42.—(1) Genetic testing shall not be carried out on a person unless—

(a) the testing is not prohibited by law, and

(b) the consent of the person to the processing of any genetic data to be derived from the testing has been obtained in accordance with F15[the Data Protection Regulation].

(2) A person shall not engage in the processing of genetic data in relation to—

(a) the employment of a person F16[…],

(b) a policy of insurance or life assurance,

(c) a policy of health insurance or health-related insurance,

(d) an occupational pension, a retirement annuity contract or any other pension arrangement,

(e) the mortgaging of property.

(3) A person shall not process genetic data unless all reasonable steps have been taken to provide the data subject with all appropriate information concerning—

(a) the purpose and possible outcomes of the proposed processing, and

(b) any potential implications for the health of the data subject which may become known as a result of the processing.

F15[(4) A person who contravenes subsection (2) or (3) shall be guilty of an offence and shall be liable—

(a) on summary conviction, to a class A fine, or

(b) on conviction on indictment, to a fine not exceeding €100,000.]

F17[(5) Where a person is convicted of an offence under subsection (4), the court may order any personal data that appears to the court to be connected with the commission of the offence to be destroyed or erased.

(6) The court shall not make an order under subsection (5) where it considers that a person other than the person convicted of the offence concerned may be the owner of, or otherwise interested in, the data concerned, unless such steps as are reasonably practicable have been taken for notifying that person and giving him or her an opportunity to show cause why the order should not be made.]