The kits, popular for helping people learn about potential future medical complications and their ancestry, also have been used to identify alleged murderers. A Sacramento, Calif., man was arrested and charged with 12 counts of murder in 2018 thanks to a little-known genealogical website.
Authorities working to crack the case of the Golden State Killer built an online genealogical profile using DNA from a decades-old crime scene, then used it to find distant relatives with matching genetic profiles.
“There’s a big difference between deleting data versus destroying a sample.”—James Hazel, postdoctoral research fellow, Center for Genetic Privacy and Identity in Community Settings, Vanderbilt University Medical Center
The breakthrough led to the long-sought capture of an infamous alleged murderer and rapist. It also surfaced ethical and privacy issues surrounding direct-to-consumer genetic-testing companies. Among them: How do they use and store your DNA samples and the data they generate. And how easy is it to delete and destroy those samples and the resulting genealogical profiles?
According to James Hazel, a postdoctoral research fellow at the Center for Genetic Privacy and Identity in Community Settings at Vanderbilt University Medical Center, those answers aren’t very clear.
“There’s tremendous variability in these companies’ policies across the industry,” he says. “Some are very comprehensive, while others provide little to no information.”
In a research paper he co-authored on direct-to-consumer genetic-testing companies and their privacy policies, Hazel found that nearly 40 percent had no specific policies in place that applied to testing practices. Of those that did, 29 percent had a policy that addressed destroying samples, though many said destroyal would be carried out according to the laboratory’s standard operating procedures, or as required by a certifying or accrediting agency. Few distinguished between the physical DNA sample and the extracted data.
Just 9 percent stated that a consumer could delete all genetic data possessed by the company, according to the report. Hazel said deleting genetic data is quite difficult.
“There’s a big difference between deleting data versus destroying a sample,” he says. “More companies today use CLIA [Clinical Laboratory Improvements Act]-certified labs, which may retain test results for 2 to 10 years for quality control purposes,” he explains. Retention policies surrounding summary statistical data that has been de-identified aren’t necessarily a cause for privacy concerns, he says, but they might when applied to sets of individual, personally identifiable data.
Here’s a look at five popular genetic testing companies and how to delete your data or have your sample destroyed.
23andMe extracts the DNA from your saliva sample for tests that include your ancestry; genetic health risks; wellness data, such as lactose intolerance; and various other traits, such as your finger length ratio, or your abilities to match musical pitch or smell “asparagus pee.”
While you can update your preferences in your account settings, the contracted genotyping laboratory will retain certain information to comply with applicable regulatory and legal obligations, it says. This data includes your date of birth, gender, and genetic information.
If you delete your account—which you can also do through your account settings—23andMe will delete all associated personal information and discard your stored samples, with the exception of legal retention requirements and data that you consented for 23andMe to use in completed studies, it says.
AncestryDNA uses a saliva sample to identify information about your geographic origins and potential relatives through DNA matching with others who have taken the test.
If you request that Ancestry delete your DNA data, it will remove all genetic information, including any derivative genetic information—such as ethnicity estimates and genetic relative matches—from its production, development, analytics, and research systems within 30 days, according to its privacy statement.
The only way to request the destruction of your biological sample is through its Member Services. If you agreed to Ancestry’s Informed Consent to Research, it will be unable to remove your genetic information from active or completed research projects, it says.
Partner company Helix says it may store your DNA sample indefinitely for “quality control and optimization” in its lab. To request that your stored saliva sample and DNA is destroyed, contact its customer care center.
To request the destruction of your DNA sample, send MyHeritage an email.
Orig3n says it helps its users discover how their DNA could impact their athletic performance and preferences; how they learn new skills; or how they think, feel, act, and react.