House Commerce Committee advances genetic data privacy bill, H.639 (draft 4.2)

The Vermont House Committee on Commerce & Economic Development voted Thursday to report H.639 (draft 4.2), a genetic data privacy bill, favorably after a discussion on deletion requirements, contract termination, law‑enforcement access, and the removal of a statutory cure period.

The bill, as presented to the committee, keeps existing requirements that direct‑to‑consumer genetic testing companies implement security procedures and allow consumers to delete accounts and genetic data. The draft adds a provision requiring companies that receive a consumer deletion request to notify third parties (including service providers) that have received the consumer's data or sample and to ensure those third parties delete or destroy the data or sample no later than 30 days after the consumer request.

Why it matters: Committee members said the 30‑day notice to third parties closes a potential loophole—consumers who request deletion might reasonably expect their data are erased, but copies held by contractors or vendors could persist unless the bill imposes an obligation on those parties.

Committee members also approved language addressing contract termination. The draft…