Florida recently passed a law governing DNA samples. The Act places several restrictions on the use, retention, and sharing of DNA samples. Those that violate the Act may face criminal liability.

Requirements under the law

Requirements under the Act are tied to “DNA samples” which include any human biological specific from which DNA can be extracted or the extracted DNA. To process a person’s DNA, entities must first obtain express consent. The Act defines “express consent” as an “authorization…evidenced by an affirmative action demonstrating an intentional decision.” With consent, there must also be a clear and prominent disclosure describing the manner of collection, use, retention, maintenance, or disclosure of a DNA sample. The notice must also describe the purpose of processing or the use of the DNA.

Penalties for violating the law

The Act creates criminal liability of varying degrees for failure to obtain express consent. Willfully collecting or retaining DNA without express consent and with the intent to perform DNA analysis is a misdemeanor. It is a felony to willfully disclose another person’s DNA analysis results to a third party without express consent. To willfully sell or transfer a person’s DNA sample or the results of a DNA analysis to a third party without express consent, regardless of whether the sample was collected with express consent in the first place, is also a felony.

Exemptions

There are certain uses of DNA samples exempt from these requirements. For example, use in a criminal investigation or prosecution, or if complying with a court order. Provided certain conditions are met, uses in medical diagnosis, patient treatment, quality assessments, and improvement activities are also exempt. Namely, that the health care practitioner who originally collected the DNA obtained express consent or a CMS certified clinical laboratory performs the activities.

Putting it Into Practice: Companies that collect DNA samples should review their notice and consent practices to ensure they meet the requirements of this new law. States are continuing to impose new restrictions on the processing of biometric and genetic data. Civil, and potentially criminal penalties await companies under these laws.