What You Should Know About Privacy BEFORE You Take a DNA Test!

Especially as personal DNA testing increases in popularity, and with increased media attention to cold cases solved via DNA and the use of genealogy databases, today’s genealogist needs to stay on top of the latest information concerning privacy.

Has your concern for privacy prevented you or a family member from taking a DNA test? What about sharing your genealogy research data online with practical strangers (even though you might be related)?

We’ll review the current status of privacy practices by the big genealogy and DNA vendors, current laws, and regulations, and what we might expect to see related to privacy in the future.

Issues to Consider BEFORE and AFTER Taking a DNA Test

• What are the current DNA privacy practices for each of the major DNA test kit vendors?

One of the best resources to stay up-to-date with each of the major DNA test kit companies is to consult the International Society of Genetic Genealogy (ISOGG) Privacy policies, consent forms and terms and conditions wiki page.

• Is privacy perceived differently in Europe compared to the United States?

The General Data Protection Regulation (GDPR) went into effect for all European Union (EU) countries in late May 2018. These regulations govern the use of personal information for EU citizens, even for US-based DNA vendors. Most of the DNA test kit vendors have separate pages for EU citizens. In addition, some countries such as France and Poland, do not allow the sale of personal DNA test kits.

• Privacy is a major concern for citizens of every country, and you can’t avoid the topic in the news these days. Is the media focused on privacy and DNA hurting those who research genealogy and family history? And if so, in what ways?

The media, especially in the US and the UK, have resorted to inaccurate and dramatic headlines resulting in “panic” over DNA and privacy. While many of the articles and issues are legitimate, those producing the content lean towards an over-simplified explanation of how DNA testing and privacy work. Many of the practices used by DNA test vendors—such as selling DNA metadata to third-party vendors, including pharmaceutical companies—are outlined in each company’s Terms of Service and Privacy Policy. See A Major Drug Company Now Has Access to 23andMe’s Genetic Data. Should You Be Concerned?.

• If someone said they wouldn’t take a DNA test due to privacy concerns, what recommendations would you make to them?

You could show them the policies governing privacy and data for the company you are using for testing. Use the resources at the end of this section and send them articles covering DNA and privacy so that they can make an informed decision. If you feel that the benefits of DNA testing for family history and genealogy research (or locating birth parents) outweighs a loss of privacy, show them evidence of how you have used DNA test results successfully.

Another option is to use a “burner email address” much like some consumers use a “burner cell phone” when they don’t want their activity traced. Create a new email address for free using Google Mail, Yahoo, or Outlook and use it when ordering a DNA test kit. Use the same email when receiving the DNA test results. In addition, DO NOT sign up for “matching” with other users. Simply download the DNA test data and use it in your research.

• What is “informed consent” and is there a form I can use when managing DNA test kits and results for others?

Informed consent is usually in the form of an agreement whereby a party consents/agrees to certain actions involving a matter. When it comes to administering a personal DNA test for a friend or relative, I highly recommend that an informed consent agreement be executed and preferably one offering a variety of choices to the person taking the DNA test. The National Human Genome Research Institute offers a comprehensive explanation of informed consent for the use of DNA test data HERE.

One of the best examples of an informed consent agreement that you can use if you manage DNA test kits for others is the Informed Consent Agreement and Beneficiary Agreement at The Genetic Genealogist

In addition, many DNA test vendors such as AncestryDNA have an informed consent agreement in force for consumers who purchase and use their AncestryDNA test product. See AncestryDNA Informed Consent.

• Is it possible to create a baseline set of “best practices” for genealogy and DNA testing?

There is no “one” set of DNA privacy guidelines being followed by both DNA vendors and DNA testers. The Future of Privacy Forum has set out Privacy Best Practices for Consumer Genetic Testing. The Board for Certification of Genealogists has set out Standards for DNA Evidence which include a section entitled Respect for Privacy Rights. Also see Best Privacy Practices for Genealogy and DNA below.

• Could “block-chaining” technology be the key to tracking DNA data usage and ensuring privacy?

Block chaining, the backbone technology of cryptocurrency, can be used to track the use of DNA data. Relying upon a “public ledger” of authority agreed to by all users and an “owner of record,” block chaining can effectively track permission to use (or not use) DNA data as well as all transactions where a specific set of DNA data is being used. Companies such as GeneCoin have already started to use block chaining for DNA data.

• Finally, what does the future hold for privacy, DNA, and genealogy?

In January 2019, 23andMe stated publicly that their sales had decreased since April 2018 when the Golden State Killer case (a 30-year criminal cold case solved using public DNA data) was in the media. Since then, not a week has gone by that there hasn’t been a media story about a criminal cold case being solved using DNA data. Right now, among the millions of users who have taken a personal DNA test, many support the efforts of law enforcement and see nothing wrong with their own DNA test data being used to capture and convict criminals. At the same time, many of these same customers are concerned that their privacy is being violated and that their information is being collected without the benefit of a warrant or subpoena served against a DNA vendor. It appears that since 2018, the role of DNA test data in crime solving has had a major impact on DNA test kit sales and potential consumers are more hesitant to take a DNA test.

Best Privacy Practices for Genealogy and DNA

If you could come up with a list of best practices to be followed by both genealogists, DNA testers and DNA test companies, what would they be? Areas to cover include:

• Expectation of privacy: Is it reasonable for a consumer to expect their DNA test results to be kept private? Should law enforcement need a warrant or subpoena before gaining access to DNA test data? If your DNA test data has already been shared with other companies (pharmaceutical, etc.), can privacy ever be restored retroactively?

• Informed consent: When asking relatives to take a DNA test for genealogy and family history research purposes, use a “consent form” outlining how the data will be used by both you, the researcher, and the DNA vendor.

• Selling DNA data: How do we control who has access to your DNA test data when shared by the DNA vendor with other third-party companies? How can we be sure that only metadata (data stripped of any identifying features traceable back to you as the tester) is being shared? If a pharmaceutical company creates  a profitable new drug based on the use of your DNA data, should you be entitled to compensation?

• Health information including usage and access: What if health insurance companies and life insurance companies could use DNA metadata to create new actuarial tables calculating projected life spans, etc.? What if these same companies could use your specific DNA data to deny you coverage?

Editor’s Note: Visit DNA Bargains at https://dnabargains.com for the latest, up-to-date coupons and promo codes BEFORE you purchase any DNA test kit.

©2023, copyright Thomas MacEntee. All rights reserved,