Bill History – West Virginia Legislature Bills

2026 Regular Session

Link to Bill History on Legacy Website (Click Here)

Summary: Relating to biometric privacy
PDF: hb5034 intr.pdf
DOCX: HB5034 INTR.docx

WEST VIRGINIA LEGISLATURE

2026 REGULAR SESSION

Introduced

House Bill 5034

By Delegates Kimble, Anders, Ridenour, Mazzocchi, Phillips, Funkhouser, Jennings, Hillenbrand, Marple, Butler, and Mastes

[Introduced February 02, 2026; referred to the Committee on Health and Human Resources then the Judiciary]

A BILL to amend the Code of West Virginia, 1931, as amended, by adding a new article, designated §16-5EE-1, §16-5EE-2, §16-5EE-3, §16-5EE-4, §16-5EE-5, §16-5EE-6, §16-5EE-7, §16-5EE-8, §16-5EE-9, §16-5EE-10, §16-5EE-11, §16-5EE-12, and §16-5EE-13, relating to biometric privacy; creating the West Virginia Genomic Information Privacy Act of 2026; requiring an entity to provide consumer information regarding the collection, use, and disclosure of genetic data; providing for limitations and exclusions; providing for genomic information storage requirements; prohibiting the use, sale or transfer of genomic information to foreign adversaries; providing for enforcement authority; providing a private right of action; and providing definitions.

Be it enacted by the Legislature of West Virginia:

ARTICLE 5EE. WEST VIRGINIA GENOMIC PRIVACY ACT.

§16-5EE-1. Short title; Purpose and Legislative Policy.

(a) This article shall be known as the "West Virginia Genomic Information Privacy Act of 2026."

(b) The purpose of this act is to ensure that a medical facility, research facility, company, entity or nonprofit organization subject to this chapter does not provide any foreign adversary access to the genetic information of residents of this state.

(1) Oppose the collection and analysis of genomic information by a foreign adversary or for use by a foreign adversary; and

(2) Support sanctions the United States Department of Commerce or the United States Department of Defense imposes on a medical facility, research facility, company, or nonprofit organization engaged in the collection and analysis of genomic information for use by a foreign adversary.

§16-5EE-2. Definitions.

As used in this article, unless the context clearly indicates otherwise, the following definitions apply:

(1) "Biological sample" means any human material known to contain DNA, including tissue, blood, urine, or saliva.

(2) "Company" means a sole proprietorship, organization, association, corporation, partnership, joint venture, limited partnership, limited liability partnership, or limited liability company that exists to make a profit. The term includes a wholly owned subsidiary, majority-owned subsidiary, parent company, or affiliate of those entities or business associations.

(3) "Consumer" means an individual who is a resident of this state.

(4) "DNA" means deoxyribonucleic acid.

(5) "Domicile" means the country in which:

(A) A company or nonprofit organization is formed, incorporated, or registered and headquartered;

(B) A company ’s or nonprofit organization ’s affairs are primarily conducted; or

(6) "Entity" means a partnership, corporation, association, or public or private organization of any character that:

(A) Offers consumer genetic testing products or services directly to a consumer; or

(B) Collects, uses, or analyzes genetic data.

(7) "Express consent" means a consumer's affirmative response to a clear, meaningful, and prominent notice regarding the collection, use, or disclosure of genetic data for a specific purpose.

(8) "Foreign adversary" has the meaning assigned by 15 C.F.R. Section 791.4.

(9) "Genetic data" means:

(A) Any data, regardless of format, concerning a consumer's genetic characteristics.

(B) The term includes but is not limited to:

(i) Raw sequence data that result from sequencing all or a portion of a consumer's extracted DNA;

(ii) Genotypic and phenotypic information obtained from analyzing a consumer's raw sequence data; and

(iii) Self-reported health information regarding a consumer's health conditions that the consumer provides to an entity that the entity:

(I) Uses for scientific research or product development; and

(II) Analyzes in connection with the consumer's raw sequence data.

(10) "Genetic testing" means:

(A) A laboratory test of a consumer's complete DNA, regions of DNA, chromosomes, genes, or gene products to determine the presence of genetic characteristics of a consumer; or

(B) An interpretation of a consumer's genetic data.

(11) "Genome sequencer" means any device or platform used to conduct genome sequencing, resequencing, or isolation or other genome research.

(12) "Genome sequencing" means any method used to determine the identity and order of nucleotide bases in the human genome.

(13) "Governmental agency" means an executive, legislative, or judicial agency, department, board, commission, authority, institution, or instrumentality of the federal government or of a state or of a county, municipality, or other political subdivision of a state.

(14) "Human genome" means the set of DNA found in human cells.

(15) "Medical facility" means a facility licensed or registered by a state or federal agency to provide health care services that receives any state funding, including pass-through federal money provided to a state agency for grant awards.

(16) "Person" means an individual, partnership, corporation, association, business, business trust, or legal representative of an organization.

