Privacy concerns

April 24, 2010 at 6:36 pm 1 comment

Privacy concerns with respect to 23andMe services come in two main variations: informational privacy and decisional privacy. According to Anita Allen, informational privacy refers to the access of personal and genetic information, while decisional privacy refers to the lack of any interference with personal choices (Rothstein).

Informational Privacy

The legal expert Alan Westin defines informational privacy as “the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about themselves is communicated to others.” Informational privacy in the context of genetic testing allows consumers to control the access and dissemination of their genetic information. This includes confidentiality measures designed to limit access to such information, as well as anonymity measures designed to protect the identity of an individual or an individual’s genetic sample.

In the Privacy Statement, 23andMe outlines their measures for data protection, confidentiality, and anonymity. These measures include maintaining contact and payment information separately from genetic information, using a barcode rather than personal information to link genetic data derived from a sample to a consumer’s account, and the destruction of DNA and saliva samples after analysis.

23andMe can, according to the Terms of Service, use genetic and “voluntarily contributed information” to develop a database for future research purposes. Consumers provide voluntarily contributed information in the form of surveys and questionnaires found on the site. The company states that a consumer’s account information will never be associated with 23andWe’s research or the database.

In addition, 23andMe is allowed to form collaborative partnerships with for-profit and non-profit companies, including researchers, drug developers, and commercial biotechnology firms (“Terms of Service”). These partners have access to aggregated genetic and voluntarily-contributed data of all 23andMe consumers. Individual-level data is only provided to partners upon consent from each consumer (“Consent and Legal Agreement”).

23andMe views these anonymity measures as adequate to protect a consumer’s informational privacy. However, studies have shown that individuals can be identified from aggregated data, even in the absence of personal identifying information. Homer et. al. showed that individuals can be identified in aggregated samples of up to 1,000 (Homer). In addition, once information is shared with 23andMe partners, there is no guarantee it will be destroyed upon request.

Anita Allen also notes that practices that fall under the purview of informational privacy should also be extended to protect family members. Genetic information about an individual reveals information about his or her family members, and these family members should be able to exercise their right to know or their right to not know about genetic information that may concern them. Genetic tests, even ancestry tests, can reveal information like misattributed paternity, secret adoptions, and anonymous sperm donation. However, 23andMe does not warn its customers about the risks posed to a consumer’s family members, and does not encourage testers to speak with their relatives before using 23andMe’s social networking services.

Decisional Privacy

The Belmont Report of 1979 established the ethical principles by which scientists and researchers are held. The first principle listed in the report, respect for persons, refers to the autonomy of individuals. This principle is applied in many forms today, but most practical applications include the protection of decisional privacy and informed consent measures.

Anita Allen describes genetic decisional privacy as “the freedom to make decisions about health, reproduction, and family life autonomously, free of unwanted governmental or other third-party interference.” Individuals have a right to act as autonomous persons with adequate information to make rational decisions.

In 23andMe’s Terms of Service, Consent Waiver, and Privacy Statement, there is practically no mention of risks posed to family members with regards to decisional privacy. The only time 23andMe acknowledges risks posed to family members is in the Terms of Service, when they warn that individuals should use caution when giving out any personally identifying information about themselves or their children. 23andMe asks the purchaser and user of the test to consent to the terms of service, but does not ask any of the consumer’s family members for consent or even hint that consent might be necessary.

In addition to providing genetic testing services, 23andMe also creates and maintains a database of genotypic and phenotypic information in order to study genetic associations. To recruit participants in these studies, 23andMe must receive informed consent from the test users. In the consent form, 23andMe explicitly states that by obtaining 23andMe’s services, the consumer is also agreeing to contribute their genetic information to 23andMe’s research services, 23andWe (“Consent and Legal Agreement”).

