Privacy Law Library

Maryland Genetic Information Privacy law (direct-to-consumer genetic testing)

MD Genetic Information Privacy

Genetic

Enacted by 2022 Md. Laws ch. 501 (HB 866), this law requires direct-to-consumer genetic testing companies to publish clear privacy information, obtain separate express consents for each use, transfer, sample retention, and marketing, secure genetic data, and let consumers access and delete their data and have samples destroyed. It bars disclosure to insurers or employers without written consent. The same act also regulated forensic genetic genealogy in the Criminal Procedure Article.

Where

Maryland

Citation

Md. Code, Com. Law §§ 14-4401 to 14-4408

Status

In force

In force since

2022-10-01

Enforced by

Consumer Protection Division, Office of the Attorney General (14-4406; Com. Law 13-301(14)(xxxvi))

People can sue

Yes

Penalties

A violation is an unfair, abusive, or deceptive trade practice subject to Title 13 enforcement and penalties (14-4406(a)), including civil penalties up to $10,000 per violation ($25,000 repeat) under 13-410 and the private action under 13-408; other remedies are preserved (14-4406(b)).

Applies to

• Direct-to-consumer genetic testing companies: entities that offer genetic testing directly to consumers or that collect, use, or analyze genetic data from a DTC test provided to them by a consumer (14-4401(d))
• Does not apply to HIPAA PHI held by covered entities or business associates, or to genetic data or samples collected for research conducted under the Common Rule, ICH GCP, or FDA human-subjects rules (14-4402)