Getting to know you: What do genetic testing companies get when you send them your DNA?

Have you taken a DNA test to find out where in the world your ancestors came from? If so, congratulations! You may have helped create a new treatment of psoriasis.

How is that even possible? Turns out a direct-to-consumer genetic testing company sold the rights to DNA samples to a major drug company to help develop the treatment. Most people would not see this as a problem but it raises very real privacy concerns.

Back in 2018, Time Magazine reported that the genetic testing company 23andMe sold a $300 million dollar stake in the company to GlaxoSmithKline, a UK-based pharmaceutical giant. This granted GlaxoSmithKline access to a gold mine of genetic information to use as it sees fit.

DNA & privacy

Most people don’t even realize that, when they spit into the tube and mail it off, they consent to having their information shared with other parties. Genetic information submitted to companies such as 23andMe is increasingly being used for additional purposes, such as drug development or in relation to criminal investigations. Without reviewing the fine print, consumers may be signing their DNA over without realizing the privacy risks.

While most people may be happy to give a bit of DNA in the pursuit of a medical breakthrough – see SickKids’ “Spit for Science” initiative – there is concern that companies in the DNA business may not provide sufficiently clear information about the use of DNA data, or may not be able to ensure data security when they share that data with third parties. In an interview with Time magazine, Peter Pitts, the president of the Center for Medicine in the Public Interest stated:

If people are concerned about their social security numbers being stolen, they should be concerned about their genetic information being misused… This information is never 100% safe. The risk is magnified when one organization shares it with a second organization. When information moves from one place to another, there’s always a chance for it to be intercepted by unintended third parties.

Profits both ways

According to New Scientist, 23andMe also used consumers’ DNA data to develop a new treatment for inflammatory diseases. It then licensed the treatment to Spanish pharmaceutical company Almirall.

Aside from the data and privacy concerns, these deals raise an important fairness question for consumers. Why are we paying to give away our DNA to a company that exploits it for profit?

As The Verge notes, “The terms of service say that customers who agree to let their data be used will not see any financial benefit, even if that data helps develop a blockbuster drug.”

This issue is not new. Companies like Google and Facebook collect mountains of personal data, from which they profit. In cases like Equifax, the data may be compromised if it is not fully secured.

With DNA testing companies, the difference is that consumers pay for the privilege of enriching the companies.

In 2019, California Governor Gavin Newsom made waves by suggesting that consumers be paid a “data dividend”. The specifics of the plan are unclear: who pays?, how much?, to whom?, and when? But the idea is to share profit with the persons whose information generated it.

How to protect yourself

Know what you’re getting into. DNA testing companies are sophisticated, and their terms and conditions are very carefully crafted. Before sending off your spit, investigate what your rights are, and what rights you are giving up.

In 2017, the Office of the Privacy Commissioner of Canada released a statement detailing the potential privacy risks associated with direct-to-consumer genetic testing, including the following:

consumers often do not know exactly what personal information is being collected;
consumers may consent to their data being shared with third parties, but lose control over the data once it is shared; and
consumers' information may be stored in or transferred to another jurisdiction with completely different privacy laws.

Before ordering a direct-to-consumer genetic testing kit, do some research. Contact the company to ensure you know what you are paying for. Make sure you are aware of your rights as a consumer. And make sure you read the fine print to protect yourself and your genetic information.