Committee clashes over 60-day "cure period" in genetic data privacy bill H.639

A House–Senate conference committee met to negotiate H.639, the state's genetic data privacy bill, and sharply debated whether genetic information should be subject to a 60-day consumer "cure period." The meeting opened with committee leaders urging a compromise to balance remediation opportunities for businesses with protections for consumers whose genetic data can be impossible to retrieve once disclosed.

Todd D of the attorney general's office urged caution about relying on a time-limited cure process for genetic information, saying breaches can reach brokers and dark-web markets and citing past incidents. He told the committee that "the Pentagon also warned against using direct to consumer testing companies for troops because there were security concerns," and described the 23andMe-related disclosures and subsequent resale as an example of how genetic information can be widely redistributed.

Supporters of a cure period argued that the process is intended to resolve many consumer complaints quickly without immediately turning to litigation, which can be costly and slow. Committee members described the cure period as a mediation-like step that could allow companies to correct notice or data-handling mistakes and, if unresolved, leave full legal remedies available after the period ends.

Opponents countered that genetic information is uniquely sensitive and often "incurable" once exposed: even if a company later ceases the offending transfers, the data may already have been copied, sold and reused downstream. Lawmakers raised scenarios in which rapid resale or transfer during a long cure period could expand harm, and they emphasized nonfinancial impacts, including stress and scam targeting, that could occur while consumers wait for remediation.

Members also pressed practical questions about how individuals would know their genetic data had been sold or improperly transferred. Committee discussion referenced a separate data-broker bill, H.211, as one mechanism that could help consumers discover whether their data is circulating in the market.

An industry presence was noted during the session: a participant identified Bridget Moore as attending on behalf of Ancestry. Committee members discussed how a short, confidential cure process could let firms confirm whether a given incident involved their data before consumers pursue litigation against the wrong party.

No formal vote or final agreement was reached. Committee members agreed to reconvene to continue negotiating the bill; the meeting was adjourned with plans to meet again Tuesday to seek a narrower compromise on the cure-period language.