A person may not (1) obtain genetic information from an individual or from an individual's DNA sample or (2) retain an individuals genetic information without prior informed consent with some exceptions, including for anonymous research where the identity of the subject will not be released. A DNA sample from an individual who is the subject of a research project must be destroyed promptly upon completion of the project or withdrawal of the individual from the project unless consent to retain the sample is provided. Additional provisions address retention and disclosure. The statutes set forth civil and criminal penalties for violations.