Search results for: genetic

I had very interesting conversations with both of my classes in the last week over the sharing of genetic information in the context of learning about the Genetic Information Non-Discrimination Act (GINA). GINA generally prohibits employers and insurers from using genetic information to discriminate in employment or insurance underwriting.

People mistaken believe that GINA protects the privacy of all genetic information. But it doesn’t. It only applies in very specific instances. When individuals take a swab from the inside of their mouth and send it to private companies for analysis to determine their ancestry or genetic predisposition, they are sending their DNA to a company that is not regulated like a doctor’s office or hospital. If an individual gets DNA testing at a doctor’s office or hospital, the doctor or hospital can perform the analysis, but then has very specific legal requirements on what they cannot do with the information, including disclose it to others or sell it.

Before you send that swab to a private company, take a look at their Privacy Policy so you are fully informed about what they are doing with the information, to who they are disclosing it, and to whom they are selling it. Try to determine how they can aggregate your genetic information with other information and if it can be disclosed to your life insurer, employer or law enforcement.

Here are some interesting articles to consider before you send that swab:

https://apple.news/A6vDj8z7GQFe6psTEYRZGTw

https://www.bloomberg.com/news/articles/2019-02-01/major-dna-testing-company-is-sharing-genetic-data-with-the-fbi

https://www.gsk.com/en-gb/media/press-releases/gsk-and-23andme-sign-agreement-to-leverage-genetic-insights-for-the-development-of-novel-medicines/

And you may wish to discuss this decision with the rest of your family, because when you send your genetic information to these companies, you are in effect sending your entire family’s as well without their consent.

House bill HR 1313, introduced by Representative Virginia Foxx (R-N.C.), proposes to allow companies to require employees to undergo genetic testing, then allow employers to see the results, and impose financial penalties on any employees who request to opt out of the requirement.

The bill, which was before the House Committee on Education and the Workforce, was supported by all 22 Republicans and opposed by all 17 Democrats on the Committee.

Those in support of the bill state that the legislation would give employers the ability to offer wellness plans and promote a healthy workforce and lower health care costs.

Critics say the bill would eviscerate the Genetic Information Non-Discrimination Act (GINA) and the Americans with Disabilities Act (ADA) which specifically prohibit employers from asking for, accessing or using genetic information for certain actions that are considered discriminatory.

We will be watching this bill closely.

Genetic information is basically one’s DNA sequence, which includes health information and genetic information about the individual and their family. It is at the core of one’s individual privacy, as well as providing information on family members. As technology advances, genetic testing is easier and cheaper to obtain, and there are numerous companies in the market that offer quick and cost-effective genetic testing. The ethics of genetic testing is outside the scope of this piece, but is interesting in its own right.

Vanderbilt University School of Medicine has announced that it received a four-year, $4 million grant from the National Institutes of Health to establish the Vanderbilt Center for Genetic Privacy and Identity in Community Settings, which will study privacy concerns associated with the use of genomic information.

According to Vanderbilt, the Center will “examine the likelihood that lapses in protecting genomic information allow people to be identified, how people perceive such risks, and how effective legal and policy efforts are in reducing them.” The Center’s goal is to develop policy recommendations about this complex area.

Why should we be concerned about the use of our genomic information? According to the Council for Responsible Genetics (www.councilforresponsiblegenetics.org), one reason why the use of genetic information is important is because of genetic discrimination. It documented over five hundred cases where the use of genetic information was used to deny individuals employment or health or life insurance. The Genetic Information Non-discrimination Act (GINA) was passed in 2008 to provide individuals protection from these types of discriminatory behaviors.

