Current Privacy Risks in Genetic Testing

The idea of taking a direct-to-consumer(DTC) genetic test is intriguing. What was once considered an expensive test that could only be performed in a medical environment can now be purchased by consumers for as little as $100.00 and administered in the home. Simply spit your saliva into a tube, mail it to the lab, and within 6-8 weeks, your results will be ready to view online! It’s exciting to live in a time where new technologies have such an enormous influence in improving our quality of life.

However, what always meets us at the end of the rainbow are privacy and security concerns. And they were addressed at last week’s FTC privacy conference by two researchers – Andelka M. Phillips from the University of Oxford and Jan Charbonneau a PhD candidate from the Centre for Law & Genetics, Faculty of Law, University of Tasmania, Australia.

Here are three major concerns of the researchers:

1. Risks With Genetic Data.

Genetic data is the most personal data any individual may have. It’s the ultimate unique identifier—the PII of all living things. At this time, it’s also not possible to fully de-identify this data. “If there’s been a privacy breach, you can’t change it,” warned  Carbonneau. “It’s not like your iTunes password.”

Phillips and Charbonneau said that because genetic data is valuable, in the future “there may be an incentive for hackers to target genetic databases in order to acquire data than can be used in financial or identity fraud. There are a number of other risks associated with the use of genetic data, including: targeted marketing of drugs to individuals and family groups; potential genetic discrimination resulting from sharing genetic information with third parties; and sharing with law enforcement or government agencies without appropriate consent.” ¹

After hearing about these risks, my mind wandered to consider something potentially worse – could genetic data be encrypted and held for ransom? Ransomware is gaining notoriety, impacting individuals as well as businesses, with no signs of slowing down.

2. The Industry Is Developing Rapidly, But The Law Isn’t Keeping Pace.

When genetic testing is performed at a hospital, as a patient, you are protected because hospitals are subject to HIPAA compliance. But once an individual decides to go the DTC genetic testing route, it becomes a very different situation because technically the testing services are not HIPAA “covered entities”— it has the same risks many fitness wearable wearers face. Is the genetic data and other PII collected from that individual stored securely? Are organizations providing sufficient protection for consumers’ privacy?

Although not a covered entity, recently Fitbit was forced to be HIPAA compliant because it fell under the business associate framework—it was processing data for a company that was directly under HIPAA.

It is all for the better. Perhaps other wearable makers will voluntarily follow suit.

The rest of the world seems to have gotten the message. With the GDPR finalized, EU organizations are required to safeguard genetic data. Even if you don’t have a formal presence in the EU zone but collect and store any personal data–including genetic– of EU citizens, you are still subject to the latest GDPR regulations.

So actually the EU’s new law can indirectly force US genetic testers to protect the privacy of genetic data—at least for EU citizens. It would be nice if they did it for everyone.

3. Consumer Perception of Control, or Lack thereof

Ms. Carbonneau also found that if consumers believe that their genetic data will only be shared after they give permission, they are more likely to purchase DTC genetic tests, participate in research, and share results with family, doctors and online health communities.

“Most of the time companies will change the terms at any time or time to time without direct notice to the consumer,” noted Phillips.  “This is important here because it could have an impact on what companies do with your data. They could change the policies on sharing sale or storage of data. And this can significantly impact consumers.”

Bottom line –  just because consumers perceive they have control doesn’t not mean they have actual control.

The Industry Gets It: Data Security Is Paramount

Despite frequent terms of conditions updates in the privacy policies along with other risks and unknowns, I was relieved there was consensus and awareness at the privacy conference.

There was acknowledgement that monitoring data access rights is something that organizations can implement – only the right people who need access to data, should have access.

It was also voiced that since consumers can’t control all the data, companies should be responsible stewards of the data and should make smart informed decisions about how the information is used.

Here’s to hoping that we can all build on this privacy awareness momentum in 2016!

¹https://www.ftc.gov/system/files/documents/public_comments/2015/10/00057-98101.pdf