Who Owns Your Genetic Information?

Senator Chuck Schumer recently kicked the undercurrent of paranoia about DNA testing up a notch in a press conference filled with inaccurate information. He said, “Here’s what many consumers don’t realize, that their sensitive information can end up in the hands of unknown third-party companies. There are no prohibitions, and many companies say that they can still sell your information to other companies.”

“There are no prohibitions.” That’s simply not true. Worse, Schumer’s press conference sparked some grossly irresponsible clickbait “journalism” stoking fears of DNA testing.

Not All Journalism Is Good Journalism

Let’s unpack some of this using this article in Gizmodo as an example. It contains inflammatory statements like “you’re giving up unfettered access to information about what makes you, you.” This statement is wrong on a number of levels. First, you’re not giving up “unfettered access” to anything. You have complete control over how the DNA companies use your DNA. You can choose to be paired to potential relatives or not. You can opt into or out of research programs that could lead to medical breakthroughs. And you can delete your results whenever you like.

On a biological level, the statement is ridiculous for two reasons. First, your genome contains roughly 3 billion units of DNA, and most of it is identical to other humans. Only about 10 million of those units are SNPs (pronounced “snips” and short for single nucleotide polymorphisms), meaning they vary among people. The DNA tests we do for genealogy only look at about 500,000 to 700,000 SNPs. So, of the 10 million units of DNA that differentiate me from the rest of humanity, the tests look at only 5% to 7%.

Second, fewer than 10% of the SNPs the genealogy testing companies use are known or suspected to have any effect on us. The vast majority of our DNA has no function at all. That’s right: most of those SNPs don’t contribute a thing to “what makes you, you”. For example, SNPedia, a wiki for genetic information, listed only 107,582 SNPs as of 3 December 2017. Their criterion for listing a SNP in the wiki is “something worthy of recording”. In other words, the other 9,892,418 SNPs in the human genome don’t do anything that we know of. AncestryDNA looks at fewer than half of the SNPedia SNPs, and the other companies examine even fewer. (Thanks to Dr. Ann Turner for pointing me to the SNPedia page that lists how many genetically meaningful SNPs are tested by each genealogy company.)

But there’s more. The Gizmodo author writes “the breadth of rights you are giving away to your DNA when you spit in that vial is kind of crazy. It’s all there in the fine print: Testing companies can claim ownership of your DNA, allow third parties to access it, and make your DNA vulnerable to hackers.” Ai-yi-yi! First, the “fine print” states that you own your own genetic information, with one possible exception; more on that below. And the companies do not allow third parties to access it without your permission. True, anything online is vulnerable to hackers, but what the heck would a hacker do with a fraction of your genome, most of which has no function?

One last beef with the Gizmodo article before I move on. It says, “23andMe, for example, sell anonymized data from your genetic code to its research partners, to help put all that genetic data to use looking for cures to diseases. That’s a use most people probably wouldn’t mind. But that research partner could in turn share your anonymized data in a research journal, and it’s possible someone might identify it.” The author of this piece has obviously never tried to identify someone using DNA alone. If it were so easy, the DNA Detectives Facebook group wouldn’t have more than 72,000 members, each of whom spends weeks or months or years trying to identify a single biological parent. The author has also clearly never read a research journal. Your raw data file from one of the testing companies contains literally hundreds of thousands of rows of text. Just for fun, I opened one of mine in Microsoft Word; the program stopped counting pages when it got to 10,000. The type of research study that could lead to medical breakthroughs would involve thousands of participants. It takes a special kinda … something … to think a journal would actually publish millions of pages of raw data, even if ethical guidelines allowed it, which they don’t.

Selling Your Genetic Information

Let’s cut to the chase: Can the companies sell your DNA information to third parties? Yes, they can. All of them include wording in their policies allowing them to share or sell our genetic information, but only if you agree to let them do it. What’s in the fine print?

AncestryDNA Terms and Conditions: “Any sharing of Genetic Information for external research purposes is governed by the Informed Consent.”

23andMe Privacy Policy: “We will not sell, lease, or rent your individual-level information (i.e., information about a single individual’s genotypes, diseases or other traits/characteristics) to any third-party or to a third-party for research purposes without your explicit consent.”

MyHeritage Privacy Policy: “We will never sell or license DNA samples, DNA Results, DNA Reports or any other DNA information, to any third parties without your explicit informed consent.”

Family Tree DNA Privacy Policy: “Gene by Gene respects your privacy and will not sell or rent your Personal Information without your consent. Personal Information includes, but is not limited to names, phone numbers, physical or mailing addresses, email addresses, and genetic test results.” (Gene by Gene is the parent company of Family Tree DNA.)

In summary, all four companies have the exact same policy with respect to sharing or selling our data to third parties: they do it only if we give them permission. The permission is granted to a company when you opt into their research program.

Who “Owns” Your Genetic Information?

Again, I’ll let the companies speak for themselves. Note that the “rights” granted in their agreements are what they need to provide the ethnicity estimates and relative matching that we pay them for.

AncestryDNA Terms and Conditions: “AncestryDNA does not claim any ownership rights in the DNA that is submitted for testing. Any Genetic Information (your DNA data and any information derived from it) belongs to the person who provided the DNA sample, subject only to the rights granted to AncestryDNA in this Agreement.”

