Personal Genetic Testing & Privacy

By: James Tyack & Holly Cline

An adapted form of this article was originally published in the May 24, 2019 edition of the Columbus Bar Associations Legal Connections newsletter.

It is reported that more than 7 million Americans have taken a direct-to-consumer (DTC) genetic DNA test offered by companies such as Ancestry.com and 23andMe.[1] Upon purchasing a DNA kit, consumers are able to directly send DNA samples—usually saliva—to the company, where the sample is tested to provide insights about ancestry, wellness, and the likelihood of developing certain types of disease.[2] However, once these third-party companies obtain this very sensitive information, it does not remain private.

The proliferation of DTC genetic testing has created a lucrative market for public genealogy databases such as GEDmatch which allow people to anonymously upload their genetic testing results for further ancestry research and evaluation.[3] Indeed, to solve the Golden State Killer case, investigators created a fake profile on GEDmatch, and using DNA from the crime scene, searched the database for relatives, built a family tree, and were able to locate a 72-year-old retiree living near Sacramento. Investigators conducted surveillance on the suspect, ultimately matching the DNA from the crime scene to the DNA found on an item investigators recovered from a trash pull outside of the suspect’s home.[4]

When a person voluntarily submits his or her DNA sample to a DTC genetic testing company, there are very few regulations protecting the privacy interests of these customers.[5] In the context of the Fourth Amendment to the federal Constitution, customers are generally deemed to waive their Fourth Amendment protections against warrantless searches and seizures when they willingly share their DNA material with DTC genetic testing companies or public genealogy websites.[6] This is because, under third-party doctrine, law enforcement officers do not need a warrant to search genetic databases like GEDmatch, as the individual has voluntarily provided information to a third-party entity that publicly shares the information provided.[7] On the other hand, law enforcement officers would likely need to obtain a warrant to search a genetic testing company’s records, as these records are not publicly available.[8]

Notably, the 2018 Supreme Court decision in Carpenter v. United States, 138 S. Ct. 2206 (2018)—which prohibited the warrantless searches of cellphone location data provided to third-party cellphone network providers on the grounds of Fourth Amendment privacy concerns—may be applicable in this context. Indeed, it is likely the Carpenter ruling will apply to extremely sensitive information—such as genetic data—notwithstanding the fact that such information was voluntarily provided to a third-party entity.[9]

Some genealogy database companies are now explicitly offering to conduct forensic searches for law enforcement.[10] Moreover, Ancestry.com’s expressly states that it will use your genetic information for “conducting scientific, statistical, and historical research.”[11] It cautions: “We use other companies to help us provide the Services to you. As a result, these partner companies will have some of your information in their systems. Our partners are subject to contractual obligations governing data security and confidentiality consistent with this Privacy Statement and applicable laws. These processing partners include our: Laboratory partners; DNA test shipping providers; Payment processors; Cloud services infrastructure providers; Biological sample storage facilities; Vendors that assist us in marketing; analytics, and fraud prevention; and, Some Member Services functions.”[12]

While understanding who your ancestors may have been and collecting information regarding your personal health profile may be incredibly valuable, the use of DNA databases to identify individuals who have not consented to sharing their genetic information with third-party companies raises serious genetic privacy and Fourth Amendment concerns.

[1] Jamie Ducharme, Millions of Americans Could Be Identified Using Consumer Genetic Databases—Even If They've Never Taken a DNA Test, Time (Oct. 12, 2018), http://time.com/5423170/dna-test-identify-millions/.

[2] Id.

[3] Id. See also Nsikan Akpan, DNA Ancestry Searches Can Now Identify Most White Americans. Here’s Why That’s Legally Questionable, PBS News Hour (Oct. 12, 2018), https://www.pbs.org/newshour/science/dna-ancestry-searches-can-now-identify-most-white-americans-heres-why-thats-legally-questionable.

[4] See Akpan, supra note 3.

[5] See id.

[6] Natalie Ram, Christi J. Guerrini, & Amy L. McGuire, Genealogy Databases and the Future of Criminal Investigation, Science Mag. (June 8, 2018), https://science.sciencemag.org/content/360/6393/1078.

[7] See Akpan, supra note 3.

[8] Id.

[9] Id., discussing Ram, Guerrini, & McGuire, supra note 6.

[10] See Akpan, supra note 3.

[11] Your Privacy, Ancestry, https://www.ancestry.com/cs/legal/privacystatement (last visited May 8, 2019).

[12] Id.

Disclaimer: The information in this blog post (“post”) is provided for general informational purposes only, and may not reflect the current law in your jurisdiction. No information contained in this post should be construed as legal advice from the Tyack Law Firm Co., L.P.A., or the individual author, nor is it intended to be a substitute for legal counsel or representation on any subject matter. No reader of this post should act or refrain from acting on the basis of any information included in, or accessible through, this post without seeking the appropriate legal or other professional advice on the particular facts and circumstances at issue from a lawyer licensed in the recipient’s state, country, county, or other appropriate licensing jurisdiction.