On June 7, 2023, Montana’s Governor signed Senate Bill (SB) 351 which revises the state’s privacy law pertaining to genetic information.

This legislation takes effect on October 1, 2023.

Covered Entity

Businesses covered by the legislation are any partnership, corporation, association, or public or private organization that:

• Offers consumer genetic testing products or services directly to a consumer; or
• Collects, uses, or analyzes genetic data

Consumer Defined

Under the legislation, consumers are defined as an individual who is a resident of the state of Montana.

Covered Entity Obligations

Under the legislation, covered entities have the following obligations:

• Provide clear and complete information regarding the business’s policies and procedures for the collection, use, or disclosure of genetic data.
• Obtain a consumer’s initial express consent for the collection, use, or disclosure of the consumer’s genetic data.
• Obtain a consumer’s separate express consent for, amount others, the transfer or disclosure of the consumer’s genetic data to any person other than the company’s vendors and service providers.
• Develop, implement, and maintain a comprehensive security program to protect a consumer’s genetic data against unauthorized access, use, or disclosure.

The law does not apply to the following:

• Protected health information that is collected by a covered entity or business associate as defined under federal privacy requirements if separate informed consent is related to the collection, use, and dissemination is obtained from the consumer.
• An entity when engaged in collecting, using, or analyzing genetic data or biological samples in the context of research pursuant to certain federal definitions.

Enforcement

The legislation is solely enforced by the state attorney general, who can initiate a civil enforcement action.

If you have questions about Montana’s new genetic data law or related issues, please reach out to a member of our Privacy, Data, and Cybersecurity practice group.