1 August, 2018
Ancestry, 23andMe and other popular companies that offer genetic testing pledged on Tuesday to be upfront when they share users’ DNA data with researchers, hand it over to police or transfer it to other companies, a move aimed at addressing consumers’ mounting privacy concerns.
Under the new guidelines, the companies said they would obtain consumers’ “separate express consent” before turning over their individual genetic information to businesses and other third parties, including insurers. They also said they would disclose the number of law-enforcement requests they receive each year.
The new commitments come roughly three months after local investigators used a DNA-comparison service to track down a man police believed to be the Golden State Killer, who allegedly raped and killed dozens of women in California in the 1970s and 1980s. Investigators identified the suspect using a decades-old DNA sample obtained from the crime scene, which they uploaded to GEDmatch, a crowdsourced database of roughly a million distinct DNA sets shared by volunteers.
Investigators said they did not need a court order before using GEDmatch, sparking fresh fears that users’ biological data might be too easy to access — and could end up in the wrong hands — without additional regulation on the fast-growing, already popular industry.
Yet adherence to the rules is voluntary. While the policy offers users of participating sites added new protections at a time of great “uncertainty,” it doesn’t have the force of law, said Justin Brookman, the director of consumer privacy and technology policy at Consumers Union.
“In general, I think there should be stronger transparency requirements and legally binding rules for everyone around the transfer and use of super sensitive data like this,” he said.