Genomic information is used by law enforcement to investigate crimes and DNA is now being used to exonerate those who have been wrongfully accused and imprisoned. Often, when one is accused of a crime, s/he is required to submit to a DNA test and has no choice, which was upheld by the U.S. Supreme Court in a 5-4 decision. The FBI’s National DNA Index System (NDIS) is a database that is populated with DNA samples of crime scenes, those arrested for crimes and those convicted of crimes. It holds millions of samples. And it doesn’t delete the samples of those arrested, but not convicted or of victims. Privacy advocates contend that the DNA samples can be used for other purposes—there are no rules around how the samples can be used by law enforcement once they have it, and that samples collected in a law enforcement setting should have privacy protections over how it is collected, maintained, stored, used and expunged.

Most concerning are the issues around surreptitious collection of DNA or genomic information. There is no federal law that prohibits surreptitious DNA testing. Some states have enacted legislation prohibiting the use and disclosure of genetic information, but not all. Further, when consumers send off a swab of the inside of their mouth to a private company to perform genetic testing, the company is not prohibited by law from using, selling or further disclosing the information as it is not covered by HIPAA and prohibited from doing so like your doctor or hospital is.

In fact, usually the individual has given consent to allow the company to use and disclose the information any way it sees fit somewhere in the fine print.

According to the Presidential Commission for the Study of Bioethical Issues’ publication “Privacy and Progress in Whole Genomic Sequencing,” one of the greatest concerns of the collection of genomic data is “Because whole genome sequence data provide important insights into the medical and related life prospects of individuals as well as their relatives–who most likely did not consent to the sequencing procedure–these privacy concerns extend beyond those of the individual participating in whole genome sequencing…data gathered now may well reveal important information, entirely unanticipated and unplanned for…”

Another privacy concern listed includes the potential for unauthorized access to and misuse of information. The example given is someone picking up a discarded coffee cup, sending the cup and saliva from the cup to a commercial lab to try to find out the person’s predisposition of a neurodegenerative disease and use it in a custody dispute, or expose it on social media to embarrass the individual or “adversely affect that individual’s chance of finding a spouse, achieving standing in the community, or pursuing a desired career path” or worse-like blackmail.

You might not have control over some collection of your DNA, but you do have control of giving your genomic information to commercial entities. Before you do, consider the impact of sharing your DNA with commercial entities and find out what you are consenting to before you send it. Your genomic information includes information about your family members too, so your decision may affect others. Be educated on how your genomic information will be used, sold or disclosed before you send it off and consent to its unlimited use. It may affect you or your children in the future.

It’s hard to believe that today’s post marks the publication of our 500th Privacy Tip. What a milestone!

We started publishing Tips because readers kept asking me about ways to protect themselves from scams, how to keep up with the latest threats, and how to stay informed about emerging technology. Feedback has been overwhelmingly positive, so we will continue publishing the Tips and helping readers navigate the technology landscape—an environment that often feels like the Wild West, with new developments emerging every day.

To commemorate the 500th Privacy Tip, I thought it apropos to recap the top ways to protect your privacy from a cybersecurity perspective.

  1. Update your devices with patches as soon as you get the notice from the manufacturer. Patching is necessary to protect your device from vulnerabilities.
  2. Maintain strong passphrases and change them often.
  3. Use multi-factor authentication on all your online accounts but beware of multifactor authentication fatigue.
  4. Limit use of public Wi-Fi networks and use virtual private networks whenever possible.
  5. Obtain your free credit report frequently to catch any fraudulently opened accounts .
  6. Properly dispose of all electronic devices, including SIM cards.
  7. Beware of imposter scams.
  8. Strengthen children’s privacy.
  9. Don’t give personal information to a generative AI tool.
  10. Beware of, and protect yourself from, threat actors using AI in attacks.

We hope these Tips continue to educate and provide practical solutions for navigating the rapidly evolving risk landscape that technology and AI create in our lives. To dive deeper into putting these Tips to work, check out this guide. We look forward to to providing another 500 practical tips on how to stay safe.

