Over the past several years, at-home DNA testing kits have become increasingly popular. The market for such testing was estimated at $70 million in 2015 and is rising quickly given the ease and availability of such products. Now more than ever, Americans are seeking to discover their ethnicity, the heritage of their ancestors and/ or find family members. While it is tempting to just swab your cheek or spit in a tube to answer these sometimes complicated questions of lineage, a thorough reading and full understanding of all terms, conditions and privacy policies of the companies providing this testing is important so that you maintain control over your unique DNA.
The rising popularity of these at-home DNA kits has caught the attention of members of Congress, as well as the Federal Trade Commission (FTC). In November of 2017, Senator Chuck Schumer commented that the FTC should take a serious look at this new form of DNA testing to ensure that the companies providing these services have clear and fair privacy policies. The FTC, in December of 2017, recommended that consumers using these products carefully read all terms of service and privacy policies of the companies providing these kits.
So, Who Owns Your DNA?
How Your Information is Stored and Who Can See?
When providing a DNA sample for genetic testing, your information can be classified as either identified, meaning it is linked to your name, or de-identified, assigned an identification number only the company can link to your account. In many cases, the genetic information is de-identified and remains so. So, even though most DNA samples are sent to a third-party laboratory for analysis and sequencing, those labs don’t know to whom the data relates. For example, 23andMe claims that no one, within their company or other third-party partners, have access to both your email and genetic information and an automated system combines the two components to generate a report for the customer. Ancestry.com claims the same sort of process in that identification information and genetic data are not co-mingled until the report containing the results is generated. It is important to read and understand the company’s policy regarding who has access to both your identified and de-identified information. However, according to the National Human Genome Research Institute, keep in mind that because DNA is unique to only you it cannot be totally de-identified due to the amount of data sources where information is stored.
Can Your Information be Shared with Third Parties?
As mentioned above, most companies who provide DNA testing de-identify the information and assigned the DNA sample an identification number. Many of these companies share the de-identified information with third-party laboratories to conduct the DNA testing; this information can be found in their terms of agreement and other documents that must be agreed to and signed before the company will analyze the sample.
A more serious privacy concern is whether your DNA information can be shared with additional third-parties, not involved with your initial genetic testing, without your consent. Many of these companies have partnership with research and pharmaceutical companies who can use the data to explore the genetics of such things as aging and disease. 23andMe and Ancestry both have such partnerships; however, they claim that you are required to consent, in writing, to share the information if you would like to participate. If you decline to share the information, it remains with the company. Again, it is especially important to understand the documents you are signing when sharing your DNA with a company for testing.
Another area of concern regarding DNA data sharing is the dissemination of such information to various law enforcement entities. If one was the Subject of a criminal investigation, could his or her DNA data be released to the law enforcement agency conducting the investigation? According to the Ancestry Guide for Law Enforcement, the answer may be “Yes.” Ancestry provides that all information, including DNA data, sought by law enforcement will only be released in response to a valid subpoena, court order and/ or search warrant. Further, the Guide states that if there is an exigent emergency involving the danger of death or serious physical injury, law enforcement can submit an emergency disclosure request to expedite the release of such information, without any of the above court authorized documents for production. While most of us do not intend to be the Subject of a criminal investigation, this policy does allow your unique personal information to be available to law enforcement in certain situations.
While it is easy, fun and inexpensive to swab your cheek and discover your genetic lineage, don’t be tempted to blindly sign documents from the testing company. Take the time to read what you are signing, determine what rights you are releasing to the company and their partners and what they intend to do with your DNA. If you are uncomfortable with the policies of one company, try another; most of their policies are online. It is important to be aware of what happens to your DNA once you send your sample to these testing companies so that you maintain control over that most unique bit of you.
by: Stacy Stevens