Enacts the "genetic privacy and protection act" to require the mandatory deletion of genetic data upon financial distress or bankruptcy; prohibits the sale, transfer, or continued use of genetic data without explicit and renewed consent from the original consumer; provides for attorney general enforcement.
NEW YORK STATE ASSEMBLY MEMORANDUM IN SUPPORT OF LEGISLATION submitted in accordance with Assembly Rule III, Sec 1(f)
BILL NUMBER: A7559
SPONSOR: Blumencranz TITLE OF BILL:
An act to amend the general business law, in relation to prohibiting the
sale, transfer, or continued use of consumer genetic data upon financial
distress, bankruptcy, or dissolution of a company handling such data
PURPOSE:
This bill, the Genetic Privacy and Protection Act, ensures that consumer
genetic data cannot be treated as a corporate asset to be sold, trans-
ferred, or otherwise exploited when a company faces financial distress
or bankruptcy. It mandates the immediate deletion of such data in these
situations, protecting New Yorkers from unauthorized use, exposure, or
sale of their most sensitive personal information.
SUMMARY OF SPECIFIC PROVISIONS:
Section 1: Amends the General Business Law by adding a new section 899-
NN to:
Define "genetic data" and "genetic data holders" to encompass companies
that collect, store, or process genetic information.
Establish clear criteria for "financial distress," including merger
announcements, bankruptcy filings, or material financial instability.
Mandate deletion of consumer genetic data within 30 days of financial
distress likely leading to 1pankruptcy.
Prohibit the sale, transfer, or continued use of genetic data in bank-
ruptcy proceedings or financial restructuring.
Require annual financial stability disclosures from genetic data compa-
nies operating in New York State.
Impose civil penalties of up to $50,000 per affected consumer for
violations, enforceable by the Office of the Attorney General.
JUSTIFICATION:
The recent 23andMe data breach crisis has exposed a glaring loophole in
consumer protection laws: genetic data one of the most personal and
immutable forms of personal information is vulnerable to sale and misuse
when companies face financial hardship. When companies that hold genetic
data go bankrupt, their assets, including this sensitive information,
can be auctioned off to the highest bidder with no consumer control or
consent.
This bill prevents another 23andMe-type scandal by ensuring that genetic
data is not a corporate asset subject to liquidation. Just as your DNA
belongs to you, not a corporation, this legislation guarantees that
companies handling genetic data operate with accountability and cannot
exploit financial distress to endanger consumer privacy.
With New York leading the way in data privacy, this legislation sets a
precedent for genetic data protection at a time when biotech and consum-
er DNA testing companies are facing financial volatility. The Genetic
Privacy and Protection Act sends a clear message: Your DNA is not for
sale. Ever.
LEGISLATIVE HISTORY:
New bill.
FISCAL IMPLICATIONS:
Minimal. Enforcement costs will be offset by penalties collected for
violations.
EFFECTIVE DATE:
This act shall take effect immediately.
STATE OF NEW YORK
________________________________________________________________________
7559
2025-2026 Regular Sessions
IN ASSEMBLY
April 1, 2025
___________
Introduced by M. of A. BLUMENCRANZ -- read once and referred to the
Committee on Consumer Affairs and Protection
AN ACT to amend the general business law, in relation to prohibiting the
sale, transfer, or continued use of consumer genetic data upon finan-
cial distress, bankruptcy, or dissolution of a company handling such
data
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. Short title. This act shall be known and may be cited as
2 the "genetic privacy and protection act."
3 § 2. The general business law is amended by adding a new article 42-A
4 to read as follows:
5 ARTICLE 42-A
6 PROTECTION OF CONSUMER GENETIC DATA IN FINANCIAL DISTRESS
7 Section 1200. Definitions.
8 1201. Mandatory deletion of genetic data upon financial distress
9 or bankruptcy.
10 1202. Prohibition on sale, transfer, or continued use of genetic
11 data.
12 1203. Annual financial health disclosures.
13 1204. Enforcement and penalties.
14 § 1200. Definitions. As used in this section, the following terms
15 shall have the following meanings:
16 1. "Genetic data" means any data, analysis, or information concerning
17 an individual's DNA, inherited characteristics, or genetic predisposi-
18 tions derived from testing, sequencing, or other means.
19 2. "Genetic data holder" means any company, entity, or organization
20 that collects, stores, or processes consumer genetic data.
21 3. "Financial distress" means any of the following conditions:
22 (a) A public announcement of a merger, acquisition, or sale of assets;
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD11353-01-5
A. 7559 2
1 (b) A company's filing for protection under Title 11 of the United
2 States Code (Bankruptcy Code); or
3 (c) Notice of material financial instability as determined by state
4 regulators.
5 § 1201. Mandatory deletion of genetic data upon financial distress or
6 bankruptcy. 1. A genetic data holder shall, within thirty days of expe-
7 riencing financial distress that is likely to lead to seeking bankruptcy
8 protection, permanently delete all consumer genetic data in its
9 possession.
10 2. A genetic data holder shall provide written notification to all
11 affected consumers regarding the deletion of their data within fifteen
12 days of such deletion.
13 § 1202. Prohibition on sale, transfer, or continued use of genetic
14 data. 1. No genetic data holder may sell, lease, share, or otherwise
15 transfer consumer genetic data as part of a bankruptcy proceeding,
16 financial restructuring, or asset liquidation.
17 2. No third-party acquiring assets of a genetic data holder may use or
18 retain consumer genetic data for any purpose unless the original consum-
19 er provides explicit and renewed consent.
20 § 1203. Annual financial health disclosures. 1. Any genetic data hold-
21 er domiciled or doing business or operating in New York state shall
22 submit an annual financial stability disclosure report to the department
23 of state subject to legislative oversight by the governor, temporary
24 president of the senate, speaker of the assembly, and minority leaders
25 of the senate and the assembly.
26 2. If such report indicates material financial instability, the compa-
27 ny shall be required to immediately halt all new collection and process-
28 ing of consumer genetic data pending review and notify consumers of such
29 instability.
30 § 1204. Enforcement and penalties. 1. Whenever it appears to the
31 attorney general, either upon complaint or otherwise, that any genetic
32 holder domiciled or doing business or operated in this state has engaged
33 in or is about to engage in any of the acts or practices stated to be
34 unlawful under this article, the attorney general may bring an action or
35 special proceeding in the name and on behalf of the people of the state
36 of New York to enjoin any violation of this article.
37 2. Any violation of this section shall be subject to a civil penalty
38 of up to fifty thousand dollars per affected consumer, payable to the
39 New York state office of victim services.
40 § 2. This act shall take effect immediately.
