On Friday, the FTC announced that was entering a consent decree with 1Health.io Inc., which also does business as Vitagene, Inc.  This is the fourth health-related FTC enforcement action announced this year (see here and here). 

In addition, it comes on the heels of Virginia, Montana, and, as recently as last week, Texas joining California, Utah, and Arizona in adopting legislation specifically regulating the privacy practices of direct-to-consumer genetic testing companies.  The recently adopted Montana law has a broader scope and narrower exceptions that raise questions about whether it will impede research, whereas the Texas law adopted last week is more similar to the other state models. 

In addition, broader consumer health data legislation has been passed this year in Washington, Nevada, and Connecticut.

The complaint against 1Health.io focused on the following factual allegations:

• That 1Health.io stored genetic data and heath data for consumers in a publicly accessible cloud repository for a period of time.  According to the FTC, 1Health.io failed to use access controls to restrict access, encrypt the data, or log or monitor access to it;

• That 1Health.io did not maintain a data inventory and thus could not search its repositories of data to honor consumer requests to delete their data; and

• That the company lacked measures to ensure that consumers’ saliva samples were destroyed shortly after they were analyzed.  In particular, the FTC noted that the company did not contractually require the laboratory with which it was working to sequence samples to require destruction of the samples.

Based on these factual predicates, the FTC alleges that the company misrepresented to consumers: the strength of its security practices; that it would honor consumer deletion requests; and that it would destroy samples after the samples have been analyzed.

The FTC also alleged that revisions that the company made to its privacy policy in April and December 2020 constituted material retroactive changes that were unlawful since the company failed to first take adequate steps to notify consumers or obtain their consent.  The FTC relied on its unfairness authority to allege that this change was unlawful, alleging that this change was likely to cause substantial injury to consumers due to the potential for unauthorized access to health and genetic data to lead to discrimination or economic or reputational injuries.

The proposed consent order requires the company to adopt an information security program to strengthen protections for genetic information and to instruct third-party contract laboratories to destroy all DNA samples that have been retained for more than 180 days.