Do-it-yourself DNA testing is a rapidly growing industry, but does the search for your ancestry or health status mean you are also giving up your rights and privacy?
University of Waikato’s Senior Law Lecturer Dr Andelka M. Phillips is an internationally recognized expert on direct-to-consumer DNA testing, coming via Oxford and Trinity College Dublin to Waikato. She has been researching this subject for nearly a decade. She says if you are buying a test and sending away your sample, very probably over international borders, then you may indeed be giving up some of your rights. “Companies should be complying with applicable consumer protection law, and data protection, and privacy law. In this context the EU’s General Data Protection Regulation (GDPR) sets quite a high standard for consent. New Zealand is currently reforming our privacy law, which will strengthen New Zealanders’ privacy rights in a similar way to the GDPR. However, at present there are issues with compliance. For instance, if we consider the right to be forgotten or erasure then it should be possible for all companies to offer the option of deleting both your DNA sample and your data after providing you with your results. … In relation to contracts and privacy policies, it’s likely that if a regulator or a court looked at this certain things, such as contractual terms could be challenged. But at the moment, once you take one of these tests, you should assume that your data could be used for secondary research and that you may not be able to control how it is used.”
One thing to understand is that the industry is diverse and that it ranges from health and ancestry tests, which you may be aware of, to tests for other more dubious purposes, such as child talent and infidelity. The more prominent health and ancestry services are at the better end of this spectrum, but more still needs to be done in terms of complying with data protection and privacy law and consumer protection law. “I believe the industry needs more regulatory oversight and that we may in fact need a new kind of regulatory body to govern all companies that are providing services that handle genetic information. Companies should also be thinking about new ways of doing things, such as their interface design and including features that allow their consumers to change their mind.”
What are the main risks? Dr Phillips lists failing to properly read the contract, which is probably very long, complex and convoluted, which means you may not know what rights you are giving away and what could be done with your data. The fact that it is common for companies to include a clause that allows them broad power to change their terms and conditions. Also the unknown future uses. For instance, it could have an impact on your insurance coverage. “One of the things about genetic information is that once you have the data processed, that data can be stored potentially indefinitely, and it is unlikely to change over time in a way that would make it non-identifiable information.”
Direct-to-consumer DNA testing (DTC) companies are not really making money from selling you a home swab kit, Dr Phillips says they’re making money doing research on your data. “A number of DTC companies have already begun partnering with other industries, including Big Pharma and we’re beginning to see investments by insurance companies as well. Some companies that were early key players in the industry have also been sold on to life sciences research companies, so in those cases, consumer data is being used in ongoing research.”
In the United States there has been controversy over direct-to-consumer DNA testing companies allowing law enforcement agencies to use their data in criminal investigations. When you’re giving away your genetic samples, you’re giving away your relatives’ information as well. “When we think of cultures like Māori where the community is very important, and you may be closely related. If you’re thinking of having one of these tests, you should also be thinking about discussing it with your family. Because once your data is out there, to some extent their data is also out there. That’s something I think is going to be really challenging.” Dr Phillips also says in the context of indigenous people there are also problems around data sovereignty, which need to be taken into consideration.
DNA testing for ancestry is riding a wave of popularity, but Dr Phillips says while potentially finding out about where you come from and locating long lost relatives may be an interesting experience for some people, it is not always the case. “For example, finding out one of your parents is not actually your biological parent. I think it is going to be more common. Some people quite enjoy finding out about new relatives, but that kind of information isn’t always going to end happily. The other thing consumers need to understand is that as ancestry tests are not standardised it is possible to obtain contradictory ethnicity estimates from different companies and also that even the largest databases will not have really large samples of some ethnic groups.”
With advances in DNA technology converging with other areas like data mining the future uses of your seemingly harmless ancestry home testing kit are wide open. Dr Phillips says in terms of privacy and control, regulators need to be more stringent. “I’m really for protecting people and our rights, so at the moment I don’t think how the industry is operating is affording sufficient protection for people’s rights, and if they are concerned about it and want to control their genetic data and personal information then they should be cautious.”