On June 30, 2026, New Jersey’s Governor Mikie Sherrill signed a new data broker law, largely effective immediately, that adds significant new obligations for businesses involved in personal data sales. The law reaches traditional data brokers that collect or purchase personal data about consumers with whom they do not have a direct relationship and then sell or license that information to third parties. It also creates obligations for “data collectors,” meaning businesses or business units that collect personal data directly from consumers and then sell or license that information to data brokers.

A central feature of the law is an annual registration requirement for covered data brokers and data collectors engaged in selling or licensing New Jersey consumers’ personal data . The state’s Division of Consumer Affairs will establish and maintain a public registry that includes contact information, privacy policy information, website information, and relevant opt-out information for each registrant. Registration fees are based on volume, starting at $5,000 for 100,000 or fewer New Jersey consumers and increasing to $1.5 million for entities involving personal data of more than 4.5 million New Jersey consumers. Registration submissions must address opt-out rights, deletion rights, activities from which individuals may not opt out, purchaser credentialing, cybersecurity event history, information concerning individuals under 18, and processors handling personal data on the entity’s behalf.

The law also prohibits data brokers and data collectors from selling or licensing sensitive data, and it separately amends New Jersey’s privacy law to prohibit controllers from selling sensitive data regardless of processing volume. Sensitive data includes categories such as health information, certain financial account information, citizenship or immigration status, genetic or biometric data used for identification, personal data collected from a known child, and precise geolocation data. The statute includes exclusions for certain regulated data and entities, including specified health, financial, insurance, consumer reporting, government, research, and securities-related contexts. Civil penalties include $2,500 per day for registration or update failures and $50,000 per record for certain sensitive data violations. Although most of the law took effect immediately, the registry provision remains inoperative for 270 days following enactment.

For businesses holding data about New Jersey residents, the new law reinforces the need for accurate data inventories, clear data sale and licensing arrangement oversight, and careful review of any sensitive data practices. As state privacy laws become more specific, companies should be prepared to show not only what their policies say, but how their data practices actually work.

Anyone who has purchased a car in the past decade is familiar with the dazzling wave of technology that greets them: giant touchscreens, voice controls, remote start apps. But behind the gleaming infotainment systems and driver-assist cameras, a subtler, more powerful feature has crept into the modern automobile, the ability to observe, record, and report on virtually every aspect of its use and its users.

For years, consumers have worried about smartphone privacy, Alexa eavesdropping, or social media tracking. However, while attention was directed elsewhere, auto manufacturers quietly built an ecosystem that rivals Big Tech in its reach, and, according to a blistering Mozilla Foundation study reported by AP News, completely fails at protecting consumer privacy. Not even one of the 25 major car brands reviewed earned a passing grade.

Why? Because car companies aren’t just making money off vehicle sales anymore. They’re monetizing your data, and the information they scoop up goes well beyond GPS locations or your driving speed. Think:

  • Biological metrics: Weight, heart rate, even facial expressions via sensors and cameras;
  • Personal details: Information from your tethered phone, call logs, text messages, sometimes even biometric or demographic data; and
  • Highly sensitive information: According to some vehicle manufacturers’ own policies, data on “sexual activity” and “intelligence” can be collected.

Unlike a smartphone app, which must explicitly ask for permissions, car makers hide their consent models deep in paperwork signed under pressure in a dealership. Few read these documents and even fewer realize that 84% of cars reviewed by Mozilla share personal data with brokers and service providers, and 76% claim the right to sell your data.

This has transformed cars into ongoing surveillance devices whose output is not for your benefit, but to be shopped around in a shadowy secondary data market, sold to insurers, marketers, and sometimes even government agencies.

What was once private (e.g., how you drive, where you go, who rides with you) can now raise your costs or be used for purposes you never anticipated. The auto industry claims this is about safety or innovation. While crash detection or predictive maintenance require some data, that argument fails when it comes to collecting genetic or intimate personal information.

