2
3
4
5
6
7 LONG TITLE
8 General Description:
9 This bill concerns genetic genealogy.
10 Highlighted Provisions:
11 This bill:
12 ▸ defines terms;
13 ▸ creates requirements that a genetic genealogy company shall meet before a law
14 enforcement agency may request certain genetic genealogy information from the
15 genetic genealogy company;
16 ▸ amends the requirements that a law enforcement agency is required to meet in order
17 to:
18 • request certain genetic genealogy information from a genetic genealogy
19 company or the Bureau of Forensic Services, including when a search warrant is
20 required; and
21 • covertly obtain a third-party DNA specimen for information regarding a
22 third-party individual's genetic genealogy information;
23 ▸ prohibits a law enforcement agency or a prosecuting agency from contracting with
24 or otherwise using a third party to request, review, or obtain certain genetic
25 genealogy information if the law enforcement agency or prosecuting agency would
26 be prohibited from undertaking the action directly;
27 ▸ prohibits a genetic genealogy company from providing certain genetic genealogy
28 information to a law enforcement agency unless certain requirements are met;
29 ▸ allows a service user of a genetic genealogy company to recover damages and be
30 granted equitable relief against a genetic genealogy company if the service user's
31 genetic genealogy information is released to a law enforcement agency in violation
32 of certain statutory requirements;
33 ▸ establishes additional law enforcement reporting requirements concerning certain
34 investigative genetic genealogy database utilizations; and
35 ▸ makes technical and conforming changes.
36 Money Appropriated in this Bill:
37 None
38 Other Special Clauses:
39 None
40 Utah Code Sections Affected:
41 AMENDS:
42 13-60-104, as renumbered and amended by Laws of Utah 2023, Chapter 327
43 53-10-403.7, as enacted by Laws of Utah 2023, Chapter 500
44 53-26-101, as enacted by Laws of Utah 2023, Chapter 500
45
46 Be it enacted by the Legislature of the state of Utah:
47 Section 1. Section 13-60-104 is amended to read:
48 13-60-104. Consumer genetic information -- Privacy notice -- Consent -- Access --
49 Deletion -- Destruction -- Law enforcement access.
50 (1) A direct-to-consumer genetic testing company shall:
51 (a) provide to a consumer:
52 (i) essential information about the company's collection, use, and disclosure of genetic
53 data; and
54 (ii) a prominent, publicly available privacy notice that includes information about the
55 company's data collection, consent, use, access, disclosure, transfer, security, retention, and
56 deletion practices;
57 (b) obtain a consumer's initial express consent for collection, use, or disclosure of the
58 consumer's genetic data that:
59 (i) clearly describes the company's use of the genetic data that the company collects
60 through the company's genetic testing product or service;
61 (ii) specifies who has access to test results; and
62 (iii) specifies how the company may share the genetic data;
63 (c) if the company engages in any of the following, obtain a consumer's:
64 (i) separate express consent for:
65 (A) the transfer or disclosure of the consumer's genetic data to any person other than
66 the company's vendors and service providers;
67 (B) the use of genetic data beyond the primary purpose of the company's genetic testing
68 product or service; or
69 (C) the company's retention of any biological sample provided by the consumer
70 following the company's completion of the initial testing service requested by the consumer;
71 (ii) informed consent in accordance with the Federal Policy for the Protection of
72 Human Subjects, 45 C.F.R. Part 46, for transfer or disclosure of the consumer's genetic data to
73 a third party for:
74 (A) research purposes; or
75 (B) research conducted under the control of the company for the purpose of publication
76 or generalizable knowledge; and
77 (iii) express consent for:
78 (A) marketing to a consumer based on the consumer's genetic data; or
79 (B) marketing by a third party person to a consumer based on the consumer having
80 ordered or purchased a genetic testing product or service;
81 (d) in accordance with Subsection (3), require valid legal process for the company's
82 disclosure of a consumer's genetic data to law enforcement or any government entity without
83 the consumer's express written consent;
84 (e) develop, implement, and maintain a comprehensive security program to protect a
85 consumer's genetic data against unauthorized access, use, or disclosure; and
86 (f) provide a process for a consumer to:
87 (i) access the consumer's genetic data;
88 (ii) delete the consumer's account and genetic data; and
89 (iii) destroy the consumer's biological sample.
90 (2) Notwithstanding Subsection (1)(c)(iii), a direct-to-consumer genetic testing
91 company with a first-party relationship to a consumer may, without obtaining the consumer's
92 express consent, provide customized content or offers on the company's website or through the
93 company's application or service.
94 (3) A request from a law enforcement agency or a law enforcement agency's agent to a
95 direct-to-consumer testing company for genetic genealogy information shall comply with the
96 requirements in Section 53-10-403.7.