23andMe Terms of Service: “Any Genetic Information derived from your saliva remains your information, subject to rights we retain as set forth in these TOS.”

MyHeritage Terms and Conditions: “We do not claim any ownership rights in the DNA samples, the DNA Results and/or the genetic information in the DNA Reports. Any genetic information derived from the DNA samples, the DNA Results and/or appears in the DNA Reports [sic] continues to belong to the person from whom the DNA was collected, subject only to the rights granted to MyHeritage in this Agreement.”

Family Tree DNA Privacy Policy and Terms of Service: “While the DNA sample remains the property of the tester, the person paying retains rights to the test results. If the tester decides to have results removed from the website, the tester must refund the full purchase price to the purchaser(s) and provide documentation to Family Tree DNA of the transaction.” Elsewhere, they say, “The owner of an account is responsible for naming a beneficiary to that account, should the test taker pass away. If no beneficiary is named on the account, Family Tree DNA retains ownership of the record and DNA. If a family member or heir presents documentation of relationship to the deceased test taker, Family Tree DNA may, at its discretion, allow the family member or heir access to the account.”

Wait, what?

To be honest, I’m not sure what to think here. In a recent press release, Bennett Greenspan, the Founder and CEO of Family Tree DNA (FTDNA), said “We feel the only person that should have your DNA is you. We don’t believe it should be sold, traded, or bartered.” Yet, we’ve already seen that their policy with respect to selling data is the same as the other companies. What’s more, FTDNA is the only company reviewed in this post that never explicitly states in their Terms of Service that we own our genetic information. (They allude to the fact that we own the samples—the cheek swabs—but not the genetic data itself.) And if someone else gave us the test, that other person has equal rights to our results until we pay them back.

Their beneficiary policy is also worrisome. A will is a legally binding declaration of what happens to our possessions when we die. If I own my genetic information, I should be able to bequeath it in my will to whomever I like. But FTDNA is saying that, unless I designate a beneficiary in their system, my will only applies at their discretion. The use of the phrase “retains ownership” is another big red flag. They can’t “retain ownership” of something that’s mine. That wording implies that we don’t own our genetic information at FTDNA; they do.

To summarize, at AncestryDNA, 23andMe, and MyHeritage, the person who takes the test owns the genetic information in it. At FTDNA, at best ownership is unclear and at worst, it belongs to FTDNA. I would like to see FTDNA revise their Terms of Service and Privacy Policy to explicitly state that we own our genetic information, regardless of who paid for the test, and that ownership does not revert to FTDNA when we die.

Informed Consent

What happens to our genetic information if we consent to participate in a research study at one of the companies?

AncestryDNA Informed Consent: “Consenting to participate in this research is completely voluntary and is not required to use any of our products or services. Even if you consent to participate in the research, you may withdraw your consent at any time, but your information will not be removed from research that is in progress or completed.”

23andMe Research Consent Document: “Your participation in the 23andMe Research study is completely voluntary.” And, “you can withdraw from 23andMe Research at any time. Any of your data that have already been entered into a study cannot be withdrawn, but your data will not be included in studies that start more than 30 days after you withdraw (it may take up to 30 days to withdraw your information after you withdraw your consent).”

MyHeritage Informed Consent Agreement: “Participation in this Project is purely voluntary and may be revoked at any time. If you choose to withdraw some or all of your personally identifiable information you provided to the Project, you may do so by contacting us to advise of your withdrawal. Upon your withdrawal, we will cease using your DNA Results in the Project. We will continue to provide you with the ability to use the Website or the DNA Services as before. Please note that due to the de-identification of certain Research Information, any research or studies using anonymized or aggregate information that has already begun, studies that have been completed, and any study results or findings that have been published prior to your withdrawal cannot be reversed, undone, or removed.”

Family Tree DNA Privacy Policy, Additional Consent: “Additionally, your consent will be sought for research purposes. Much of the genetic information resulting from DNA testing has not been clinically validated, and the technology we use, which is the same technology used by the research community, to date has not been widely used for clinical testing. For these reasons, our customers are encouraged to participate in Gene by Gene’s research initiatives that may contribute to a better understanding of the results of genetic testing. Your participation in these initiatives is entirely voluntary and your DNA test results will not be used or disclosed without your consent. Once given, however, consent cannot be revoked.” [original emphasis]

Per the US Department of Health and Human Services: “Subjects have the right to withdraw from (i.e., discontinue participation in) research at anytime (45 CFR 46.116(a)(8)).” FTDNA needs to change their wording regarding the withdrawal of consent.

The big picture? You have complete control over whether to participate in the research programs, and you can withdraw your consent at any time. The one thing you can’t do is pull your data from a research study that’s already been published or that is underway.

Schumer

I don’t blame Schumer. He’s trying to do what politicians are supposed to do, which is to respond to the concerns of his constituents. He’s undoubtedly heard from enough residents of New York state, which he represents, to spur him to action. The problem is that he’s misguided about the “dangers” of DNA testing with the major genealogical companies, and, as a result, is proposing a government solution to something that isn’t a problem. And in doing so, he’s stoking irrational fear that will scare people away from a fun and rewarding hobby.