Recently, my dad discovered a family secret: In the 1960s, one of his first cousins, now deceased, fathered a previously unknown child with a woman who placed the baby for adoption. The records were sealed.
When that child, now grown and living in Austin, Texas, did genetic testing to find her birth parents, she also found us.
“Neither my adoptive parents nor myself knew anything about my biological family,” Lori Peterson, my second cousin, told me. “I have always been curious and finally decided to do DNA testing.”
After using both Ancestry and 23andMe, she found her biological mother, a maternal younger half-brother, a fraternal half-sister and several cousins, aunts and uncles.
She wasn’t too concerned with privacy when she opted into research and sharing genetic data. However, when 23andMe experienced a data leak and financial troubles, she lost trust in the company.
Peterson’s story reflects the contradictory nature of consumer DNA testing kits: They provide useful information about family history and medical risks, but they also send genetic data into the world with limited privacy protections.
“Millions of people trusted DNA test companies enough to choose their services in the past 10 to 20 years, but fast forward to the present when there are headlines about money troubles and password hackers, and some of that trust has eroded,” says Brianne Kirkpatrick Williams, a genetic counselor and ancestry expert at National Society of Genetic Counselors (NSGC).
What can happen if your genetic data is sold or shared, and what can you do about it? Here are some steps to safeguard your information.
[READ How AI Is Transforming Medicine and Patient Care]
How Do DNA Testing Kits Work?
Direct-to-consumer DNA testing kits are at-home genetic analysis tools that allow people to discover more about their ancestry, health and hereditary traits.
People provide their DNA through a saliva or cheek swab sample, which is then sent to a lab for analysis to identify known genetic biomarkers, such as BRCA gene mutations. Some kits also let you build a family tree by comparing your DNA to that of other people who have agreed to share for potential matching.
Consumer testing companies include:
— 23andMe (just bought back by its former CEO after bankruptcy)
— AncestryDNA
— MyHeritage
— FamilyTreeDNA
— Living DNA
[READ: How to Put Together a Family Medical History]
How Do DNA Testing Companies Use Genetic Data?
Companies such as 23andMe and Ancestry specify what data is used for in their privacy policies and user agreements. If you opt into research, nonidentifiable data is shared with third parties, such as academic institutions, nonprofit organizations and pharmaceutical companies.
— Scientific research. Consumers are helping provide scientific research if they have opted in to research participation. In fact, 80% of 23andMe users have done so, according to bioethicist Jonathan LoTempio, Jr., a fellow in ethical, legal and social implications of genetics and genomics at the University of Pennsylvania. 23andMe is associated with nearly 300 scientific papers, ranging from studies of diabetes to mental health.
— Drug research. Although this research is for legitimate scientific purposes, it could mean others are making money from your data. For example, a drug company could use your genetic data to help create a new medicine.
— Product development. The DNA testing company may also use data to develop additional products.
[READ: Should You Take a Gut Health Test?]
Do DNA Testing Companies Sell Genetic Data?
Each DNA test company has its own set of guidelines and policies regarding selling genetic data. However, it’s common practice for companies to remove personally identifiable information, known as de-identifying, from the DNA data shared with researchers and third parties. Examples of personally identifiable information include an individual’s full name, social security number, date of birth and contact information. In other words, your results should be anonymous.
In addition, consumer testing only reveals a subset of your genes, not your entire genome.
“Anonymity is hard to achieve with genomic data. It is, however, not yet readily identifiable,” LoTempio says. “This means that, unlike looking at someone’s name and address, it is harder to ascertain information about a person from genomic information.”
While this may currently be the case, future technology — such as the use of artificial intelligence in medicine — may make it easier to link genetic data to a specific individual.
How Can Consumers Protect Their Data From Being Sold?
Unfortunately, the laws surrounding genetic data are not very strong in the United States.
“There’s a patchwork of state laws that provide varying levels of protection via privacy statutes,” says legal expert Christi Guerrini, an associate professor in the Center for Medical Ethics and Health Policy at Baylor College of Medicine.
