Read the fine print

What do we give up in DNA privacy?

There isn’t a day that goes by at The Legal Genealogist without at least one person asking about DNA testing: “What test should I take?” “What’s the best test for…?” “Which test if I wanted to find out…”

But it’s a rare day when someone stops to ask the question that everybody should ask, before testing: “what am I giving up in terms of my own data if I do test?”

This rare question came from reader Cherry Britton, who wrote that she had come across a comment in a New York Times book review. “It shouldn’t have shocked me,” she said, “but it did.” The comment:

We give our data away. We give it away in drips and drops, not thinking that data brokers will collect it and sell it, let alone that it will be used against us. There are now private, unregulated DNA databases culled, in part, from DNA samples people supply to genealogical websites in pursuit of their ancestry. These samples are available online to be compared with crime scene DNA without a warrant or court order.¹

The article is mostly about the collection of personal data on sites like Facebook and GMail, even from our Fitbit trackers… but does include the comment above. So, Cheryl, wanted to know, did The Legal Genealogist have any comment?

Oh, yeah… Sure do…

Now… in some respects, it’s overblown. There are no “private unregulated DNA databases” that are publicly available that are “culled” from genealogical samples: any public DNA database that exists does so because people voluntarily chose to include their samples. And no DNA testing company makes its data available to be compared with crime scene DNA “without a warrant or court order.”²

But that doesn’t mean we don’t give up some of our privacy when we DNA test or when we upload our information to a third-party sharing site like GedMatch or DNALand. To some extent, we all do — and we need to be aware of just what we are giving up when we test.

Before I go on, let me make it clear: I don’t think the risk is a big one. I personally have tested with just about every DNA testing company that’s out there and have a couple more kits on order. I have contributed my DNA to those third-party sites.

I’ve done that because the genealogical upside of connecting with cousins who may have data critical to my family research is enough — to me — to outweigh any downside of making my DNA data available.

But that’s a decision each and every one of us needs to make individually — and we can’t make an informed decision if we don’t know what we’re being asked to give up in terms of our own data.

So here’s the key point: before we test, before we ask a family member to test, before we buy a kit for someone we hope may turn out to be a family member, we have to read the fine print. And we need to make sure the person who’s testing, if the kit is for someone else, reads the fine print too.

Every testing company requires the person tested to sign or provide a consent in some form. What that consent extends to is set out in lengthy documents called either terms of service or something like privacy document — or both.

Every testing company’s requirements are different, and you need to read carefully the fine print at the specific company where you’re testing.

Every testing company requires a certain level of consent in order to test with the company at all, and then may have an opt-in where you can choose to participate in studies ostensibly for the benefit of science and medical advances (but — let’s face it — are ultimately intended to benefit the testing company).

So the first thing we need to do is carefully distinguish between permissions that are required and those that are optional. It’s only the required permissions that we have to agree to in order to do the testing.

The least onerous permissions are those at Family Tree DNA. Family Tree DNA only requires blanket consent “to use … de­identified DNA samples and test results for the purposes of migration and population genetics studies.”³ The privacy document explains that: “Your consent will allow Gene By Gene to share your test results, anonymized and aggregated with those of others who have consented, with our third-party research partners for the purposes of general scientific research intended to lead to publication in peer-reviewed scientific journals.”⁴

For anything beyond that, Family Tree DNA states that “(f)rom time to time, (it) may ask for explicit consent” to use a specific person’s DNA in a specific way — but nothing more is required.⁵

At AncestryDNA, the up-front required consent is broader:

AncestryDNA will analyze Users’ genetic, genealogical, and health information, to provide results, including an ethnicity estimate, to each User (the “Results”) and will use aggregated Users’ Results to make discoveries in the study of genealogy, anthropology, genetics, evolution, languages, cultures, medicine, and other topics. …

By submitting DNA to AncestryDNA, you grant AncestryDNA and the Ancestry Group Companies a perpetual, royalty-free, world-wide, transferable license to use your DNA, and any DNA you submit for any person from whom you obtained legal authorization as described in this Agreement, and to use, host, sublicense and distribute the resulting analysis to the extent and in the form or context we deem appropriate on or through any media or medium and with any technology or devices now known or hereafter developed or discovered.⁶

There’s a broader opt-in for more detailed research, but this much is required — you can’t test with AncestryDNA without accepting this.

At 23andMe, you can opt in to allowing the use of your DNA with identifying information or for peer-reviewed scientific research, but that’s not required. What is required is that you agree that your collective DNA can be used perform research & development activities, which may include, for example, conducting “data analysis and research in order to develop new or improve existing products and services, and performing quality control activities.”⁷ 23andMe explains what that means:

We may share aggregate information with third-parties, which is any information that has been stripped of your Registration Information (e.g., your name and contact information) and aggregated with information of others so that you cannot reasonably be identified as an individual (“Aggregate Information”). This Aggregate Information is different from “individual-level” information. Individual-level Genetic Information or Self-Reported Information consists of data about a single individual’s genotypes, diseases or other traits/characteristics information. For example, Aggregate Information may include a statement that “30% of our female users share a particular genetic trait,” without providing any data or testing results specific to any individual user. We may provide such Aggregate Information in commercial arrangements with our business partners. In contrast, individual-level Genetic Information could reveal whether a specific user has a particular genetic trait, or all of the Genetic Information about that user. 23andMe will ask for your consent to share individual-level Genetic Information or Self-Reported Information with any third-party, other than our service providers as necessary for us to provide the Services to you.⁸

If test with any other service, like the new testing at MyHeritage, or if you go further and choose to upload your DNA data to a third-party site like DNALand or GedMatch, each of those sites will have its own required privacy statements and rules. Under any of them, you will be agreeing to give up some degree of privacy in and control over your data.

Bottom line: read the fine print. You may well decide, as I have, that the risks are well worth it given what we can learn when we test. But we can’t give informed consent if we don’t read the terms of what it is we’re consenting to.

SOURCES