(17) "Processor" means a person that processes genetic data on behalf of an entity pursuant to a contract between the entity and the processor that prohibits the processor from retaining, using, or disclosing the genetic data, or any information regarding the identity of the consumer, including whether that consumer has solicited or received genetic testing, as applicable, for any purpose other than for the specific purpose of performing the services specified in the contract.

(18) "Software" means computer programs and related equipment used for genome sequencing or the operation, control, analysis, research, or other functions of genome sequencers.

(19) "Third party" means a person other than the consumer, entity, or processor.

§16-5EE-3. Exceptions.

(a) Protected health information that is collected by a covered entity or business associate as those terms are defined in 45 CFR, parts 160 and 164, if separate informed consent related to the collection, use, and dissemination of genetic data is obtained from the consumer, parent, guardian, or power of attorney, and the covered entity or business associate follows the policies under this article;

(b) An entity when it is engaged only in collecting, using, or analyzing genetic data or biological samples in the context of research as defined in 45 CFR 164.501 conducted with the express consent of an individual and in accordance with:

(i) The federal policy for the protection of human research subjects under 45 CFR, part 46, the good clinical practice guideline issued by the international council for harmonization of technical requirements for pharmaceuticals for human use; or

(ii) The United States food and drug administration policy for the protection of human subjects under 21 CFR, parts 50 and 56; or

(d) Beginning January 1, 2027, any collection, storage, use, or dissemination of genetic data by a governmental agency must be performed in accordance with a specific state law or executed through a search warrant.

§16-5EE-4. Consumer genetic data; privacy notice; consent; access; deletion; destruction.

To safeguard the privacy, confidentiality, security, and integrity of a consumer's genetic data, an entity shall:

(1) Provide clear and complete information regarding the entity's policies and procedures for the collection, use, or disclosure of genetic data by making available to a consumer:

(A) A high-level privacy policy overview that includes basic, essential information about the entity's collection, use, or disclosure of genetic data; and

(B) A prominent, publicly available privacy notice that includes, at a minimum, information about the entity's data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices for genetic data;

(2) Obtain initial express consent from a consumer, parent, guardian, or power of attorney for the collection, use, or disclosure of the consumer's genetic data that:

(A) Clearly describes the entity's use of the genetic data that the entity collects through the entity's genetic testing product or service;

(B) Specifies the categories of individuals within the entity that have access to test results; and

(4) If the entity engages in any of the following, obtain a consumer's:

(A) Separate express consent for:

(i) The transfer or disclosure of the consumer's genetic data or biological sample to any third party other than the entity's processors, including the name of the third party to which the consumer's genetic data or biological sample will be transferred or disclosed with the consumer's express consent;

(ii) The use of genetic data beyond the primary purpose of the entity's genetic testing product or service and inherent contextual uses; or

(iii) The entity's retention of any biological sample provided by the consumer following the entity's completion of the initial testing service requested by the consumer;

(B) Informed express consent for transfer or disclosure of the consumer's genetic data to third party persons for:

(i) Research purposes; or

(ii) Research conducted under the control of the entity for the purpose of publication or

generalizable knowledge; and

(i) Marketing to a consumer based on the consumer's genetic data;

(ii) Marketing by a third-party person to a consumer based on the consumer having ordered or purchased a genetic testing product or service. Marketing does not include the provision of customized content or offers on the websites or through the applications or services provided by the entity with the first-party relationship to the consumer; or

(iii) Sale or other valuable consideration of the consumer's genetic data.

(5) Comply with the provisions of §46A-7-101 et seq. of this code requiring a valid legal process for disclosing genetic data to law enforcement or any other government agency without a consumer's express consent;

(6) Develop, implement, and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use, or disclosure; and

(A) Provide a process for a consumer to:

(i) Access the consumer's genetic data;

(ii) Delete the consumer's genetic data;

(iii) Revoke any consent provided by the consumer; and

(iv) Request and obtain the destruction of the consumer's biological sample.

(7) Genetic data and biometric samples of West Virginia residents collected in the state may not be stored within the territorial boundaries of any country currently sanctioned in any way by the United States office of foreign asset control or designated as a foreign adversary under 15 CFR 7.4(a). Genetic data or biometric data of West Virginia residents collected in the state may only be transferred or stored outside the United States with the consent of the resident.

§16-5EE-5. Disclosure; when prohibited; when express consent required.

(a) The disclosure of genetic data pursuant to this article must comply with all state and federal laws for the protection of privacy and security.

(b) Notwithstanding any other provisions in §16-5EE-4 of this code, an entity may not disclose a consumer's genetic data to any entity offering health insurance, life insurance, or long-term care insurance, or to any employer of the consumer without the consumer's express consent.

§16-5EE-6. Prohibited use of certain genome sequencers and genome sequencing technologies.

