By: Andrew Toney,
The personal genomics industry has experienced rapid growth since 2006, when influential genome information service companies opened web-based exchange points to their customers.[1] Big players in the personal genomics industry including 23andMe, deCODEme, and Navigenics offer customers a glimpse into their health and ancestry. A customer need only submit a saliva sample for testing and – voila! – they uncover DNA qualities that explain their quirks, their family’s origin, and their susceptibility to certain diseases. Companies target consumers’ intellectual curiosity by providing an answer to life’s greatest question – Who am I? However, the DNA collection process, along with the accuracy of the findings, raises many pertinent legal questions: Who owns the rights to this data? Can third parties view this information, or is consumer data kept safely with the company? Just how accurate are these findings?
Researchers on the subject have developed a working definition of “genetic privacy,” concluding that the term encompasses four aspects: 1) informational privacy that relates to access to personal information; 2) physical privacy, which relates to access to persons and personal spaces; 3) decisional privacy, which relates to access to governmental or other third party interference with personal choices; and 4) proprietary privacy that relates to ownership interest in the human body.[2]
Determining the rights of ownership over genetic information has been a hotly contested issue due to the potential utility of such information in other industries. Companies make individual findings by comparing a customer’s DNA sample with an ever-expanding online genotype/phenotype database. In 2008, the federal government passed the Genetic Information Nondiscrimination Act (“GINA”) in response to increasing concerns of third party access to these massive databases of genetic information. GINA is designed to protect Americans against discrimination based on their genetic information with regard to employment or the receipt of health insurance.[3] Under GINA, an individual’s genetic information is categorized as a confidential medical record and, as a result, prevents employers from disclosing such information to third parties.[4]
What does this mean for consumers? On the one hand, consumers may continue to choose personal genomics because of GINA’s protections against personal data distribution. Likewise, this may encourage an employee to disclose their genetic information to an employer in order to supplement existing medical records. However, rapid growth in this industry, coupled with major technological advancements, show that customers may be storing data on company servers that GINA is not designed to protect.[5] As company databases continue to grow with newly added customer data, they become a juicier target for cyber attacks. Likewise, companies in the industry typically include provisions within their terms of service authorizing them to share information with affiliated entities.[6] Such provisions make clear that the consumer does not have exclusive rights to their own genetic information, nor is there any assurance that the information will remain within a company’s database. If the company collecting consumer data also has rights of ownership over that data, then they are free to treat it as they would any other commodity, including selling or transferring the data to third parties without consumer consent.[7]
Another concern with the personal genomics industry is whether consumers are really getting any substantial data in return for their DNA samples. Specifically within the realm of health data, many genomics companies market their products toward consumers concerned with hereditary health issues. This presents an obvious concern regarding the accuracy of a company’s findings. In 2013, the Food and Drug Administration issued a cease and desist letter to 23andMe, ordering the company to discontinue marketing its product as a means for analyzing consumer health data.[8] The FDA reasoned that foreboding health data would induce customers to seek unnecessary medical procedures or treatments.[9] Likewise, some state health departments have taken stances against customer health data collection in the wake of industry growth.[10] Growing concern at the state and federal levels points back to the original problem behind personal genomics, the protection of individual data from unwanted data distribution.
What the preceding information tells us is that personal genomics is currently opening a new avenue for legal conflicts in the realm of individual privacy. Personal genomics, as an industry, is still a relatively new concept. The unique services offered by this industry have piqued the interest of American consumers and have raised valid personal privacy concerns along the way. Indeed, the industry will no doubt continue experiencing growing pains as a result of such concerns. As databases continue to expand, and companies begin to offer more accurate findings, we may see personal genomics play a larger role in other industries, such as healthcare or family planning. Will this quell the unrest surrounding the storage and trading of genetic data? Until then, take solace in the fact that you, your genes, and your personal genomics service provider are contributing to one of technology’s newest frontiers
[1] D. Gurwitz & Y. Bregman-Eschet, Personal Genomics Services: Whose Genomes?, Eur. J. Hum. Genetics (Mar. 4 2009), https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2986500/.
[2] See Anita L. Allen, Genetic Privacy Emerging Concepts and Values, Genetic Secrets: Protecting Privacy And Confidentiality In The Genetic Era 31, 33-34 (Mark Rothstein ed., 1997).
[3] 42 U.S.C. § 2000ff (2016).
[4] See id.
[5] See Barbara Prainsack, What are the Stakes? Genetic Nondiscrimination Legislation and Personal Genomics, ResearchGate (Apr. 2, 2015), https://www.researchgate.net/publication/229439788_What_are_the_stakes_Genetic_non-discrimination_legislation_and_personal_genomics.
[6] See 23andme Privacy Highlights, (last visited Sept. 18, 2016) https://www.23andme.com/about/privacy/. (“We may share some or all of your information with other companies under common ownership or control of 23andMe, which may include our subsidiaries, our corporate parent, or any other subsidiaries . . .”). It is worth mentioning here that Google is a major investor in 23andMe, donating $3.9 million in 2007, when the company was still in its second year.
[7] See Gurwits, supra note 1.
[8] R. Green and N. Farahany, Regulation: The FDA is Overcautious on Consumer Genomics, Nature (Jan. 15, 2014), http://www.nature.com/news/regulation-the-fda-is-overcautious-on-consumer-genomics-1.14527.
[9] See id.
[10] Alexis Madrigal, 23andMe to California: We’re not Ceasing or Desisting, Wired (June 24, 2008), https://www.wired.com/2008/06/23andme-were-no.
Photo Source:
http://innovatemedtec.com/images/img/personal_genomics.jpg