House Commerce Committee advances genetic data privacy bill, H.639 (draft 4.2)

The Vermont House Committee on Commerce & Economic Development voted Thursday to report H.639 (draft 4.2), a genetic data privacy bill, favorably after a discussion on deletion requirements, contract termination, law‑enforcement access, and the removal of a statutory cure period.

The bill, as presented to the committee, keeps existing requirements that direct‑to‑consumer genetic testing companies implement security procedures and allow consumers to delete accounts and genetic data. The draft adds a provision requiring companies that receive a consumer deletion request to notify third parties (including service providers) that have received the consumer's data or sample and to ensure those third parties delete or destroy the data or sample no later than 30 days after the consumer request.

Why it matters: Committee members said the 30‑day notice to third parties closes a potential loophole—consumers who request deletion might reasonably expect their data are erased, but copies held by contractors or vendors could persist unless the bill imposes an obligation on those parties.

Committee members also approved language addressing contract termination. The draft requires that, upon the termination of a contract between a direct‑to‑consumer genetic‑testing company and a service provider, the service provider “shall immediately destroy all genetic data the service provider retained during their contractual period” and not disclose, transfer, or sell that genetic data before destruction.

On the issue of law‑enforcement access, the draft clarifies that a direct‑to‑consumer genetic testing company shall not disclose a consumer’s genetic data or identifying information to a government entity without a search warrant issued by a court on a finding of probable cause, or unless the consumer provides expressed consent after being notified by the company. The presenter told the committee the intent is to prevent broad or speculative law‑enforcement “fishing expeditions” while preserving the ability to comply with a properly targeted warrant.

The committee spent substantial time debating the bill’s removal of a statutory cure period that would allow companies limited time to remedy technical privacy violations before enforcement. One member raised concerns that eliminating a cure period could fuel consumer panic and create opportunities for bad actors to exploit companies with threats of litigation or demands for payment. Todd Davidson, addressing the committee, said cure periods sometimes allow straightforward fixes for technical notice or consent problems but do not remedy the underlying harm when data have already been transferred; he added Vermont does not typically include cure periods in other consumer statutes.

Representing Ancestry, Morris of Morris Strategies reiterated the company’s objection: “We certainly disagree with, you know, the taking out the cure period,” Morris said, asking the committee to consider possible harms and market impacts.

Procedural outcome: Chair entertained a motion to report the bill favorably on H.639 draft 4.2. Representative White moved the motion; Representative Caris Duncan seconded. The clerk called roll: Representatives Bosch, Buton, Carys Duncan, Duke, Olson, Priestley, White, Crane and Markup were recorded as voting yes; Representative Micklece was recorded as voting no. The motion passed and the committee reported the bill favorably for further consideration.

What’s next: Staff clarified remote voting rules during the meeting (committee practice allows each member up to three calendar days to cast authorized remote committee votes under existing HR guidance). Staff also said they would distribute updated documents to committee members and noted an upcoming engagement with UVM interns. The committee concluded its session with instructions for follow‑up and administrative coordination.

Authority and enforcement: The draft removes a cure period and keeps enforcement options under the Vermont Consumer Protection Act, which allows the attorney general or private parties to bring enforcement actions where applicable.

Clarifying details recorded in committee discussion included: the 30‑day deadline for third‑party deletion; explicit language requiring destruction of retained data upon contract termination; the statutory standard that companies must obtain a court search warrant on probable cause before disclosing identifying DNA information to government entities absent the consumer’s express consent; and that the committee removed the cure period by decision of the committee chair.

The committee’s vote to report H.639 favorably sends the draft forward in the legislative process with the changes discussed during the session.