GSK, Ancestry, 23andMe Push Montana Genetic Privacy Law Changes

Genetic testing companies and biotechnology groups are lobbying for revisions to a new Montana law that is more stringent than other state requirements intended to protect a consumer’s genetic data privacy, including additional oversight for increasingly popular at-home kits.

The biopharma company GSK Plc and the coalition representing consumer genetic testing companies 23andMe Holding Co. and Ancestry.com LLC are among those that argue Montana’s law imposes unworkable mandates that will impede research. The law establishes disclosure and consent requirements for how genetic data is collected, used, and shared.

Montana joins numerous other states that have enacted privacy protections for genetic data in recent years. Montana’s law, though, includes stronger consumer protections for such sensitive information, bill sponsor state Sen. Daniel Zolnikov (R) said.

“Actually being in charge of your own DNA shouldn’t be such a crazy concept,” Zolnikov said.

Research Impact

Montana’s law, which took effect Oct. 1, comes as consumers are increasingly turning to at-home genetic testing for family history and health information. State lawmakers are now going beyond privacy standards that consider access to genetic information by insurers and employers to address consumers who share their genetic data with companies, said Jennifer Lynch, general counsel at the privacy-focused Electronic Frontier Foundation.

“They are looking at how they can protect not just the original biological sample, but also any information that’s extracted from that sample and information that’s interpreted from that sample,” she said.

The Coalition for Genetic Data Protection advocates for an existing policy framework supported by member companies 23andMe and Ancestry that outlines consumer transparency and consent requirements. The coalition has supported legislation in other states targeting direct-to-consumer genetic testing that includes those principles.

Montana’s law, though, applies to consumer genetic testing such as at-home kits as well as entities that collect, use, or analyze genetic data, with limited exceptions. Notably, out of more than a dozen states that passed genetic information privacy acts, Montana is the only one that does not exempt de-identified data—or data that’s not linked to a specific person, said Ann Blackwood, executive director of the Coalition for Genetic Data Protection, in an email.

Companies such as Ancestry allow consumers to consent to sharing their genetic information not personally linked to them with third parties for research. That data can be used to develop therapeutics or otherwise contribute to treating and predicting health conditions, according to the company’s privacy statement.

Companies and trade associations said applying privacy requirements to data not linked to an individual and the inclusion of other last-minute amendments made to Montana’s law without their input will impede research and clinical trials. They asked legislators at a meeting last month to address the issues, though lawmakers did not announce what action they may take.

The industry has raised additional concerns with the law’s broad definition of genetic data; its application to hospitals and universities; and consent and disclosure requirements companies argue are unrealistic, according to a legislative report. The law’s requirements are untenable for GSK, which has a manufacturing facility in Montana, and could prevent clinical trials in the state, Jeff Woodhouse, regional director for state government affairs, told state legislators last month.

“That would mean patients with the most serious unmet needs in your state would be left out of these studies,” Woodhouse said.

Ancestry and 23andMe support requiring people to opt-in to having their genetic data collected and used, Blackwood told lawmakers last month. Montana’s law, though, will pose challenges even when a consumer decides to participate in research and agrees to share their data for it, she said.

“The law will require companies to get individual consent in cases where the company may not know the identity of a person from which the data was derived,” Blackwood said.

‘Watered Down Bill’

The differences in Montana’s law compared to other states, though, provide state residents control over how their genetic data is used, Zolnikov said. Zolnikov, who also sponsored Montana’s recently enacted comprehensive consumer privacy law, said he will always work to make legislation better but is “not going to give the farm away” to appease opposition.

“They want it to be the watered-down bill that does nothing,” he said of the industry demands.

Zolnikov also said protections for data not directly linked to a consumer are important given that an individual’s DNA “only belongs to one person on the whole globe.”

“It’s not a generic thing; it’s highly specific,” he said. “And although today we’re not sure the usages—how it can be used—who knows where we’re going with the world?”

Montana’s law adds to the state’s long-time leadership in data privacy, including a 2013 law requiring law enforcement to get a warrant to access cell phone and other location information, Lynch said. The current Republican-led state legislature is able to pass laws on a bipartisan basis, she said.

“Sometimes we tend to think that maybe one political group might be more interested in privacy than another, but this really does show that that’s not true,” Lynch said.