DNA for sale: Who owns your genes?

Have you taken a DNA test? You pay about a hundred bucks to spit into a tube, ship your saliva to a lab, and find out where your ancestors hailed from or identify health risks. There’s a lot to potentially gain—or lose.

The consumer DNA market is poised to become a $10 billion business by 2022. Dozens of companies sell home DNA test kits. Some, like Ancestry.com and FamilyTreeDNA, allow you to divine your ethnic background and connect with distant relatives. Others, like 23andMe, can also identify genes linked to 10 diseases, including Alzheimers, Parkinson’s, and Celiac’s.

The ads for these services, already purchased by millions of Americans, don’t tell you that unlocking your genetic code could also get you in legal trouble, prevent you from getting life insurance, or lead to your parents’ divorce.

And Uncle Sam has his own stash of DNA. The FBI’s Combined DNA Index System contains more than 16 million samples taken from alleged offenders and victims, and has been used in roughly 400,000 investigations. The U.S. military has about 3.8 million DNA samples. Some have been used to exonerate hundreds of wrongly convicted inmates. And many have been used to prosecute people charged with crimes.

The National Institutes of Health is recruiting a million people to donate DNA to a massive research project into precision medicine that could lead to individualized treatments. Multiple private organizations, including Kaiser Permanente Research Bank, are doing this on a smaller scale.

In short, there’s a ton of DNA floating around. Yours might be among it. So what happens to your genetic information? Who has access to it, and what can they do with it? The rules aren’t always clear.

Genetic code meets U.S. Code

The Genetic Nondiscrimination Act of 2008, known as Gina, prohibits employers and health insurers from using your genetic information against you. DNA showing an increased risk of developing breast cancer, for example, can’t be used to deny someone employment, a promotion, or health coverage.

Although a handful of states, including California, have passed Gina statutes prohibiting schools, banks, landlords, and other institutions from using DNA data, Gina itself is limited. Among other things, it doesn’t prohibit a life or liability insurer from using data garnered from your double helix to deny you coverage, a school from expelling your child, or a bank from denying you a mortgage.

Gina is also is under attack. Last March, a U.S. House of Representatives subcommittee approved H.R. 1313, designed to allow employers to collect employee DNA as part of a “wellness program,” and to charge those who decline to provide samples more for health insurance. The bill has yet to be voted on by the full House.

Sharing spit

What might a DNA-testing service do with your genetic data? Look no further than its privacy policy, which it may update at any time. Also keep in mind that any data it possesses is an asset that can be transferred in an acquisition.

All the privacy policies of the services we looked at (23andMe, Ancestry, FamilyTreeDNA, FamilyVault, and MyHeritage) say that excepting law enforcement agencies, they won’t release personal information to third parties without consent. They must dispute or comply with police department requests.

According to its 2017 Transparency Report, 23andMe received five legal requests for DNA data and declined all of them. In 2016, Ancestry received nine requests and provided information in response to eight of them, but all were for transactional data related to credit card fraud, not genetic data, according to a company representative.

Family ties

In 2015, however, Ancestry complied with a police request in Idaho Falls, Idaho, for the name of a person whose DNA it found in a public database the company owned. Michael Usry Sr.’s DNA partially matched apparent evidence from a 1996 murder. The DNA, which indicated that a close relative of Usry could be responsible for the murder, led to the arrest of his son, Michael Usry Jr.

A subsequent genetic test of Usry Jr. cleared him, police determined that the DNA evidence linking the Usry family to the crime was probably flawed, and Ancestry made the database private. But this controversial investigative technique, known as “familial searching,” is still used by at least 10 U.S. states, and is credited with bringing Kansas’ “BTK” and California’s “Grim Sleeper” serial killers to justice.

Maryland and Washington, D.C., have banned familial searching, and Stephen Mercer, an attorney for Maryland’s Office of the Public Defender, has called the practice “a particularly corrosive form of genetic surveillance.” He asserts that it unfairly targets minorities, who are over-represented in criminal DNA databases, and violates Fourth Amendment protections against unlawful search and seizure.

To keep, trash, or recycle DNA?

What happens to the DNA sample itself also varies by service. Unless you opt into its BioBank, 23andMe destroys your sample after analyzing it. But Ancestry and Kaiser Permanente’s research bank keep it unless you request its disposal.

All the services we surveyed say they store samples separate from other personal information; someone who manages to steal your saliva wouldn’t be able to connect it to your name, says Eric Heath, Ancestry’s chief privacy officer. He says one reason many DNA labs keep samples is that, as new types of tests arise, customers can choose to have their samples re-analyzed and their profiles updated.

Stored saliva also represents a lucrative stream of revenue for DNA-testing companies. They can sell your anonymized genetic information to research firms, over and over, provided that you’ve given consent.

Not so anonymous

Because DNA is such a perfect biometric identifier, even “anonymized” data may not stay unidentified forever. In 2013, researchers identified the surnames of men in publicly accessible genetics databases using a few key markers of so-called anonymous DNA.

Sharing genetic information also can lead to life-altering experiences such identifying your sperm donor, or discovering a half-sibling. (This led to the divorce of one man’s parents.)

DNA is the most deeply personal information you have; what it reveals can change your life indelibly. So think carefully before you share it with the world.