2022 Wyoming Statutes
Title 35 - Public Health and Safety
Chapter 32 - Genetic Data Privacy
Section 35-32-102 - Genetic Testing; Prohibitions; Exceptions.

35-32-102. Genetic testing; prohibitions; exceptions.

(a) Except as provided in subsection (b) of this section, no person conducting genetic testing shall do any of the following without the informed consent of the individual or the individual's authorized representative:

(i) Obtain an individual's genetic data;

(ii) Perform genetic testing on an individual;

(iii) Retain an individual's genetic data;

(iv) Disclose an individual's genetic data.

(b) Except as otherwise prohibited by law, an individual's genetic data may be obtained, retained, disclosed and used without informed consent for:

(i) Disclosures to the individual or the individual's authorized representative;

(ii) Law enforcement purposes otherwise authorized by law;

(iii) The state DNA database created by W.S. 7-19-402 or the comparable provisions of another jurisdiction;

(iv) The registration of sex offenders pursuant to W.S. 7-19-302;

(v) Determining paternity in accordance with a court or administrative order;

(vi) Determining the identity of a deceased individual;

(vii) Newborn screening requirements under W.S. 35-4-801;

(viii) The provision of emergency medical treatment;

(ix) Complying with an order of a court of competent jurisdiction;

(x) Anonymous research where the identity of the individual will not be released;

(xi) Services limited to storage, retrieval, handling or transmission of genetic data by a third party service provider pursuant to a contract or other obligation;

(xii) Diagnosis or treatment of the individual if performed by a clinical laboratory that has received a specimen referral from the individual's treating physician or another clinical laboratory. Nothing in this paragraph shall be deemed to waive the requirement that a treating physician obtain specific informed consent for the taking of a specimen when required.

(c) To safeguard the privacy, confidentiality, security and integrity of a consumer's genetic data, a direct to consumer genetic testing company shall:

(i) Provide clear and complete information regarding the company's policies and procedures for the collection, use or disclosure of genetic data by making available to a consumer:

(A) A high-level privacy policy overview that includes essential information about the company's collection, use or disclosure of genetic data; and

(B) A prominent, publicly available privacy notice that includes, at a minimum, information about the company's data collection, consent, use, access, disclosure, transfer, security and retention and deletion practices.

(ii) Obtain a consumer's consent for the collection, use or disclosure of the consumer's genetic data including, at a minimum:

(A) Initial express consent that describes the uses of the genetic data collected through the genetic testing product or service, and specifies who has access to test results and how the genetic data may be shared;

(B) Separate express consent for transferring or disclosing the consumer's genetic data to any person other than the company's vendors and service providers, or for using genetic data beyond the primary purpose of the genetic testing product or service and inherent contextual uses;

(C) Separate express consent for the retention of any biological sample provided by the consumer following completion of the initial testing service requested by the consumer;

(D) Informed consent in compliance with the federal policy for the protection of human research subjects, 45 C.F.R. § 46, for transfer or disclosure of the consumer's genetic data to third party persons for research purposes or research conducted under the control of the company for the purpose of publication or generalizable knowledge; and

(E) Separate express consent for marketing to a consumer based on the consumer's genetic data, or for marketing by a third party person to a consumer based on the consumer having ordered or purchased a genetic testing product or service. Marketing does not include the provision of customized content or offers on the websites or through the applications or services provided by a direct to consumer genetic testing company with a first-party relationship to the customer.

(iii) Require valid legal process for disclosing genetic data to law enforcement or any other government agency without a consumer's express written consent;

(iv) Develop, implement and maintain a comprehensive security program that protects a consumer's genetic data against unauthorized access, use or disclosure; and

(v) Provide a process for a consumer to:

(A) Access the consumer's genetic data;

(B) Delete the consumer's account and genetic data; and

(C) Request and obtain the destruction of the consumer's biological sample.

(d) Notwithstanding any other provisions in this section, a direct to consumer genetic testing company shall not disclose a consumer's genetic data to any entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer without the consumer's written consent.