97 Section 2. Section 53-10-403.7 is amended to read:
98 53-10-403.7. Investigative genetic genealogy service -- Genetic genealogy database
99 utilization -- Third-party specimens -- Requirements -- Enforcement.
100 (1) As used in this section:
101 (a) "Genetic genealogy company" means a company that provides a genetic genealogy
102 database utilization or an investigative genetic genealogy service.
103 (b) "Genetic genealogy database utilization" means a utilization of a genetic
104 genealogical database for the purpose of identifying potential biological relatives to a DNA
105 profile.
106 (c) "Genetic information" means data acquired from an analysis of a DNA specimen.
107 (d) "Investigative genetic genealogy service" means the processing of an individual's
108 DNA specimen or genetic data file to be used for a genetic genealogy database utilization.
109 (e) "Prosecuting agency" means the Office of the Attorney General or the office of a
110 county attorney or district attorney, including an attorney on the staff, whether acting in a civil
111 or criminal capacity.
112 (f) "Qualified genetic genealogy company" means a genetic genealogy company that:
113 (i) provides notice to the genetic genealogy company's service users and the public that
114 law enforcement may use the genetic genealogy company's services to investigate crimes or to
115 identify unidentified human remains;
116 (ii) allows a service user to:
117 (A) opt in or opt out of having the service user's data be accessible to a law
118 enforcement agency upon request for a criminal investigation; and
119 (B) access the genetic genealogy company's services even if the service user opts out of
120 having the service user's data be accessible to a law enforcement agency upon request for a
121 criminal investigation;
122 (iii) has a policy that prevents the genetic genealogy company from compiling, selling,
123 licensing, or transferring to a third party any data generated by the genetic genealogy company
124 concerning a victim, crime scene, or suspect;
125 (iv) provides a quarterly notification to all of the genetic genealogy company's service
126 users that contains:
127 (A) the total number of law enforcement agency requests that were received by the
128 genetic genealogy company during the previous quarter;
129 (B) the total number of law enforcement agency requests for which the genetic
130 genealogy company provided genetic genealogy information to a law enforcement agency
131 during the previous quarter;
132 (C) for a service user who has opted in to allow a law enforcement agency to access the
133 service user's genetic information or genetic genealogy information, a statement that states,
134 "Information concerning your genetic genealogy and that of your relatives may have been
135 accessed during any searches conducted on behalf of law enforcement.";
136 (D) for a service user who has opted out of allowing a law enforcement agency to
137 access the service user's genetic information or genetic genealogy information, a statement that
138 confirms that the service user has opted out of sharing the service user's genetic information or
139 genetic genealogy information;
140 (E) for a service user who has opted in to allow a law enforcement agency to access the
141 service user's genetic information or genetic genealogy information, a link that allows the
142 service user to elect at any time to prohibit law enforcement from accessing the service user's
143 genetic information or genetic genealogy information; and
144 (F) for all service users, in accordance with Subsection 13-60-104(1)(f), a link that
145 allows the service user to completely delete the user's information from the company's records
146 and database;
147 (v) for the preceding five years, has not had more than three instances, as determined
148 by an independent audit, of releasing to a law enforcement agency or a law enforcement
149 agency's agent in the absence of a court order or search warrant any genetic information or
150 genetic genealogy information obtained from or based upon genetic information provided by a
151 service user who has opted out of sharing genetic information or genetic genealogy information
152 with a law enforcement agency;
153 (vi) for any instance of an unauthorized release described in Subsection (1)(f)(v),
154 emails a notification of the unauthorized release to every affected service user within 30 days
155 after the day on which the unauthorized release was discovered; and
156 (vii) furnishes on an annual basis to the State Commission on Criminal and Juvenile
157 Justice the results of an independent audit that certifies that the genetic genealogy company
158 meets all statutory requirements outlined in this section to be considered a qualified genetic
159 genealogy company under this section.
160 [
161 (i) a violent felony; or
162 (ii) the identity of a missing or unknown individual.
163 [
164 individual who is not a likely suspect in an investigation.
