It is unlawful to obtain any genetic information of a person without informed consent with some exceptions, including for use in a study where the identities of the persons from whom the genetic information is obtained are not disclosed to the person conducting the study. It is unlawful to retain genetic information that identifies a person without first obtaining the informed consent with some exceptions. Except as otherwise provided, a person who obtains the genetic information for use in a study must destroy that information upon completion of the study or withdrawal of the person from the study. Criminal penalties and a right to civil action are established for violations.