Effective October 1, 2021, Florida's Protecting DNA Privacy Act (HB 833 or DNA Privacy Act) amends Florida's genetic privacy law (Fla. Stat. section 760.40) to establish new crimes arising out of the unlawful use of a person's DNA in the state of Florida. HB 833 provides:
(1) the submittal of another person's DNA sample for DNA analysis without that person's express consent is a third-degree felony;
(2) disclosure of DNA test results without the person's express consent is a third-degree felony; and
(3) sale or transfer of another person's DNA sample or DNA test results to a third party without the person's express consent is a second-degree felony.
Third-degree felonies in Florida are punishable by up to five years in prison, a $5,000 fine, and five years probation; second-degree felonies are punishable by up to 15 years in prison, 15 years probation, and a $10000 fine.
The DNA Privacy Act applies to DNA samples collected from any person in Florida, and regulates the use, retention, disclosure, or transfer of such DNA, or of any analysis derived from it. Specifically, HB 833 introduces the requirement that any person from whom DNA is extracted must provide "express consent" for any specified use of the person's genetic information. Such consent consists of authorization by the person (or the person's legal guardian or authorized representative), evidenced by an affirmative action demonstrating an intentional decision for DNA sampling and testing, provided the person receives a clear and prominent disclosure regarding the manner of collection, use, maintenance, or disclosure of a DNA sample or DNA test results. HB 833 further specifies that genetic information is the "exclusive property" of the person from whom it is extracted.
Before the amendments contained in HB 833, DNA analysis without informed consent was punishable as a first-degree misdemeanor. HB 833 elevates unlawful use of DNA to a potential felony, depending on the provision of the law that is violated. However, several important exceptions to such criminal liability are also specified in the DNA Privacy Act, such as use of such genetic information for:
(1) criminal prosecution or other legal processes,
(2) medical diagnosis or treatment, or
(3) conducting/preparing research subject to federal law, including under the Health Insurance Portability and Accountability Act (HIPAA).
This law is the latest development in an ongoing strengthening of genetic privacy protections in Florida. In 2020, the Florida legislature enacted HB 1189 which imposed restrictions on insurance carriers in regard to insureds' genetic information. Such prohibitions included a bar on the requirement or solicitation of genetic information or test results, or using a consumer's decision as to whether or not to take action in regard to genetic testing, for any insurance purpose. Insurers were also prohibited from canceling, limiting, denying, or varying premium rates based on genetic information.
If you have any questions regarding Florida's DNA Privacy Act or other state laws governing genetic information privacy, adoption of measures to comply with such law, or any other aspect of your information privacy program, please contact the author Al Leiva or any member of Baker Donelson's Data Protection, Privacy, and Cybersecurity Team.