SoylentNews

5 biggest risks of sharing your DNA with consumer genetic-testing companies:

The business of personal genetic-testing kits is booming, with consumers able to learn about their ancestry and health risks at the cost of just $99 to a few hundred dollars. Should you be afraid?

Some individuals worry they will discover things about their DNA that will be frightening — namely, the risks they run of contracting various diseases — and not know how to move forward with the information. Professional scientific skeptics contend the information may not even be as accurate as claimed, and lead people to make questionable health decisions. But there’s another type of risk that consumers aren’t focusing on as much, and it’s a big one: privacy. There is nothing more private than your personal genetic information, and sending away for a personal genome kit means sharing your DNA with the testing companies. What do they do with it, beyond providing consumers with genetic and health assessments?

[...] Here are five of the biggest privacy risks for consumers sharing their DNA with testing companies.

1. Hacking

Obviously, this is not a risk that the genetic-testing industry alone faces, but it is an industry that has a unique set of information on its consumers. And there was a recent hack in the space. More than 92 million accounts from the genealogy and DNA testing service MyHeritage were found on a private server, the company announced earlier this month. DNA data, specifically, was not breached, the company said. But a hack in this space is a concern, regardless.

2. Who may profit on your DNA? The answer: Not you

One of the most compelling signs that consumers have a positive view of these companies is that a majority agree to let them share DNA with researcher partners. All of these companies make clear that they will not share your DNA with any third-party unless you explicitly consent to it, but as 23andMe data shows, the vast majority of consumers opt in — at 23andMe, more than 80 percent. Ancestry and Veritas do not provide data on the opt-in percentage.

23andMe provides consumers the choice of opting into research conducted on behalf of academic, nonprofit and industry organizations. They also offer an option to consent separately to specific disease studies in which their DNA is used in conjunction with for-profit drug companies, such as the Parkinson’s disease research conducted with Genentech and the lupus and IBD research conducted with Pfizer.

“If customers don’t consent, none of their data is shared,” a 23andMe spokeswoman said.

Consumers seem to have made the decision that altruism is the proper course of action: If their DNA can help find a cause of, or cure for, a disease, they want to be part of that process. But it also means that one day a drug company may be bringing a drug to market based, in part, on your DNA.

“People do think they are helping the world, helping society, even though they may not as an individual benefit,” King said. “But if your DNA helps develop a drug for a pharmaceutical company, there is nothing governing what they do. It could be a drug they sell at a high profit but doesn’t help the world become a better place.”

Veritas Genetics CEO Mirza Cifric said what it learns from research becomes immediately available to consumers through updates to their own genome or publication that moves science forward. “Our primary interest is unlocking secrets that exist in the genome, not engaging pharmaceutical companies to develop drugs, although we see potential value in that,” Cifric said.

Marcy Darnovsky, executive director at the Center for Genetics and Society, said this research process also means that data is shared with and passes through many partners, and in her opinion, no matter what the testing companies say, they can’t ensure what those partners are doing with your DNA.

An Ancestry spokeswoman noted that the decision to share DNA for research is not irrevocable, and consumers can request to revoke that permission at any time through their account settings. But King isn’t convinced: “Quitting one of these services isn’t as simple as just clicking Delete. How do you verify that they’ve actually deleted your genetic profile or destroyed a physical sample?”

3. Laws covering genetic privacy not broad enough, experts say.

Many privacy experts are concerned that the only law currently covering genetic privacy, the Genetic Information Non-discrimination Act (also known as GINA) is too narrow in its focus on banning employers or insurance companies from accessing this information. Other than GINA, there really is nothing, King said.

[...]

The genetic information space is in many respects still uncharted legislative territory, and consumers are taking these companies at their word, and they do state that protecting customers’ privacy is their highest priority. Ancestry reminds customers that “you own your data and you always maintain ownership of it,” and “you may request that we delete your data or account at any time.”

Why might a lack of strict legislation come back to haunt consumers? Keep reading.

4. Law enforcement knows these companies have your DNA, and they may want it. They’re already asking.

Requests from law enforcement and courts for your data are already happening and also can be done under subpoena.

[...] She also noted that while testing companies stress that DNA data is “de-identified” to protect privacy, data shared with researchers can be re-identified in many cases.

[...] All of these DNA testing companies explain this in their privacy statements, and 23andMe makes clear that it stands on the side of consumers. It says it will “resist” efforts of law enforcement.

[...] King said that law enforcement has barely begun to test the power of the subpoena in this area, if at all, and so it’s really uncharted territory in the legal realm. But she said there is every reason to believe the companies will defend consumers in a manner similar to how Apple has fought government requests to unlock and unencrypt iPhones.

[...]

5. The company’s situation — or privacy statement — can change.

Unintended consequences — not just acute incidents like hacking — are also inherent in this business model’s risks.

Companies change — they are bought, sold and go out of business — and what happens to your data then? Darnovsky asked.

In the current tech-sector regulatory landscape, privacy statements also change.

“There are no limits on what these companies can do; they just have to state it in their privacy policies, which they can change at any time (though you may have to consent to it again),” King said.

But here’s the good news: These companies do have an incentive to be on the consumer’s side. Without your faith in their motivations and actions, they won’t succeed for long.

“The people I interviewed were generally uninformed about the potential risks and took a very optimistic view on how these companies would treat them in the future. With any luck they will be right,” King said.

Bottom line argument? Trust in self regulation! They'd never behave in a manner to upset the general consumer.