Genetic testing companies must explain and protect residents’ data

Companies must give consumers plain-language privacy information and get written consent for collecting, sharing, or using genetic data. These rules cover companies offering genetic tests directly to South Dakota residents and certain companies handling data from those tests. Separate consent is required for transfers beyond company vendors and service providers, uses beyond the testing service, keeping samples after testing, research, and specified marketing. No start date is stated in the supplied text.

Companies must protect genetic data and offer ways to access or delete it, destroy samples, and revoke consent. These rules cover direct-to-consumer genetic testing companies and the South Dakota consumers whose genetic data or biological samples they hold. Companies must honor revoked consent within 30 days. If consent to store a biological sample is revoked, the company must destroy it within 30 days. The 30-day period starts when the company receives a revocation of consent.

Contracted service providers must follow the same confidentiality duties, and the attorney general may seek a court-imposed civil penalty. Confidentiality duties cover contracted service providers holding samples, genetic data, or information identifying a consumer. A penalty requires a court petition and may not exceed $5,000 per violation. The rules in sections 2 to 5 do not apply to listed medical, education, law enforcement, research, and hospital activities. No start date is stated in the supplied text.