In the United States, where state-level rules like the California Consumer Privacy Act are only just beginning to probe this problem, most drivers are exposed by default. Federal lawmakers are only now starting to see the domestic, and even national security dangers. Issues range from stalkers misusing connected apps to fears of foreign adversaries accessing U.S. driver data. But for now, self-regulation prevails—and as Mozilla’s findings make clear, it doesn’t work. Consent screens for cars, buried in sales documents and 50-page privacy policies, simply don’t provide real choice or transparency, particularly when a car is used by multiple drivers or passengers.

In an age when car sensors can identify individual drivers, or capture pedestrians in external footage, the question of whose privacy is being violated gets murky. Passengers (who never agreed to anything), can have their images, voices, and even biometrics swept up by default, an uncharted legal territory, with serious implications for consent and wiretapping laws.

The Alliance for Automotive Innovation touts voluntary, non-binding “consumer privacy principles.” In practice, opting out often means disabling mission-critical functions or navigating a maze of settings and customer service calls—hardly a meaningful choice, and often creating a “take it or leave it” arrangement where convenience trumps privacy.

As cars increasingly become platforms for subscriptions and software updates, the industry must realize that trust is everything. Already, lawsuits are hitting data-sharing arrangements. If automakers don’t fix their practices, a harsh regulatory reckoning is inevitable—one that could curtail the very innovation they celebrate.

Today’s car dealerships are not just selling you a car, they’re enrolling you, and everyone who travels with you, into a sprawling, often poorly regulated data marketplace. As drivers and passengers wake up to this reality, demands for transparency, meaningful consent, and real privacy choices will only grow. The road to the future, it turns out, is paved with data. The question is, do we still control the dashboard, or has the car quietly taken the wheel?

A new wave of state consumer privacy laws focused on limiting data collection is creating anxiety among businesses—and Maryland is leading the charge. The Maryland Online Data Privacy Act (MODPA), set to take effect in October 2025, requires companies to collect only data that is “reasonably necessary and proportionate” to their stated purposes. However, with no official guidance for compliance from the Maryland Attorney General, businesses are left guessing.

Under MODPA’s data minimization requirement, businesses should avoid collecting or processing more data than is necessary to provide a specific product or service to a consumer. In addition to the limited data collection requirement, MODPA also requires:

  1. Stricter Data Collection Practices for Sensitive Data: The data minimization requirements are more stringer for sensitive data, such as health information, religious beliefs, and genetic data. 
  2. Ban on the Sale of Sensitive Data: The law prohibits the sale of sensitive data unless it is strictly necessary to provide or maintain a requested product or service. 
  3. Explicit Consent: A business may not process personal information for a purpose other than the purpose(s) disclosed to the consumer at the time of collection unless the consumer provides explicit consent. 
  4. Limited Retention: A business may not retain consumer data for longer than necessary to fulfill the purpose for which it was collected (i.e., now is the time to update or implement your retention program).

This shift towards data minimization marks a departure from the more familiar “notice and choice” model, pushing companies to operationalize data minimization in ways that may significantly alter their data practices. While some businesses, particularly those already operating under stricter global standards like the European Union’s General Data Protection Regulation (GDPR), may be better prepared, others are weighing whether to reduce data collection or even scale back operations in certain states.

Companies developing or utilizing generative artificial intelligence are especially concerned, as these laws may limit access to large, diverse datasets required to train their models. Still, some see this as an opportunity to innovate with privacy-first technologies, such as synthetic data.

States like Maine, Massachusetts, Connecticut, and Minnesota are considering similar laws, signaling a growing trend. But as businesses await clearer definitions and enforcement standards, the central question remains: Can regulators strike the right balance between protecting privacy and supporting innovation?

In the ongoing saga of the 23andMe bankruptcy, Federal Trade Commission Chairman Andrew N. Ferguson recently sent a letter to the Trustee overseeing the 23andMe bankruptcy proceeding stating, “As Chairman of the Federal Trade Commission, I write to express the FTC’s interests and concerns relating to the potential sale or transfer of millions of American consumers’ sensitive personal information.”

