Genetic Information Privacy

Wyo. Stat. Ann. tit. 35, ch. 32
in effect

Wyo. Stat. Ann. § 35-32-101 Definitions.

(a) As used in this chapter unless otherwise defined: (i) "Authorized representative" means a person authorized by state or federal law to make health care decisions for an individual; (ii) "DNA" means deoxyribonucleic acid; (iii) "Genetic testing" means any laboratory test of an individual's complete DNA, regions of DNA, chromosomes or genes to determine the presence of genetic characteristics of an individual; (iv) "Genetic characteristic" means a gene or chromosome, or alteration thereof, that is scientifically or medically believed to predispose an individual to a disease, disorder, trait or syndrome, or to identify an individual or a blood relative; (v) "Genetic data" means any data, regardless of its format, that concerns an individual's genetic characteristics. Genetic data includes: (A) Raw sequence data that result from sequencing of an individual’s complete extracted or a portion of the extracted DNA; (B) Genotypic and phenotypic information that results from analyzing the raw sequence data, including any familial inferences therefrom; and (C) Self reported health information that an individual submits to a company regarding the individual's health conditions and that is used for scientific research or product development and analyzed in connection with the individual's raw sequence data. (vi) "Informed consent" means the signing of a consent form or forms in writing or by electronic signature as defined in W.S. 40-21-102(a)(viii) by an individual or an individual's authorized representative which includes a description of: (A) Any genetic testing to be performed and how the genetic testing or resulting genetic data will be used; (B) How any genetic data will be retained or disclosed; (C) An individual's rights under W.S. 35-32-103. (vii) "Biological sample" means any material part of a human, discharge therefrom or derivative thereof known to contain deoxyribonucleic acid (DNA), such as tissue, blood, urine or saliva; (viii) "Consumer" means a natural person who is a resident of the state of Wyoming; (ix) "Deidentified data" means data that cannot be used to infer information about or otherwise be linked to an identifiable individual, and that is subject to: (A) Administrative and technical measures to ensure that the data cannot be associated with a particular individual; (B) Public commitment by the company to maintain and use data in deidentified form and not attempt to reidentify data; and (C) Legally enforceable contractual obligations that prohibit any recipient of the data from attempting to reidentify the data. (x) "Direct to consumer genetic testing company" or "company" means any person that offers consumer genetic testing products or services directly to consumers or who collects, uses or analyzes genetic data provided by a consumer; (xi) "Express consent" means a consumer's affirmative response to a clear, meaningful and prominent notice regarding the collection, use or disclosure of the consumer's genetic data for a specific purpose.

Wyo. Stat. Ann. § 35-32-102 Genetic testing; prohibitions; exceptions.

(a) Except as provided in subsection (b) of this section, no person conducting genetic testing shall do any of the following without the informed consent of the individual or the individual's authorized representative: (i) Obtain an individual's genetic data; (ii) Perform genetic testing on an individual; (iii) Retain an individual's genetic data; (iv) Disclose an individual's genetic data. (b) Except as otherwise prohibited by law, an individual's genetic data may be obtained, retained, disclosed and used without informed consent for: (i) Disclosures to the individual or the individual's authorized representative; (ii) Law enforcement purposes otherwise authorized by law; (iii) The state DNA database created by W.S. 7-19-402 or the comparable provisions of another jurisdiction; (iv) The registration of sex offenders pursuant to W.S. 7-19-302; (v) Determining paternity in accordance with a court or administrative order; (vi) Determining the identity of a deceased individual; (vii) Newborn screening requirements under W.S. 35-4-801; (viii) The provision of emergency medical treatment; (ix) Complying with an order of a court of competent jurisdiction; (x) Anonymous research where the identity of the individual will not be released; (xi) Services limited to storage, retrieval, handling or transmission of genetic data by a third party service provider pursuant to a contract or other obligation; (xii) Diagnosis or treatment of the individual if performed by a clinical laboratory that has received a specimen referral from the individual's treating physician or another clinical laboratory. Nothing in this paragraph shall be deemed to waive the requirement that a treating physician obtain specific informed consent for the taking of a specimen when required. (c) To safeguard the privacy, confidentiality, security and integrity of a consumer's genetic data, a direct to consumer genetic testing company shall: (i) Provide clear and complete information regarding the company's policies and procedures for the collection, use or disclosure of genetic data by making available to a consumer: (A) A high-level privacy policy overview that includes essential information about the company's collection, use or disclosure of genetic data; and (B) A prominent, publicly available privacy notice that includes, at a minimum, information about the company's data collection, consent, use, access, disclosure, transfer, security and retention and deletion practices. (ii) Obtain a consumer's consent for the collection, use or disclosure of the consumer's genetic data including, at a minimum: (A) Initial express consent that describes the uses of the genetic data collected through the genetic testing product or service, and specifies who has access to test results and how the genetic data may be shared; (B) Separate express consent for transferring or disclosing the consumer's genetic data to any person other than the company's vendors and service providers, or for using genetic data beyond the primary purpose of the genetic testing product or service and inherent contextual uses; (C) Separate express consent for the retention of any biological sample provided by the consumer following completion of the initial testing service requested by the consumer; (D) Informed consent in compliance with the federal policy for the protection of human research subjects, 45 C.F.R. § 46, for transfer or disclosure of the consumer's genetic data to third party persons for research purposes or research conducted under the control of the company for the purpose of publication or generalizable knowledge; and (E) Separate express consent for marketing to a consumer based on the consumer's genetic data, or for marketing by a third party person to a consumer based on the consumer having ordered or purchased a genetic testing product or service. Marketing does not include the provision of customized content or offers on the websites or through the applications or services provided by a direct to consumer genetic testing company with a first-party relationship to the customer. (iii) Require valid legal process for disclosing genetic data to law enforcement or any other government agency without a consumer's express written consent; (iv) Develop, implement and maintain a comprehensive security program that protects a consumer's genetic data against unauthorized access, use or disclosure; and (v) Provide a process for a consumer to: (A) Access the consumer's genetic data; (B) Delete the consumer's account and genetic data; and (C) Request and obtain the destruction of the consumer's biological sample. (d) Notwithstanding any other provisions in this section, a direct to consumer genetic testing company shall not disclose a consumer's genetic data to any entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer without the consumer's written consent.