A medical facility, research facility, company, entity or nonprofit organization subject to this chapter may not use a genome sequencer or software produced by or on behalf of:

(1) A foreign adversary;

(2) A state-owned enterprise of a foreign adversary;

(3) A company or nonprofit organization domiciled within the borders of a country that is a foreign adversary; or

(4) An owned or controlled subsidiary or affiliate of a company or nonprofit organization domiciled within the borders of a country that is a foreign adversary.

§16-5EE-7. Prohibited sale of genomic information in bankruptcy or reorganization.

A medical facility, research facility, company, or nonprofit organization subject to this chapter may not sell or otherwise transfer genomic sequencing data of residents of this state as part of a bankruptcy proceeding or pursuant to a plan of reorganization under Chapter 11 of the United States Bankruptcy Code (11 U.S.C. Section 1101 et seq.) to:

(1) A foreign adversary;

(2) A state-owned enterprise of a foreign adversary;

(3) A company or nonprofit organization domiciled within the borders of a country that is a foreign adversary; or

(4) An owned or controlled subsidiary or affiliate of a company or nonprofit organization domiciled within the borders of a country that is a foreign adversary.

§16-5EE-8. Requirements for genomic information storage.

(a) A medical facility, research facility, company, entity, or nonprofit organization subject to this chapter may not store any genome sequencing data of a resident of this state at a location within the borders of a country that is a foreign adversary.

(b) A medical facility, research facility, company, or nonprofit organization subject to this chapter that stores genome sequencing data of residents of this state, including storage of genome sequencing data through a contract with a third-party data storage company, shall ensure the security of the genome sequencing data using reasonable encryption methods, restriction on access, and other cybersecurity best practices.

(c) A medical facility, research facility, company, or nonprofit organization subject to this chapter shall ensure genome sequencing data of residents of this state, other than open data, is inaccessible to any person located within the borders of a country that is a foreign adversary.

(d) This section does not apply to the storage of genome sequencing data by a medical facility, research facility, company, or nonprofit organization subject to this chapter that is collected as part of a clinical trial or other biomedical research study subject to, or conducted in accordance with, 28 C.F.R. Part 202.

§16-5EE-9. Required annual certification of compliance.

(a) Not later than December 31 of each year, a medical facility, research facility, company, or nonprofit organization subject to this §16-5EE-1 et seq. shall certify to the attorney general that the facility, company, or organization is in compliance with this chapter.

(b) An attorney representing a medical facility, research facility, company, or nonprofit organization subject to this chapter shall submit the certification required under Subsection §16-5EE-8(a).

§16-5EE-10. Enforcement.

(a) The Attorney General may investigate an allegation of a violation of this chapter and has the sole authority to enforce this article on behalf of the State of West Virginia.

(b) The attorney general may bring an action to recover the civil penalty imposed under this section.

(d) In an action to enforce this article, the Attorney General may recover:

(1) Actual damages to the consumer;

(2) Costs;

(3) Reasonable attorney fees; and

(4) $2,500 for each violation of any provision of §16-5EE-1 et seq. of this code.

(e) The attorney general shall deposit a civil penalty collected under this section in the state treasury to the credit of the general revenue fund.

(f) The attorney general may recover reasonable expenses incurred in obtaining a civil penalty under this section, including court costs, reasonable attorney ’s fees, investigative costs, witness fees, and deposition expenses.

§16-5EE-11. Private cause of action.

(a) A legal resident of this state who is a patient or research subject of a medical facility, research facility, company, or nonprofit organization subject to this chapter and who is harmed by the storage or use of the patient ’s or subject ’s genome sequencing data in violation of this chapter may bring an action against the facility, company, or organization that violated this chapter and is entitled to obtain:

(1) The greater of:

(A) Actual damages; or

(B) Statutory damages in an amount not to exceed $5,000 for each violation; and

(2) Court costs and reasonable attorney ’s fees.

(b) An action under this section may be brought in the county in which the plaintiff resides.

§16-5EE-12. Legal Applicability of West Virginia Genomic Information Privacy Act of 2026.

(a) Except as provided by Subsection (b) of this section, the change in law made by this Act applies only to a cause of action that accrues on or after the effective date of this Act. A cause of action that accrues before the effective date of this Act is governed by the law in effect on the date the cause of action accrued, and the former law is continued in effect for that purpose.

(b) West Virginia Code §16-5EE-12, as added by the West Virginia Genomic Information Privacy Act of 2026, applies only to a bankruptcy filing that occurs on or after the effective date of this Act.

§16-5EE-13. Effective Date.

The West Virginia Genomic Information Privacy Act of 2026 shall take effect July 1, 2026.

NOTE: The purpose of this bill is to create the West Virginia Genomic Information Privacy Act of 2026, requiring biometric privacy; requiring an entity to provide consumer information regarding the collection, use, and disclosure of genetic data; providing for limitations and exclusions; providing for genomic information storage requirements; prohibiting the use, sale or transfer of genomic information to foreign adversaries; providing for enforcement authority; providing a private right of action and providing definitions.

Strike-throughs indicate language that would be stricken from a heading or the present law and underscoring indicates new language that would be added.