The letter further outlined the promises 23andMe made to consumers about protecting the sensitive information it collected and maintained and that it had “made direct representations to its users about how it uses, discloses, and protects their personal information, including how personal information will be safeguarded in the event of bankruptcy.” It outlined additional promises 23andMe made to consumers and that “these types of promises to consumers must be kept.” Importantly, the letter states:

This means that any bankruptcy-related sale or transfer involving 23andMe users’ personal information and biological samples will be subject to the representations the Company has made to users about both privacy and data security, and which users relied upon in providing their sensitive data to the Company. Moreover, as promised by 23andMe, any purchaser should expressly agree to be bound by and adhere to the terms of 23andMe’s privacy policies and applicable law, including as to any changes it subsequently makes to those policies.

For 23andMe customers, now is the time to request the deletion of their data. Hopefully, the letter from the FTC will also escalate the concern over the potential sale of genetic information.

On May 17, 2024, Colorado Governor Jared Polis signed, “with reservations,” Senate Bill 42-205, “Concerning Consumer Protections in Interactions with Artificial Intelligence Systems” (the Act). The first of its kind in the United States, the Act takes effect on February 1, 2026, and requires artificial intelligence (AI) developers, and businesses that use high-risk AI systems, to adhere to certain transparency requirements and AI governance.

The Governor sent a letter to the Colorado General Assembly explaining his reservations about signing the Act. He noted that the bill “targets ‘high risk’ AI systems involved in making consequential decisions, and imposes a duty on developers and deployers to avoid ‘algorithmic discrimination’ in the use of such systems.” He encouraged the legislature to “reexamine” the concept of algorithmic discrimination of the results of AI system use before the effective date in 2026.

If your company does business in Colorado and either develops or deploys AI systems, your company may need to first determine whether the systems used qualify as high-risk AI systems. A “High-Risk AI System” means any AI system that, when deployed, makes or is a substantial factor in making a consequential decision. A “Consequential Decision” has a material legal or significant effect on the provision or denial of education enrollment/education opportunity, employment opportunity, financial or lending service, essential government service, health care services, housing, insurance, or a legal service.

Unlike other state consumer privacy laws, this Act does not have a threshold number of consumers to trigger applicability. Further, both the Act and the Colorado Privacy Act (CPA) (similar to the California Consumer Privacy Act (CCPA)) use the term “consumers,” but the term refers to Colorado residents under this Act. At the same time, the CPA defines consumers as Colorado residents “acting only in an individual or household context,” excluding anyone in a commercial or employment context. Therefore, businesses that may not be subject to the CPA may have obligations under the Act.

The Act aims to prevent algorithmic discrimination in the development and use of AI systems. “Algorithmic discrimination” means any condition in which the use of an artificial intelligence system results in an unlawful differential treatment or impact that disfavors an individual or group of individuals based on their actual or perceived age, color, disability, ethnicity, genetic information, limited proficiency in the English language, national origin, race, religion, reproductive health, sex, veteran status, or other protected classification under state or federal law.

What are the requirements of the Act?

For Developers:

  • To avoid algorithmic discrimination in the development of high-risk artificial intelligence systems, developers must develop a statement describing the “reasonably foreseeable uses and known harmful or inappropriate uses of the system,” the type of data used to train the system, risks of algorithmic discrimination, the purpose of the system and the intended benefits and uses of the system. 
  • Additionally, the developer must provide documentation with the AI product stating how the system was evaluated to mitigate algorithmic discrimination before it was made available for use, the data governance measures utilized in development, how the system should be used (and not be used), and how the system should be monitored when used for consequential decision-making. Developers are also required to update the statement no later than 90 days after modifying the system.
  • Developers must also disclose to the Colorado Attorney General any known or reasonably foreseeable risks of algorithmic discrimination arising from system’s intended uses without unreasonable delay but no later than 90 days after discovery (through ongoing testing and analysis or a credible report from a business).

