Genetic testing and processing of genetic data.

42.—(1) Genetic testing shall not be carried out on a person unless—

(a) the testing is not prohibited by law, and

(b) the consent of the person to the processing of any genetic data to be derived from the testing has been obtained in accordance with the Acts.

(2) A person shall not engage in the processing of genetic data in relation to—

(a) the employment of a person save in accordance with the provisions of section 12A of the Data Protection Act 1988 (as inserted by the Data Protection (Amendment) Act 2003 ),

(b) a policy of insurance or life assurance,

(c) a policy of health insurance or health-related insurance,

(d) an occupational pension, a retirement annuity contract or any other pension arrangement,

(e) the mortgaging of property.

(3) A person shall not process genetic data unless all reasonable steps have been taken to provide the data subject with all appropriate information concerning—

(a) the purpose and possible outcomes of the proposed processing, and

(b) any potential implications for the health of the data subject which may become known as a result of the processing.

(4) A person who contravenes subsection (2) or (3) shall be guilty of an offence; an offence under this subsection shall be deemed to be an offence to which section 31 of the Data Protection Act 1988 applies.