Who Owns Your DNA?

Genetic data is uniquely vulnerable compared to other forms of sensitive data. By virtue of its nature, if your relative has genetic information leaked, that is some of your identifiable information that has also been compromised.

By Maya Rowley

24 November, 2022

Buying a DNA test kit this holiday season? You may be giving away more than you expect when you send off your vial of saliva.

In the last fifteen years, the field of genome sequencing has become rapidly commercialized and accessible to the public. We have seen an extraordinary democratisation of our own genetic information as discovering what your genes say about you has transformed from a highly specialist, costly, and time-consuming process into a weekend activity often approached with the same light-hearted curiosity as doing a personality quiz. Whether you want to uncover your ancestry, find long-lost relatives, or justify your culinary preferences with science (do you taste coriander as herby or soapy?), it seems there is a company willing to provide you with answers. However, what’s sold as a fun and easy way to learn more about yourself poses difficult questions about the price we pay when we give up the most intrinsic part of our identity: our DNA.

We have quietly entered an unprecedented era of human history where anyone with Internet access and disposable income is able to access their own genetic code – the language that encodes your very being. Pay around £80, spit in a tube, wait 3-4 weeks, and your genome (the complete set of your DNA) is in your hands.

The boom in personal genetic testing began in 2007 with 23andMe, a company now worth over 250 million USD. According to its website, animated with bright and cheerful graphics, the service has thus far sold 12 million of its DNA kits. That’s 12 million genomes the company has had access to. It is hard to understate how valuable this data is – your genes can betray your health, ethnicity, physical traits, disease predispositions, and even behavioural tendencies like whether you’re more likely to be a night owl or an early riser. Biometric data of this large sample size is something most scientists only dream of; the potential applications in drug discovery, population genomics, and studying human diversity makes these datasets highly prized.

Furthermore, this genomic data will only increase in value with time as we become better at parsing the genetic code and gleaning even more information about an individual from their DNA. These enormous genomic datasets are a veritable treasure trove for advertisers, insurance companies, and pharmaceutical developers which can use them to better target or develop their products. This is not science fiction: in 2018, pharmaceutical giant GlaxoSmithKline invested 300 million USD in 23andMe for the rights to the genetic data of its customers.

While most DNA testing services emphasise their commitment to giving customers the choice of how their data is used, these affiliations with third parties are not always transparent. 23andMe gives users the choice of opting into having their data used for “research purposes”, which includes selling this information to academic and industry research groups. According to the Head of Therapeutics at 23andMe, around 80% of customers choose to ‘opt-in’ to having their DNA used in this way.

The research ranges from designing new cancer drugs to better characterising the associations between genetics and mental health disorders. No one would argue that these are not worthwhile causes. However, the crux of the issue arises from the issue of ownership and corporations capitalising off sensitive information. Millions are having their data used to design drugs and treatments that make the DNA testing companies and pharmaceutical industries huge profits, of which the providers of this data do not see a penny. Consumers are being significantly undervalued in this unequal exchange – between the individual’s genomic sequence and the genetic analysis given in return through DNA testing, the former is significantly more valuable in the long term.

Genetic data is uniquely vulnerable compared to other forms of sensitive data. By virtue of its nature, if your relative has genetic information leaked, that is some of your identifiable information that has also been compromised. This is how police were able to identify the Golden State Killer that terrorised California in the 70s and 80s. By uploading DNA evidence taken from a crime scene to GEDMatch, a platform that allows users to explore their genealogy by sharing their genetic information, the FBI was able to construct a family tree of relations to the killer that led them to the now-convicted Joseph DeAngelo. A 2020 University of Washington paper states, “current estimates predict that a genetic genealogy database containing 2% of a target population will produce a 3rd cousin or closer relative for over 99% of individuals, the same relative degree used to identify the Golden State Killer”. If DNA testing services market their products by emphasizing how unique and individual your DNA makes you, then it is no surprise that the same information also makes us immediately, incontrovertibly identifiable. For better or for worse, it seems the golden age of anonymity is now past.

Despite the dubious ethics of many testing services, there are many advantages to knowing your own genetic information as it relates to your health. Understanding what medical conditions, you are predisposed to can provide people the autonomy to make informed decisions outside of the intimidating environment of a GP clinic or hospital. Knowing you have a BRCA mutation that significantly increases your chances of developing breast or ovarian cancer can make the difference between living till 40 or 80 depending on what actions are taken according to this knowledge. However, the consequence of selling medical information as a direct-to-consumer product is that it bypasses professionals. Information that was once shared with patients by trained medical specialists and discussed with genetic counsellors is now accessed by people with no support system in place to navigate the information they may not be prepared to receive. But as difficult as it may be to process, using a DNA test kit can be a quick and relatively cheap way to access crucial medical information that empowers individuals to act early and mitigate their health risks.

Perhaps one of the most obvious concerns with sharing your DNA with testing services is the threat of a data leak. Fortunately, most major sequencing companies are keenly aware of the impact a data breach would have on their reputation (not to mention their potential client base), therefore have a vested interest in investing in their data security.

On a consumer level, taking simple steps like choosing a reputable DNA testing company that has a sophisticated data encryption system, being cautious of uploading your genetic data to third-party sites, and requesting to have your sample and data deleted after use can go a long way in protecting your privacy. However, much more can be done to advocate for better privacy and data protection for all.

As the keepers of the valuable commodity that is DNA, the public have leverage. Governments can be pressured into establishing more stringent regulations on how DNA testing companies store and use the highly sensitive information they receive. Many argue genomic data taken by these companies should have the same burden of protection as other biometric data, e.g., medical information taken by your GP. Other proposals include genomic datasets taken by companies being made a government resource to reduce the costs of testing by the NHS and make them accessible for taxpayer-funded research.

Pandora’s box has been opened, with little warning or fanfare, and there is no going back to a time when some of our most vulnerable and vital information is held by companies. In the same way, we have accepted the collection and monetisation of our online activity by tech monopolies, will our DNA be conceded as the latest conquest of surveillance capitalism?

Although we have naturally welcomed the great leaps in scientific understanding of how we function as living beings, this newfound technology comes at a yet unknowable cost to our privacy. DNA contains our past, present, and future selves. To hand over this information to corporations with a profit incentive is to give them unprecedented power to sell the most basic component of our being. It is incumbent upon our generation to come together to fix the unfairly skewed power balance between the individual and the corporation. As with genomic data, what is insignificant as a singular entity becomes an incalculably powerful tool as a collective.