However, there are some concerns that the informed consent of the test user is adequate. As noted in the Belmont Report, to achieve an ethical standard of informed consent, individuals must be given sufficient information to understand the risks of the study, must comprehend the risks of the study, and must voluntarily participate in the study. Recent events surrounding the Havasupai Indian lawsuit against Arizona State University have lead some to question what it means to have fully informed consent for genetic and genomic research, and whether this is achievable at all. Daniel Vorhaus, legal expert and author of the Genomics Law Report blog, writes that fully informed consent may require participants to possess a reasonable understanding of genetics and genomics, a task that “sets a very high bar.” He notes that it is particularly difficult to fully inform research participants of the costs and benefits of participating in the study when the scientific community is still uncertain of many of these risks. There is still a lot that is not known about the relationship between genetic information, ancestry, and disease phenotype. A consumer could share information because he believes it is not medically or personally significant, but he may not understand that the significance of his genetic information may change over time.

Karin Esposito and Kenneth Goodman also questioned the sufficiency of 23andMe’s consent agreement, especially with regard to the risks associated with the compilation of the genotype/phenotype database. When large databases are compiled and analyzed, researchers are able to make associations about very specific population groups, including racial and ethnic subgroups. The authors note that 23andMe does not address potential group harms that might occur, especially if associations are later discovered that were not initially understandable or possible to predict prior to the study. One can imagine a situation similar Havasupai incident: if, for example, individuals of a particular racial subgroup independently agree to participate in a study about one disease phenotype, they may not have consented to a study about the prevalence of a different, socially stigmatized disease in their racial subgroup.

These privacy issues are not addressed by the legal agreements posted on 23andMe’s sites, and should be a source of major concern for users of 23andMe’s services.

Works cited in this post
“Consent and Legal Agreement.” 23andMe. Web. 24 Apr. 2010. https://www.23andme.com/about/consent/.
Esposito, Karin, and Kenneth Goodman. “Genethics 2.0: Phenotypes, Genotypes, and the Challenge of Databases Generated by Personal Genome Testing.” American Journal of Bioethics 9.6 (2009): 19-21. Informa. Web. 5 Apr. 2010.
Homer, Nils, Szabolcs Szelinge, Margot Redman, et al. “Resolving Individuals Contributing Trace Amounts of DNA to Highly Complex Mixtures Using High-Density SNP Genotyping Microarrays.” PLoS Genetics 4.8 (2008). Web. 19 Apr. 2010.
“Privacy Statement.” 23andMe. Web. 24 Apr. 2010. https://www.23andme.com/legal/privacy/#Full
Rothstein, Mark A. Genetic Secrets: Protecting Privacy and Confidentiality in the Genetic Era. New Haven: Yale UP, 1997. Print.
“Terms of Service.” 23andMe. Web. 24 Apr. 2010. https://www.23andme.com/about/tos/.
United States. Department of Health, Education, and Welfare. The National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. The Belmont Report. Office of Human Subjects Research. Web. 19 Apr. 2010. http://ohsr.od.nih.gov/guidelines/belmont.html.
Vorhaus, Daniel. “The Havasupai Indians and the Challenge of Informed Consent for Genomic Research.” Web log post. Genomics Law Report. 21 Apr. 2010. Web. 24 Apr. 2010. http://www.genomicslawreport.com/index.php/2010/04/21/the-havasupai-indians-and-the-challenge-of-informed-consent-for-genomic-research.
Westin, Alan F. Privacy and Freedom. London: Bodley Head, 1970. Print.

Advertisements

Entry filed under: ethics.

Can we really have “recreational” genomics? And that’s all, folks

1 Comment Add your own

  • 1. dnancestree  |  April 25, 2010 at 11:28 pm

    I find it disconcerting that, by submitting a sample to 23andMe, I have put myself at risk of being identified by a curious third party that has access to the company’s entire dataset. Does 23andMe have my full genotype sequenced (including markers for the disease profile that I didn’t pay for) and included in its database? If this is the case, then some third party with extensive knowledge of genetics could gain access to more information about me than even I have. Frightening thought.

    Reply

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Trackback this post  |  Subscribe to the comments via RSS Feed


Archives

Categories

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 3 other followers

Follow Swathi’s blog, too!

Follow my classmate and fellow group member, Swathi, as she explores the ethical issues related to genetic ancestry testing!

DNAncestree.wordpress.com

%d bloggers like this: