Virginia Code 59.1-596: Express consent required; revocation of express consent
A. Express consent required pursuant to this chapter requires a statement of the nature of the data collection, use, maintenance, or disclosure for which express consent is sought in plain and prominent language that an ordinary consumer would notice and understand and an affirmative authorization by the consumer granting permission in response to such statement. Express consent shall not be inferred from inaction.
Terms Used In Virginia Code 59.1-596
- Affirmative authorization: means an action that demonstrates an intentional decision by a consumer. See Virginia Code 59.1-593
- Biological sample: means any material part of the human, discharge therefrom, or derivative thereof, such as tissue, blood, urine, or saliva, known to contain deoxyribonucleic acid (DNA). See Virginia Code 59.1-593
- Consumer: means a natural person who is a resident of the Commonwealth. See Virginia Code 59.1-593
- Direct-to-consumer genetic testing company: means an entity that (i) offers consumer-initiated genetic testing products or services directly to a consumer or (ii) collects, uses, or analyzes genetic data that is collected or derived from a direct-to-consumer genetic testing product or service and is directly provided by a consumer. See Virginia Code 59.1-593
- Express consent: means a consumer's affirmative authorization to grant permission in response to a clear, meaningful, and prominent notice regarding the collection, use, maintenance, or disclosure of genetic data for a specific purpose. See Virginia Code 59.1-593
- Genetic data: includes uninterpreted data that results from the analysis of the biological sample and any information extrapolated, derived, or inferred therefrom. See Virginia Code 59.1-593
- Genetic testing: means any laboratory test of a biological sample from a consumer for the purpose of determining information concerning genetic material contained within the biological sample, or any information extrapolated, derived, or inferred therefrom. See Virginia Code 59.1-593
- Service provider: means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners that is involved in (i) the collection, transportation, and analysis of the consumer's biological sample or extracted genetic material (a) on behalf of the direct-to-consumer genetic testing company or (b) on behalf of any other company that collects, uses, maintains, or discloses genetic data collected or derived from a direct-to-consumer genetic testing product or service or directly provided by a consumer or (ii) the delivery of the results of the analysis of the biological sample or genetic material. See Virginia Code 59.1-593
B. Every direct-to-consumer genetic testing company shall obtain a consumer’s express consent for the collection, use, and disclosure of the consumer’s genetic data, including, at a minimum, separate and express consent for each of the following:
1. The use of genetic data collected through the genetic testing product or service offered to the consumer. Express consent for such use of genetic data shall include a statement describing who will receive access to the genetic data, how such genetic data will be shared, and the purposes for which such data shall be collected, used, and disclosed;
2. The storage of a consumer’s biological sample after the initial testing required by the consumer has been completed;
3. Each use of genetic data or the biological sample beyond the primary purpose of the genetic testing or service and inherent contextual uses;
4. Each transfer or disclosure of the consumer’s genetic data or biological sample to a third party other than a service provider, including the name of the third party to which the consumer’s genetic data or biological sample will be transferred or disclosed; and
5. Any marketing or facilitation of marketing to a consumer based on the consumer’s genetic data or marketing or facilitation of marketing by a third party based on the consumer’s having ordered, purchased, received, or used a genetic testing product or service, except that a direct-to-consumer genetic testing company shall not be required to obtain a consumer’s express consent to marketing to the consumer on the company’s own website or mobile application based on the consumer having ordered, purchased, received, or used a genetic testing product or service from that company if (i) the advertisement does not depend on any information specific to that consumer other than information regarding the product or service that the consumer ordered, purchased, received, or used; (ii) the placement of the advertisement does not result in disparate exposure to advertising content on the basis of the sex, race, color, religion, ancestry, national origin, disability, medical condition, genetic data, marital status, sexual orientation, citizenship, primary language, or immigration status of the consumer; and (iii) the advertisement of a third-party product or service is clearly labeled as advertising content, is accompanied by the name of the third party that has contributed to the placement of the advertisement, and, if applicable, indicates that the advertised product or service and claims regarding the product or service have not been vetted or endorsed by the direct-to-consumer genetic testing company.
C. Every direct-to-consumer genetic testing company shall provide a mechanism by which a consumer may revoke the express consent required pursuant to subsection B, which shall include an option for revocation of express consent through the primary medium through which the company communicates with consumers.
D. Upon revocation of the express consent required pursuant to subsection B by a consumer, a direct-to-consumer genetic testing company shall (i) honor such revocation of express consent as soon as is practicable but in all cases within 30 days of receipt of such revocation and (ii) destroy the consumer’s biological sample within 30 days of receipt of revocation of the consumer’s express consent to store such sample.
2023, c. 526.