It would be nice to have better special regulations specifically concerned with DNA usage and collection, just as we do for health information like HIPAA, just as we should for facial recognition as well.
"The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)." [4]
Finally, it's worth pointing out that some states (e.g, WA) have enacted their own legislation that specifically calls out genetic testing and data as PHI [5]. In addition, there is the GINA act, which provides some protections as well [6]
[1]: https://cphs.berkeley.edu/hipaa/hipaa18.html
[2]: https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hipaa-protect-genetic-information/index.html
[3]: https://www.law.cornell.edu/cfr/text/45/160.103
[4]: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
[5]: https://app.leg.wa.gov/billsummary?BillNumber=6284&Initiative=false&Year=1999
[6]: https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrimination_Act