These states — such as Texas, Virginia and Florida — have more stringent protections that criminalize data-sharing without the consumer’s consent. However, consumers must rely on each company’s privacy policies.
In addition, some aspects of genetic privacy law aren’t yet clear, such as what happens to data when a testing company is sold or goes bankrupt, recently the case for 23andMe.
Although the company said the buyer would adhere to current privacy laws, there’s no legal guarantee.
“(Consumers) can change permissions at any time to opt in and out of what happens with their data,” Williams says.
Here are the steps you can take to control how much of your data companies can share:
1. Opt out of research and data sharing
To change what you allow the testing company to do with your information:
— Log into your online profile
— Navigate to account settings
— Modify the checkboxes for each privacy option
The changes will take effect going forward; if your data has already been used in a research project, for example, you can’t remove it.
2. Destroy your sample
You can decide what to do with your actual DNA sample (usually saliva).
“Some DNA test companies dispose of a customer’s biological DNA sample once the test has been run, while other companies store the DNA sample with permission,” Williams says.
If the sample has been stored, you can have it removed by going into account settings and unchecking that box; or the company’s site might have a separate opt-out process for sample storage.
3. Delete your data
If you’re concerned about privacy, LoTempio advises deleting your data before the company is sold.
You can also fully revoke permission to use your data by deleting your entire account. The responsibility for actually deleting the data (or destroying the sample), however, falls on the company to follow through.
“You could ask for verification, but again, you are trusting the company,” says Dr. Susan Klugman, vice chair of Genetics and Precision Medicine at Albert Einstein College of Medicine/Montefiore Medical Center, and immediate past president of the American College of Medical Genetics and Genomics (ACMG).
Risks of Sharing Genetic Data
Your genetic data is some of the most personal, sensitive information about you. When you share that information with for-profit genetic testing companies, there are risks associated with allowing others access to that data.
Specific concerns with this information include:
— Availability to law enforcement. Most testing companies say they only share genetic matches (not the DNA itself) with law enforcement with a subpoena or warrant. Genetic data may also be requested in forensic cases, such as identifying human remains. Law enforcement could request the genetic data of a specific person, but Guerrini says this is very rare. However, you may be unknowingly compromising your relatives’ privacy, as they could be found by matching their DNA to yours.
— Discrimination in insurance and employment. The federal Genetic Information Nondiscrimination Act (GINA) prohibits health insurance companies and employers from discriminating against employees based on their genetic data, such as a marker increasing their risk for a certain disease. However, GINA doesn’t cover everything — such as disability insurance, life insurance or long-term care insurance — and genetic nondiscrimination laws at the state level vary.
— Lack of HIPAA protection. The federal Health Insurance Portability and Accountability Act (HIPAA) provides privacy and security protections of your health information, including genetic testing when ordered by a physician. However, HIPAA doesn’t protect DNA testing results when performed by direct-to-consumer genetic testing companies.
Bottom Line
It’s up to each individual to decide whether a consumer DNA test kit is worth privacy risks.
For some, such as adoptees and those searching for family members, the risks are small compared to the treasure trove of ancestry information gained.
“I knew the risks. But for me, an adoptee, the benefits far outweigh the risks,” Peterson, my second cousin, says.
However, if your priority is uncovering your genetic makeup as it pertains to health, genetic testing ordered by your doctor or through direct participation in a research study might be the way to go, instead of a consumer test.
“(Direct-to-consumer) genetics can be fun, interesting and a good way to participate in research with some more tangible benefits,” LoTempio says. “Should a user want to participate in research and get some interesting — good or bad — information back, then (direct-to-consumer) genetics testing is a way to do both things.”
More from U.S. News
A Patient’s Guide to Colorectal Cancer
What Is Benign Breast Disease?
The Difference Between Sun Poisoning and Sunburn
DNA Testing Kits: Are They Worth It? originally appeared on usnews.com