165 (2) A law enforcement agency may request an investigative genetic genealogy service
166 or a genetic genealogy database utilization from the bureau or a genetic genealogy company if:
167 (a) (i) the law enforcement agency, through the law enforcement agency's investigation,
168 has a DNA profile from forensic evidence that the law enforcement agency reasonably believes
169 is attributable to:
170 (A) the perpetrator of a crime;
171 (B) the remains of an unidentified individual; or
172 (C) a missing or unknown individual;
173 (ii) the case for which the law enforcement agency requires the information is a
174 qualifying case;
175 (iii) a routine search of CODIS-eligible profiles, if any, developed in the case revealed
176 no DNA matches to the DNA profile;
177 (iv) the law enforcement agency, the bureau, and the prosecuting agency consult
178 regarding whether an investigative genetic genealogy service or genetic genealogy database
179 utilization is an appropriate and necessary step in the development of information that may
180 contribute to solving the case; [
181 (v) the law enforcement agency and prosecuting agency commit to further investigation
182 of the case if the investigative genetic genealogy service or genetic genealogy database
183 utilization produces information that may contribute to solving the case; [
184 (vi) (A) if the investigation is based on a qualifying case concerning a violent felony,
185 the law enforcement agency obtains a signed document from both the prosecuting agency and
186 the bureau that certifies that in the opinion of both entities, all other viable options for
187 investigation have been exhausted; or
188 (B) if the investigation is based on a qualifying case concerning a covertly collected
189 DNA specimen under Subsection (3)(a)(ii)(B), the law enforcement agency has requested and
190 successfully obtained a search warrant that authorizes the investigative genetic genealogy
191 service or genetic genealogy database utilization from the bureau or a genetic genealogy
192 company; or
193 (b) ordered by a court in accordance with a postconviction relief proceeding under
194 Section 78B-9-301.
195 (3) (a) Before a law enforcement agency may collect a third-party DNA specimen for
196 the purpose of obtaining an investigative genetic genealogy service or a genetic genealogy
197 database utilization, the law enforcement agency shall:
198 (i) consult with the prosecuting agency; and
199 (ii) (A) obtain informed, voluntary consent from the individual providing the
200 third-party DNA specimen; or
201 (B) [
202
203
204
205 collection of the third-party DNA specimen.
206 (b) Before obtaining a third-party DNA specimen in accordance with Subsection
207 (3)(a)(ii)(B), a law enforcement agency shall, if applicable, request the prosecuting agency to
208 notify and consult with the prosecuting agency in the jurisdiction in which the sample will be
209 covertly collected to ensure that all applicable laws and procedures are followed.
210 [
211
212
213 (4) A law enforcement agency or a prosecuting agency may only use a third-party DNA
214 specimen obtained under Subsection (3) to:
215 (a) identify a possible suspect;
216 (b) exonerate a possible suspect; or
217 (c) identify a missing or unknown individual.
218 (5) (a) When requesting an investigative genetic genealogy service or genetic
219 genealogy database utilization from a genetic genealogy company under Subsection (2), a law
220 enforcement agency or a law enforcement agency's agent shall:
221 [
222
223 [
224 genetic genealogy company [
225 [
226
227
228 [
229 [
230
231 [
232
233 [
234
235
236 [
237 enforcement agency;
238 (iii) confirm that the request is permitted under the terms of service for the genetic
239 genealogy company; and
240 [
241 service site user settings that control access to the DNA submitted by the law enforcement
242 agency and associated account information in a manner that will prevent the information from
243 being viewed by other service users.
244 (b) A request for an investigative genetic genealogy service or genetic genealogy
245 database utilization ordered by a court in accordance with a postconviction relief proceeding
246 under Subsection (2)(b) may be performed by a genetic genealogy company that does not meet
247 the requirements necessary to qualify as a qualified genetic genealogy company.
248 (6) (a) Before an individual may be arrested as a suspect in a crime for which an
249 investigative genetic genealogy service or genetic genealogy database utilization has been
250 conducted under Subsection (2)(a) and the investigative genetic genealogy service or genetic
251 genealogy database utilization has aided in the identification of the individual as a suspect, the
252 law enforcement agency and the bureau shall verify with confirmatory genetic testing that the
253 DNA obtained from the crime scene could have originated from the individual unless the law
254 enforcement agency or the prosecuting agency has sufficient evidence outside of the
255 investigative genetic genealogy service or genetic genealogy database utilization to
256 independently support the individual's arrest.
257 (b) After an individual has been charged with an offense after an investigative genetic
258 genealogy service or a genetic genealogy database utilization has been conducted for that
259 offense, the law enforcement agency shall:
260 (i) if applicable, verify with confirmatory genetic testing that the DNA obtained from
261 the crime scene could have originated from the individual;
262 (ii) if applicable, make a prompt, formal request to the genetic genealogy company to:
263 (A) provide the DNA information and any associated account information related to
264 the charged crime directly to the law enforcement agency; and
265 (B) remove the DNA information and any associated account information held by the
266 genetic genealogy company;
267 (iii) if applicable, document the request described in Subsection (6)(b)(ii); and
268 (iv) retain the information received from the genetic genealogy company or the bureau
269 for use during prosecution and subsequent judicial proceedings.
