HB21 Summary: Alabama Genetic Data Privacy Act

• Requires genetic testing companies to prominently display privacy policies covering collection, use, maintenance, and disclosure of genetic data in plain language.

• Mandates companies obtain express written consent from Alabama consumers before using biological samples or genetic data, with separate consent required each time data is transferred to third parties or used for new purposes.

• Prohibits companies from disclosing genetic data to insurers, employers, or prospective employers without express written consent.

• Requires companies to provide consumers processes to access, delete, or request destruction of their genetic data within 30 days, and to return transferred data within 60 days if consent is revoked.

• Authorizes the Attorney General to enforce violations through civil action in circuit court with penalties up to $3,000 per violation; effective October 1, 2024.