For Businesses:

  • Businesses that use high-risk AI systems must implement a risk management policy and program to govern the system’s deployment. The Act sets out specific requirements for that policy and program and instructs businesses to consider the size and complexity of the company itself, the nature and scope of the systems, and the sensitivity and volume of data processed by the system. Businesses must also conduct an impact assessment for the system at least annually in accordance with the Act. However, there are some exemptions from this impact assessment requirement (e.g., fewer than 50 employees, does not use its own data to train the high-risk AI system, etc.).
  • Additionally, businesses must notify consumers that they are using an AI system to make a consequential decision before the decision is made. The Act sets forth the specific content requirements of the notice, such as how the business manages known or reasonably foreseeable risks of algorithmic discrimination that may arise from the system’s deployment. As applicable, if the CPA applies to the business (in addition to the Act), the company must also provide consumers the right to opt out of the processing of personal data by such AI systems for profiling purposes.
  • Businesses must also disclose to the Colorado Attorney General any known or reasonably foreseeable risks of algorithmic discrimination arising from the use of the system no later than 90 days after discovery.

The Act requires developers and businesses who deploy, offer, sell, lease, license, give, or otherwise make available an AI system that is intended to interact with consumers to disclose to each consumer who interacts with the system that the consumer is interacting with an AI system.

Although noting that the Act is “among the first in the county to attempt to regulate the burgeoning artificial intelligence industry on such a scale,” Colorado’s Governor stated in his letter to the legislature that “stakeholders, including industry leaders, must take the intervening two years before this measure takes effect to fine-tune the provisions and ensure that the final product does not hamper development and expansion of new technologies in Colorado that can improve the lives of individuals across our state.” He further noted:

“I want to be clear in my goal of ensuring Colorado remains home to innovative technologies and our consumers are able to fully access important AI-based products. Should the federal government not preempt this with a needed cohesive federal approach, I encourage the General Assembly to work closely with stakeholders to craft future legislation for my signature that will amend this bill to confirm with evidence based findings and recommendations for the regulation of this industry.”

As we have seen with state consumer privacy rights laws, this new AI law may be a model that other states will follow but, based upon the Governor’s letter to the Colorado legislature, we anticipate that there will be additional iterations of the law before it becomes effective. Stay tuned.

Some writers (not from my great state of Rhode Island) act like Rhode Island has been behind the times when it comes to data privacy and security when discussing the state’s new privacy law. I feel a need to explain that this is just not so. Rhode Island is not a laggard when it comes to data privacy.

Rhode Island has had a data privacy law on its books for a long time, though it was not called a privacy law. It was the Rhode Island Identity Theft Protection Act, which was enacted in 2015. It was designed to protect consumers’ privacy and provide data breach notification. It was amended to include data security requirements in the footsteps of the then-novel Massachusetts data security regulations. It was a one-stop shop for data privacy, security, and breach notification. Still, it did not provide individuals the right to access or delete data and was not as robust as new data privacy laws. Rhode Island was an early state to include health information in its definition of personal information that requires breach notification in the event of unauthorized access, use, or disclosure of health information. Many states still do not include health information in the definition of breach notification.

But just so the record is clear, consumer protection has been in the DNA of Rhode Island’s laws for many years, and the new privacy law was an expansion of previous efforts to protect consumers.

The new privacy law in Rhode Island expands the privacy protections for consumers and is the latest in a wave of privacy laws being enacted in the United States. As of this writing, 19 states have new privacy laws, and Rhode Island makes it 20.

All of the privacy laws are fairly similar, except for California, which is the only state to date that provides for a private right of action in the event of a data breach (with requirements prior to the filing of a lawsuit).

That said, for those readers who will fall under the Rhode Island law and are in my home state, here are the details of the law (the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)) of which you should be aware:

Continue Reading Rhode Island’s New Data Privacy Law