State could put limits on release of DNA data

OLYMPIA – Washington residents who spit in a tube or supply some other sample of their DNA to companies that analyze it for a fee would have legal protections for who could see the test results, under a proposal before a House panel.

As part of the Legislature’s push for privacy rights over data generated by new technology, the House Innovation, Technology and Economic Development Committee is considering whether improper release of such genetic information should be a violation of the state’s Consumer Protection Act and leave the company liable to a lawsuit.

The bill would prohibit a testing company from disclosing a customer’s genetic data to a health or life insurance company or an employer. A law enforcement agency would need a valid court order to get the information.

“There is nothing more personal than the blueprint to making another you or another me,” Rep. Shelley Kloba, the bill’s sponsor, said during a hearing Friday.

The bill is based on the latest industry best practices that many companies employ voluntarily, but it would serve as an extra protection or what Kloba, a Kirkland Democrat, called a “belt and suspenders” approach.

Last year, one of the largest consumer genetic testing companies, Family Tree DNA, acknowledged it had an agreement with the FBI to share data to help the agency solve crimes without notifying its customers.

Representatives of two other companies that offer DNA testing, 23andMe and Ancestry, said they already follow the bill’s requirements for protecting genetic data and obtaining a customer’s consent before revealing it.

“Trust is our company’s top priority,” Eric Heath, chief privacy officer for Ancestry, said.

But he balked at the bill’s provision that would allow a customer to sue, contending it would “open the door to vexatious litigation.” He and Jacquie Haggarty, of 23AndMe, argued the state’s consumer protection laws and the contractual agreements customers have with the companies would be enough protection.

Kloba said she thought consumers need more protection and the Legislature shouldn’t leave the protection of those privacy rights to “nothing but an understaffed attorney general’s office.”

The committee is also considering requirements for home devices with voice-recognition capability that would restrict the manufacturer from disclosing anything the device collects. The consumer would have to give written consent before releasing a recording or a transcript for advertising or any third party, and would have the right to demand the manufacturer permanently delete anything the device collects that was being stored by the company.

“We see some abuse of these wonderful devices that we bring into our homes,” Committee Chairman Zack Hudgins, the bill’s sponsor, said. “They listen to our conversations, they listen to us cooing to our babies and fighting with our spouses, and we need to have some kind of guidelines about how those conversations are treated.”

The committee is expected to decide whether to send the bills to the full House as is, or with changes, in the coming weeks.