HB21 Alabama 2024 Session

Summary

Primary Sponsor

Chip BrownRepresentative

Republican

Session

Regular Session 2024

Title

Genetic Testing Companies, requiring consent to release customers' genetic data

Summary

HB21 creates the Alabama Genetic Data Privacy Act, requiring express consent to collect, use, or share genetic data and enabling penalties for violations.

What This Bill Does

It requires genetic testing companies to clearly display privacy information and obtain express consent for collecting, using, retaining, and disclosing genetic data. It sets rules about who may access data, retention for future testing, and transfers to third parties, including prohibiting certain disclosures without consent. It gives consumers rights to access their data, delete their account, destroy samples and data, and revoke consent, with enforcement by the Attorney General and civil penalties up to $3,000 per violation. It also outlines exemptions for certain research, law enforcement, and health care providers, and requires contractors to follow the same privacy obligations.

Who It Affects

• Alabama residents who use genetic testing services, who gain explicit rights over their genetic data and control over how it is used and shared.
• Genetic testing companies and their contractors, who must obtain express consent, display privacy policies, limit data use, and face penalties for violations.

Key Provisions

• Defines key terms: biological sample, consumer, contractor, deidentified data, express consent, and genetic data.
• Genetic testing companies must prominently display privacy policies, including an overview, full policy text, deidentified data sharing notices, and a complaint process.
• Obtain initial express consent for: (a) using data to fulfill the consumer's order; (b) identifying who may access the data and including contractors; (c) retaining samples/data for future testing; (d) future transfer/disclosure to third parties.
• Obtain express consent each time for: (a) transferring data to a third party for reasons other than fulfillment; (b) using data for purposes other than the ordered services; (c) marketing based on genetic data (with certain marketing exclusions).
• Require informed consent for transfers for independent or company-sponsored research and development or publication purposes.
• Provide a consumer process to access data, delete accounts, request destruction of samples/data, and revoke consent; destruction within 30 days; return of data/samples within 60 days after revocation when applicable.
• Prohibit disclosure of genetic data to health insurers or employers without consumer consent; allow law enforcement disclosure only under valid legal process and with limited transparency.
• Contractors must keep consumer data confidential and follow the same restrictions as the genetic testing company; data handling is limited to service purposes.
• Exemptions include HIPAA-covered entities, noncommercial research by educational institutions, and lawful law enforcement collection.
• Enforcement by the Attorney General's Consumer Division; civil penalties up to $3,000 per violation; restitution and attorney fees may be awarded in settlements; consumers can file complaints with the AG.
• Effective date: October 1, 2024.

AI-generated summary using openai/gpt-5-nano on Feb 22, 2026. May contain errors — refer to the official bill text for accuracy.

Subjects

Consumer Protection