 may be attached for each violation.

Considerations for Covered Companies

This Act is set to go into effect July 1, 2022. As such, covered companies should review their policies and procedures against these statutory requirements to ensure compliance.