January 21, 2022

Volume XII, Number 21

Advertisement
Advertisement

January 20, 2022

Subscribe to Latest Legal News and Analysis

January 19, 2022

Subscribe to Latest Legal News and Analysis

January 18, 2022

Subscribe to Latest Legal News and Analysis
Advertisement

Florida Imposes Criminal Penalties for Improper Processing of DNA

Florida recently passed a law governing DNA samples. The Act places several restrictions on the use, retention, and sharing of DNA samples. Those that violate the Act may face criminal liability.

Requirements under the law

Requirements under the Act are tied to “DNA samples” which include any human biological specific from which DNA can be extracted or the extracted DNA. To process a person’s DNA, entities must first obtain express consent. The Act defines “express consent” as an “authorization…evidenced by an affirmative action demonstrating an intentional decision.” With consent, there must also be a clear and prominent disclosure describing the manner of collection, use, retention, maintenance, or disclosure of a DNA sample. The notice must also describe the purpose of processing or the use of the DNA.

Penalties for violating the law

The Act creates criminal liability of varying degrees for failure to obtain express consent. Willfully collecting or retaining DNA without express consent and with the intent to perform DNA analysis is a misdemeanor. It is a felony to willfully disclose another person’s DNA analysis results to a third party without express consent. To willfully sell or transfer a person’s DNA sample or the results of a DNA analysis to a third party without express consent, regardless of whether the sample was collected with express consent in the first place, is also a felony.

Exemptions

There are certain uses of DNA samples exempt from these requirements. For example, use in a criminal investigation or prosecution, or if complying with a court order. Provided certain conditions are met, uses in medical diagnosis, patient treatment, quality assessments, and improvement activities are also exempt. Namely, that the health care practitioner who originally collected the DNA obtained express consent or a CMS certified clinical laboratory performs the activities.

Putting it Into Practice: Companies that collect DNA samples should review their notice and consent practices to ensure they meet the requirements of this new law. States are continuing to impose new restrictions on the processing of biometric and genetic data. Civil, and potentially criminal penalties await companies under these laws. 

Copyright © 2022, Sheppard Mullin Richter & Hampton LLP.National Law Review, Volume XI, Number 305
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

Julia Kadish is an attorney in the Intellectual Property Practice Group in the firm's Chicago office.

Areas of Practice

Julia's practice focuses on data breach response and preparedness, reviewing clients' products and services for privacy implications, drafting online terms and conditions and privacy policies, and advising clients on cross-border data transfers and compliance with US and international privacy regulations and standards. She also workes on drafting and negotiating software licenses, data security exhibits, big data licenses, professional...

312.499.6334
Staff Attorney

Harrison Schafer is a staff attorney in the Intellectual Property practice group in the firm's Chicago office. He is a Privacy and Cybersecurity Fellow and a member of the Privacy and Cybersecurity Team. He is a certified information privacy professional (CIPP/E and CIPP/US) by the International Association of Privacy Professionals (IAPP).

Areas of Practice

As a fellow, Harrison’s practice focuses on publishing articles covering relevant legal developments in the privacy and cybersecurity space to...

312-499-6371
Advertisement
Advertisement
Advertisement