§ 35-32-102 — Genetic testing; prohibitions; exceptions

(a) Except as provided in subsection (b) of this section,
no person conducting genetic testing shall do any of the
following without the informed consent of the individual or the
individual's authorized representative:
(i) Obtain an individual's genetic data;
(ii) Perform genetic testing on an individual;
(iii) Retain an individual's genetic data;
(iv) Disclose an individual's genetic data.
(b) Except as otherwise prohibited by law, an individual's
genetic data may be obtained, retained, disclosed and used
without informed consent for:
(i) Disclosures to the individual or the individual's
authorized representative;
(ii) Law enforcement purposes otherwise authorized by
law;
(iii) The state DNA database created by W.S. 7-19-402
or the comparable provisions of another jurisdiction;
(iv) The registration of sex offenders pursuant to
W.S. 7-19-302;
(v) Determining paternity in accordance with a court
or administrative order;
(vi) Determining the identity of a deceased
individual;
(vii) Newborn screening requirements under W.S.
35-4-801;
(viii) The provision of emergency medical treatment;
(ix) Complying with an order of a court of competent
jurisdiction;
(x) Anonymous research where the identity of the
individual will not be released;
(xi) Services limited to storage, retrieval, handling
or transmission of genetic data by a third party service
provider pursuant to a contract or other obligation;
(xii) Diagnosis or treatment of the individual if
performed by a clinical laboratory that has received a specimen
referral from the individual's treating physician or another
clinical laboratory. Nothing in this paragraph shall be deemed
to waive the requirement that a treating physician obtain
specific informed consent for the taking of a specimen when
required.
(c) To safeguard the privacy, confidentiality, security
and integrity of a consumer's genetic data, a direct to consumer
genetic testing company shall:
(i) Provide clear and complete information regarding
the company's policies and procedures for the collection, use or
disclosure of genetic data by making available to a consumer:
(A) A high-level privacy policy overview that
includes essential information about the company's collection,
use or disclosure of genetic data; and
(B) A prominent, publicly available privacy
notice that includes, at a minimum, information about the
company's data collection, consent, use, access, disclosure,
transfer, security and retention and deletion practices.
(ii) Obtain a consumer's consent for the collection,
use or disclosure of the consumer's genetic data including, at a
minimum:
(A) Initial express consent that describes the
uses of the genetic data collected through the genetic testing
product or service, and specifies who has access to test results
and how the genetic data may be shared;
(B) Separate express consent for transferring or
disclosing the consumer's genetic data to any person other than
the company's vendors and service providers, or for using
genetic data beyond the primary purpose of the genetic testing
product or service and inherent contextual uses;
(C) Separate express consent for the retention
of any biological sample provided by the consumer following
completion of the initial testing service requested by the
consumer;
(D) Informed consent in compliance with the
federal policy for the protection of human research subjects, 45
C.F.R. § 46, for transfer or disclosure of the consumer's
genetic data to third party persons for research purposes or
research conducted under the control of the company for the
purpose of publication or generalizable knowledge; and
(E) Separate express consent for marketing to a
consumer based on the consumer's genetic data, or for marketing
by a third party person to a consumer based on the consumer
having ordered or purchased a genetic testing product or
service. Marketing does not include the provision of customized
content or offers on the websites or through the applications or
services provided by a direct to consumer genetic testing
company with a first-party relationship to the customer.
(iii) Require valid legal process for disclosing
genetic data to law enforcement or any other government agency
without a consumer's express written consent;
(iv) Develop, implement and maintain a comprehensive
security program that protects a consumer's genetic data against
unauthorized access, use or disclosure; and
(v) Provide a process for a consumer to:
(A) Access the consumer's genetic data;
(B) Delete the consumer's account and genetic
data; and
(C) Request and obtain the destruction of the
consumer's biological sample.
(d) Notwithstanding any other provisions in this section,
a direct to consumer genetic testing company shall not disclose
a consumer's genetic data to any entity offering health
insurance, life insurance or long-term care insurance, or to any
employer of the consumer without the consumer's written consent.