Are you unknowingly forfeiting your genetic privacy rights?

Posted by Katherine M. Silverman on

The issue of genetic privacy is getting a lot of attention in the media lately, mainly due to the role DNA has played in identifying suspects in prominent “cold cases” like that of the Golden State Killer. But use of these “genetic genealogy” tools has raised concerns from privacy advocates who fear that genetic information shared on public genealogy databases could be misused. While “oversharing” personal information on social media has become par for the course, it’s important to think carefully about what information you’re publishing on the internet and who might have access to that information in the future.

How does “genetic genealogy” work?
In criminal cases, DNA is often recovered from a crime scene. Until recently, investigators would only run the DNA through a government database known as CODIS. However, if the suspected perpetrator wasn’t already in the CODIS database (through a prior arrest or conviction), the investigator would be at a dead end. Recent advances in “genetic genealogy” have allowed investigators to run DNA samples from crime scenes through much larger public databases, such as GEDmatch. Many of these public databases aggregate genetic profiles from commercial websites such as Ancestry.com or 23andme. If the investigator finds a link, even to a distant relative, they can use that information to begin building out a family tree, which may eventually lead to the identification of the perpetrator.

Genetic privacy: what do you need to know?
At the federal level, the Genetic Information Nondiscrimination Act of 2008 (GINA) regulates the permissible use of genetic information by health insurers and employers. GINA prevents health insurers from denying coverage to an individual based solely on a genetic predisposition to develop a disease in the future. The law also bars employers form using an individual’s genetic information in employment decisions. In Georgia, O.C.G.A. § 55-54-1, et seq. provides a basic right to genetic privacy, but Georgia law is limited to preventing health insurers from denying coverage to an individual based on information obtained through genetic testing.

How can you protect yourself?
Talk to your family members about the risks and benefits of uploading their genetic profile to a public database. While the idea of finding long-lost relatives is appealing, the privacy policies on many commercial genealogy websites allow these companies to share and monetize your genetic information without any obligation to notify you or obtain your consent. And while most of us would be willing to assist law enforcement officers in investigating a serious crime, the potential applications for this technology are only beginning to emerge. Many people don’t realize that by uploading their genetic information, they are exposing their relatives, including children and grandchildren to a loss of genetic privacy. If your relatives have already uploaded their genetic profile, ask them to check the privacy policy on the website they used, or to explore whether the website allows them to “opt out” from having their information publicly available.

Finally, if you suspect that your genetic information is being misused by a health insurer to deny you coverage or by an employer in an adverse employment decision, you may have a legal remedy.