Ancestry urges Vermont to make attorney general sole enforcer of genetic-privacy bill
Get AI-powered insights, summaries, and transcripts
Subscribe
Summary
Ancestry testified in support of House Bill 639, which would require express consents and let consumers delete genetic data; the company and the state AG’s office clashed over whether enforcement should be limited to the attorney general or include private lawsuits.
Ancestry’s government-affairs head, Richie Engelhart, told the House Commerce and Economic Development committee on Feb. 4 that House Bill 639 would codify long-standing privacy practices for direct-to-consumer genetic testing and urged the committee to designate the state attorney general as the sole enforcement authority rather than creating a private right of action. "We would like to offer 1 amendment to the bill today, making it clear that the attorney general and the state's attorney have the sole authority to enforce H.639," Engelhart said.
The bill, Engelhart said, requires separate, express consent for collection, processing, use or sharing of genetic data, and lets consumers delete their genetic data and request destruction of any biological samples they had stored. He told lawmakers the measure reflects best-practice standards developed after a 2017 Future of Privacy Forum model and said 14 states have enacted similar laws, including Texas, Utah, California and Minnesota.
Todd Dalo’s assistant attorney general (speaking for the AG’s office) told the committee the choice of enforcement mechanism is central to the bill. The assistant AG said state prosecutors represent the public interest and must prioritize cases given limited, taxpayer-funded resources, and that private actions give individual consumers a path to vindicate harms the AG might not be able to pursue on a single person’s behalf. "We think consumers who are the ones who are most directly injured in these circumstances ... should be able to vindicate their rights," the assistant AG said.
Engelhart argued agency enforcement is preferable because the direct-to-consumer genetic-testing market is concentrated — Ancestry, 23andMe and MyHeritage perform the majority of tests — and because many state laws already avoid broad private rights of action to prevent meritless litigation that can raise costs for consumers. He pointed to Illinois litigation that produced claims without prevailing judgments as an example of costly suits that ultimately did not succeed.
Lawmakers asked technical and policy questions about other states’ approaches. Committee members queried whether Wyoming’s law, which includes a narrow private right of action with a 60-day right-to-cure, had produced many suits; Engelhart said the right-to-cure mechanism has reduced filings and that a 30-day cure period could be workable. He and the AG representative both described coordinated AG activity during the 23andMe bankruptcy, saying state attorneys general informed the bankruptcy court of privacy promises and advised consumers of deletion rights.
The testimony also addressed data provenance: Engelhart said Ancestry’s genetic data comes from consumers and is distinct from other public records in the company’s genealogy products; the company also objects to secondary analysis services that request uploads of raw results and then propose advertising or other uses without separate express consent.
The committee did not vote on the bill at the Feb. 4 hearing. Members signaled interest in balancing robust consumer remedies with avoiding frivolous litigation and requested further information on enforcement capacity and cure-period designs before taking further action.