270 (7) A law enforcement agency or a prosecuting agency:
271 (a) may not:
272 (i) request, review, or obtain an investigative genetic genealogy service or a genetic
273 genealogy database utilization except as provided in this section; or
274 (ii) contract with or otherwise use a third party to request, review, or obtain an
275 investigative genetic genealogy service or a genetic genealogy database utilization that would
276 be prohibited under this section if the law enforcement agency or prosecuting agency directly
277 requested, reviewed, or obtained the investigative genetic genealogy service or the genetic
278 genealogy database utilization;
279 (b) shall ensure that genetic information obtained under this section is used only for
280 law enforcement purposes or postconviction relief purposes under Section 78B-9-301; and
281 (c) shall ensure that a DNA specimen and associated genetic information is:
282 (i) retained in conformance with applicable laws; and
283 (ii) destroyed once permitted under applicable laws.
284 (8) A person that provides a genetic genealogy database utilization or an investigative
285 genetic genealogy service may not provide the genetic genealogy database utilization or the
286 investigative genetic genealogy service to a law enforcement agency or an agent working on
287 behalf of a law enforcement agency unless the law enforcement agency or the law enforcement
288 agency's agent:
289 (a) provides:
290 (i) a copy of the signed document described in Subsection (2)(a)(vi)(A) if the signed
291 document is required under Subsection (2)(a)(vi)(A); or
292 (ii) a search warrant if a warrant is required under Subsection (2)(a)(vi)(B); or
293 (b) certifies in writing that the requested genetic genealogy database utilization or the
294 investigative genetic genealogy service is not related to an investigation for which a signed
295 document described in Subsection (2)(a)(vi)(A) is required or for which a warrant under
296 Subsection (2)(a)(vi)(B) is required.
297 [
298 to request the suppression of evidence unless a court determines that the violation led to a
299 deprivation of the defendant's constitutional rights.
300 (b) (i) If a court in a civil suit finds that an employee or agent of a law enforcement
301 agency knowingly has violated a provision of this section, the court shall order that the
302 employee or agent may not participate in another investigative genetic genealogy service or
303 genetic genealogy database utilization under this section for one year.
304 (ii) A finding or order under Subsection [
305 for a judgment for monetary damages or attorney fees against the state or a governmental entity
306 or an individual employed by the state or a governmental entity.
307 (c) Except as provided in Subsection (9)(a), a service user of a genetic genealogy
308 company whose genetic genealogy information was released to a law enforcement agency or a
309 law enforcement agency's agent by a genetic genealogy company in violation of this section
310 may recover damages and be granted equitable relief in a civil action against the genetic
311 genealogy company.
312 Section 3. Section 53-26-101 is amended to read:
313 53-26-101. Law enforcement reporting requirements for genetic genealogy
314 database utilizations -- Report.
315 (1) As used in this section:
316 (a) "Commission" means the State Commission on Criminal and Juvenile Justice
317 created in Section 63M-7-201.
318 (b) "Genetic genealogy database utilization" means the same as that term is defined in
319 Section 53-10-403.7.
320 (c) "Law enforcement agency" means the same as that term is defined in Section
321 53-1-102.
322 (d) "Qualifying case" means the same as that term is defined in Section 53-10-403.7.
323 (2) (a) Beginning on January 1, 2024, a law enforcement agency shall annually on or
324 before April 30 submit a report to the commission with the following data for the previous
325 calendar year:
326 (i) the number of genetic genealogy database utilizations requested by the law
327 enforcement agency under Section 53-10-403.7; and
328 (ii) for each utilization described in Subsection (2)(a)(i):
329 (A) if applicable, the type of qualifying case;
330 (B) for a criminal investigation, the alleged offense and the case number;
331 (C) the number of third-party DNA specimens obtained under Subsection
332 53-10-403.7(3)(a)(ii)(A);
333 (D) the number of third-party DNA specimens obtained under Subsection
334 53-10-403.7(3)(a)(ii)(B);
335 [
336 53-10-115, at the time of the request for the utilization; and
337 [
338 DNA specimen.
339 (b) A law enforcement agency shall compile the report described in Subsection (2)(a)
340 for each year in the standardized format developed by the commission under Subsection (4).
341 (3) If a genetic genealogy database utilization is requested by a multijurisdictional team
342 of law enforcement officers, the reporting requirement in this section is the responsibility of the
343 commanding agency or governing authority of the multijurisdictional team.
344 (4) The commission shall:
345 (a) develop a standardized format for reporting the data described in Subsection (2);
346 (b) compile the data submitted under Subsection (2), including the number of genetic
347 genealogy database utilizations requested by each reporting law enforcement agency; and
348 (c) annually on or before August 1, publish a report of the data described in Subsection
349 (2) on the commission's website.
350 Section 4. Effective date.
351 This bill takes effect on May 1, 2024.