Ten years ago, the novelty of tracking down lost cousins and tracing ethnic origins made DNA kits seem like benign tools for amateur genealogists.
Today, with DNA data from an estimated 26 million kit users stored in commercial databases, it’s more obvious that consumer genetic testing is a big business that deals in highly sensitive personal information.
Ancestry and 23andMe sell user data for drug research (albeit, some consent is required). FamilyTreeDNA gives law enforcement agencies some access to client files to assist with criminal investigations.
And some people conduct research using GEDmatch, an open access database with which they’ve shared results from their own tests — and those of their family members, too.
“I’m certain there are a lot of people who have their genetic data in GEDmatch who have no idea,” says Leah Larkin, a genetic genealogy consultant who runs The DNA Geek website. “I don’t think it was necessarily done with intent to deceive or harm, but no one realized the true power of these tests.”
These circumstances raise valid concerns about compromised genetic privacy in many areas of life.
“Genetic information, like all information centrally stored, is susceptible to hacking,” said I. Glenn Cohen, the James A. Attwood and Leslie Williams Professor of Law at Harvard Law School and faculty director of the Petrie-Flom Center for Health Law Policy, Biotechnology & Bioethics, in an email interview. “Much work has shown that even what is labeled as ‘de-identified’ data can sometimes be re-identified.”
Thankfully for workers, though, they’ve had employment protections since 2009, because lawmakers had the foresight to enact the Genetic Information Nondiscrimination Act.
Genetic Discrimination Protections
Passed when the consumer genetic testing industry was still in its infancy, the Genetic Information Nondiscrimination Act prohibits discriminatory use of DNA data in both the health insurance industry and the workplace.
“The idea behind it was to stop something before it happened,” says Kerry Leibig, senior attorney advisor in the office of legal counsel at the U.S. Equal Employment Opportunity Commission.
Not only can covered companies not take adverse employment action based on people’s DNA data; with some exceptions, they also can’t request, require or purchase it.
The law defines genetic information as:
— Information about an individual’s genetic tests.
— Information about the genetic test of a family member.
— Family medical history.
— Requests for and receipt of genetic services by an individual or a family member.
— Genetic information about a fetus carried by an individual or family member or of an embryo legally held by an individual or family member using assisted reproductive technology.
Genetic information differs from disease information, which may be protected instead by the Americans with Disabilities Act, explains Jessica Roberts, director of the Health Law & Policy Institute and an Alumnae College Professor in Law at the University of Houston Law Center.
“GINA tries to take account for family ties,” she says. “For example, if I have breast cancer, that’s not my genetic information; the ADA would protect me. If my sister had breast cancer, that is my genetic information. If I tested positive for the BRCA gene, that’s my genetic information. If my sister tested positive for BRCA, that’s mine too.”
While the original intent of GINA may have been to protect workers’ health information, at least one federal court has held that the law also applies to non-medical genetic testing — like DNA kits — too, Roberts says.
In the “case of the devious defecator,” Atlas Logistics Group Retail Services hired a forensic testing company to figure out which of its workers expressed job dissatisfaction by deploying human excrement in a warehouse. Two employees were asked to provide cheek swabs of their DNA to test against the DNA found in the feces.
Both were cleared of suspicion. But they sued under GINA, won and helped to establish precedent for prohibiting employers from seeking non-medical genetic data.
Genetic Discrimination Cases and Genetic Privacy Cases
Cases like Lowe v. Atlas Logistics have been rare. In GINA’s first decade of existence, charges of relevant workplace rights violations have represented only a very small percent of EEOC cases.
“It’s hard to know if the reason there are so few charges is because it’s working or people aren’t really as familiar with the law yet,” Leibig says. “Our hope would be that since the law existed before the problem, we aren’t going to see that many.”
Roberts and her co-author, Tennessee College of Law associate professor Bradley A. Areheart, found no cases of workplace discrimination on the basis of a genetic test result in their survey published in a 2019 issue of Yale Law Journal.
Instead, most cases have stemmed from employers asking for family medical history information, often during routine pre-employment drug tests or pre-hiring medical exams for jobs that require physical activity. For example, in 2017, the EEOC sued Dollar General for seeking details in a medical exam about whether a job applicant’s relatives had cancer, heart disease and diabetes.
Normal office conversations can sometimes veer into GINA territory if managers aren’t careful, says Camille Olson, partner at Seyfarth Shaw law firm and employment law specialist. For example, a supervisor expressing condolences about the death of an employee’s relative may cross the line if she asks certain questions about the cause.
Company wellness programs that provide incentives to workers who engage in or refrain from certain exercise, eating and other behaviors sometimes solicit genetic information. The EEOC is working on new proposed rules governing the extent to which these programs are actually voluntary and therefore legal.
With relatively few cases tried so far, “GINA has not had much of a legacy as a genetic discrimination statute,” Roberts says. “But it might be valuable as a protection for employee privacy.”
In the era of big data, employers are collecting more and more information about their workers, tracking not just their time and attendance but also their health, communication, technology use and physical movement. Some companies are even using data about their top-performing employees to design algorithms intended to identify job candidates most likely to be similarly successful.
“It’s in their best interest to get as much information about their employees that they can,” Roberts says. “GINA tries to withhold information from employers.”
Despite the law’s protections, experts advise workers to be thoughtful about sharing genetic information publicly or privately, since digital security is never fully assured.
Even though hiring managers shouldn’t punish employees because of genetic details they see on social media, Leibig says, “it’s not that easy to prove the reason I didn’t get that job is I posted my DNA on Facebook.”
More from U.S. News