HF1520 Summary

• Creates Genetic Information Privacy Act requiring direct-to-consumer genetic testing companies operating in Minnesota to provide clear privacy policies and obtain express written consent before collecting, using, or disclosing genetic data.

• Mandates separate express consent for each data transfer to third parties, use beyond primary testing purposes, biological sample retention, research purposes, and marketing based on genetic data.

• Prohibits companies from disclosing genetic data to law enforcement without consumer consent except pursuant to valid search warrants or court orders, and absolutely prohibits disclosure to health insurers, life insurers, disability insurers, long-term care insurers, or employers.

• Requires companies to implement comprehensive security programs, provide consumers ability to access and delete their data and request sample destruction, and honor consent revocations within 30 days while destroying biological samples within 30 days of revocation.

• Applies service provider restrictions prohibiting retention or use of genetic data beyond specified services and imposes same confidentiality obligations on service providers as companies; enforced by Minnesota Commissioner of Commerce; excludes protected health information, higher education institutions, and federally-compliant research entities.