DNA kits raise security concerns

WASHINGTON – Test kits to check one’s DNA heritage have never been cheaper. Prices have fallen to less than $50, and in at least one instance, thousands of people were offered free tests.

It’s a commercial brawl, but one that stretches far beyond the marketplace to raise sensitive issues of privacy and personal identity. And it is likely to intensify. Ten million to 15 million people in the U.S. have already taken the DNA tests, and the number is rising quickly.

For many people, the tests are fodder for cocktail conversation, revealing exotic aspects of their heritage. For others, results can help track lost relatives or build family trees.

As DNA tests proliferate, though, some experts worry that consumers may be getting a bad bargain. They say DNA data may fall into the wrong hands.

The DNA kits, and advertising for them, are spreading fast. In September, a biotech company, Orig3n Inc., promised 55,000 football fans headed to Baltimore’s M&T Bank Stadium for a Ravens game that they would get a free DNA test. All they had to do was swab their mouths and drop the swabs in a bin on the way home.

Maryland regulators questioned the promotion, and to avoid potential legal problems, the company postponed the plan before game day.

Competition is intensifying. Year-end sales that began around Thanksgiving made some DNA kits available for slightly under $50.

Not mentioned in the sales blitz and bargain-basement pricing, though, is that human genetic material can be extremely valuable to some commercial interests, experts say, and some companies are making a profit by selling the information they collect.

“They are selling it to you on the front end, and they are commercializing it on the back end,” said Bennett Greenspan, president and founder of Family Tree DNA, a Houston company.

Senate Minority Leader Charles E. Schumer, D-N.Y., has called for more scrutiny of how the consumer genomics companies can sell DNA databases.

“DNA testing firms don’t clearly disclose to consumers exactly what they are doing with the DNA once a person’s cheek swab is sent in to the company,” Schumer said. “Most people, if they knew that this information could be sold to third parties, would think twice. ”

Schumer has urged the Federal Trade Commission to examine the industry to ensure that companies have “clear, fair privacy policies.”

At least a half dozen companies are significant players in the field, including Ancestry, 23andMe and MyHeritage. Many smaller ones, some in Europe, also compete.

“It’s doubling in size practically every year. It’s just growing at an astronomical rate,” said Blaine T. Bettinger, a lawyer in Syracuse, New York, who also holds a doctorate in molecular biology and blogs as The Genetic Genealogist.

“People are naturally curious over what their DNA can tell them,” said Michelle De Mooy, director of the privacy and data project at the Center for Democracy & Technology, a Washington think tank that studies privacy and governance issues.

But De Mooy said there are problems ahead for the industry, particularly if testing companies don’t adequately protect the security of the genetic databases and ensure that consumers don’t find that their own DNA is giving business or the government a leg up against them.

“It’s really inevitable that these databases will be breached” by hackers, De Mooy said. “This is just tempting, tempting data for the government, too.”

And accusations have intensified over the sale of DNA databases by the companies themselves.

Greenspan’s company in November launched a social media video campaign hitting on the theme. In one ad, a company spokesman says, “Family Tree DNA will never sell your genetic data. Can the other guys say that? Nope.”

Even as transparency is being called into question, the companies acknowledge that confidence is essential to growth.

“This business is based on trust, and without the users’ trust, it doesn’t exist,” said Eric Heath, privacy officer for Ancestry, the giant in the field with more than 6 million customers.

Ancestry, headquartered in Lehi, Utah, shares some DNA databases with Calico, a division of Alphabet Inc., the parent of Google. Calico is a biotech company focused on combating aging. Ancestry says that all genetic samples are anonymized and transferred only with users’ consent.

“We state essentially, ‘You, our users, own your DNA data.’ If at any time you want to take it away from us, we’re more than happy to give it back to you,” Heath said.

Greenspan said some legal language that authorizes companies to sell DNA databases is deep in lengthy customer user agreements.

“Most people other than lawyers really don’t read the fine print,” Greenspan said.

23andMe, which says it has tested more than 3 million people worldwide, says about 80 percent of clients opt in to participate in research programs, which include some conducted by pharmaceutical companies, academic institutions and nonprofit groups looking for cures to diseases.

“We do not sell individual customer information nor do we include any customer data in our research program without an individual’s voluntary and informed consent,” said Kate Black, the company’s privacy officer.

Information shared with or sold to third parties is anonymized, unless clients agree to give additional information, Black said, and recipients are “required to meet the same rigorous security standards as we hold ourselves to, including robust technical and organizational controls.”

Outside the industry, health experts say they worry that as scientists find new genetic markers for predisposition to disease or risky behavior, the DNA data banks will become both more valuable to outside parties and more risky for consumers.

“If you had a genetic test, and your genetic test showed that you might be predisposed to develop early onset Alzheimer’s disease, and that information was made public, how would your employer feel about that?” said Peter Pitts, president of the Center for Medicine in the Public Interest, a New York-based research group.

Pitts said he feared that criminals could also target victims by impersonating them with their DNA samples.

“If people are trying to imitate you based on your Social Security number, imagine the damage they could cause impersonating you on the genetic level,” Pitts said.

Heath, the Ancestry executive, downplayed such fears, saying that genetic material is already widely available to criminals, who don’t know how to use it.

“You go to your barber shop, that place is full of DNA,” Heath said.

Of greater concern to Robert Lord, chief executive of Protenus, a Baltimore startup that helps health care organizations protect their digital records, is a potential desire by industry and business to exploit their customers through DNA research.

“Perhaps we start to understand that particular genetic markers indicate a susceptibility to more addictive behaviors,” Lord said. “You could imagine that gambling institutions or casinos might say, ‘Well, you know what? Why don’t we target and segment individuals who have addictive personalities?’ ”

Other industries could also take an interest, such as insurance companies that find a genetic indicator of people prone to risky behavior.

“You could be priced out of insurance before you are even born,” Lord said.

The one natural brake on the DNA testing industry is skepticism among some consumers.

“They are worried about health insurers getting their information or the government having access to their information, law enforcement having access. I’ve encountered a lot of resistance to testing because of privacy concerns,” said Bettinger, the lawyer and genealogist.