Wyo. Stat. Ann. § 35-32-103 Genetic data; inspection; retention.

(a) An individual or the individual's authorized representative may inspect, correct and obtain genetic data about the individual. (b) A person conducting genetic testing shall destroy an individual's genetic data upon request by the individual or the individual's authorized representative unless: (i) The data was obtained pursuant to W.S. 35-32-102(b); or (ii) Retention of the data is necessary for a purpose disclosed to the individual or representative in the informed consent. (c) Genetic data about an individual obtained pursuant to W.S. 35-32-102(b) shall be used solely for the purposes obtained and shall be destroyed or returned to the individual or the individual's authorized representative upon completion of the purposes for which the data was obtained or in accordance with law.

Wyo. Stat. Ann. § 35-32-104 Criminal penalty; private right of action.

(a) Any person violating the provisions of this chapter is guilty of a misdemeanor punishable by a fine of not more than one thousand dollars ($1,000.00) for each violation. (b) An individual whose rights have been violated under the provisions of this chapter may bring a civil action to enjoin or restrain any violation of this chapter and may in the same action seek damages from the person violating this chapter. Prior to filing an action under this subsection the individual shall give notice in writing to the alleged violator stating fully the nature of the alleged violation. The alleged violator shall have not more than sixty (60) days from the date notice is provided to cure any violation. If, after sixty (60) days the violation has not been cured, the individual may bring a civil action. A prevailing party in an action brought under this subsection may recover all costs and expenses reasonably associated with the action, including but not limited to reasonable attorney fees. (c) The attorney general may bring an action in the name of the state or as parens patriae on behalf of consumers to enforce this chapter. In any action brought by the attorney general to enforce this chapter, a person found to have violated this chapter shall be subject to a civil penalty of two thousand five hundred dollars ($2,500.00) for each violation, the recovery of actual damages incurred by consumers on whose behalf the action was brought and costs and reasonable attorneys' fees incurred by the office of the attorney general.

Wyo. Stat. Ann. § 35-32-105 General provisions; limitations.

(a) The provisions of this chapter applicable to direct to consumer genetic testing companies shall not be waived. (b) The disclosure of genetic data pursuant to this chapter shall comply with all state and federal laws for the protection of privacy and security. This chapter shall not apply to protected health information that is collected by a covered entity or business associate governed by the privacy, security and breach notification rules issued by the United States Department of Health and Human Services (Parts Regulations) 160 and 164 of Title 45 of the Code of Federal Services (Parts Regulations) established pursuant to the federal Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191) and the federal Health Information Technology for Economic and Clinical Health Act (P.L. 111-5).
Source: Public.Resource.Org WY StatutesURL: https://unicourt.github.io/cic-code-wy/transforms/wy/ocwy/r78/gov.wy.code.title.35.htmlFetched: 6/28/2026