SALT LAKE CITY — The genetic testing company 23andMe calls it a research partnership. Critics call it a profit-driven sale of intimate data.
But regardless of how you characterize the recent deal between 23andMe and pharmaceutical giant GlaxoSmithKline, the most apocalyptic outcomes envisioned on social media — to include involuntary cloning and widespread cancellation of insurance policies — are not likely to occur, analysts say.
For one thing, 23andMe is not handing over a freezer full of its customers' DNA encased in frosty slides, but an anonymous and aggregated database that the London-based drugmaker will use for research.
23andMe has struck deals with drugmakers before and has a robust opt-out policy for its users. Six days after the announcement, it was among five genetic-testing companies (including Utah-based Ancestry.com) that agreed to abide by a list of best practices, crafted in conjunction with the Future of Privacy Forum.
Leah Larkin, a San Francisco Bay-area biologist who uses genetic tests to help people find their biological families, is a 23andMe client who believes the company has done a good job of informing consumers about their rights. Furthermore, she notes, GSK and other drug companies aren’t interested in the genetic information of individuals.
“The DNA of a single person is practically worthless for biomedical research. It only becomes valuable when researchers can associate that DNA profile with health traits for that person and analyze thousands of people with the same health traits together,” said Larkin, whose company is called The DNA Geek.
Still, to many, the idea of 23andMe banking $300 million in exchange for their customers’ genetic information is unsettling, particularly since the customers paid up to $199 to have their DNA analyzed. Some people have suggested that 23andMe customers should share in the profits of any drugs that are developed.
And because the beneficiary of that data is a pharmaceutical company that stands to profit handsomely from any new drugs it develops, the deal has reminded some people of Henrietta Lacks, the African-American mother whose cancer cells were widely used in research for decades after her death from cervical cancer in 1951.
Today's consumers, however, have something Lacks was denied during her treatment: laws governing informed consent. "If the decision is an informed one, some of these ethical issues are minimized," said James Hazel, a researcher at Vanderbilt University's Center for Genetic Privacy and Identity in Community Settings.
Larkin has a Ph.D. in biology, which she puts to good use in her work with adoptees who want to learn about their biological heritage. When she first used 23andMe a few years ago, Larkin was among the 20 percent of the company’s customers that chose not to let the company share their data. Over the years, she’s adopted a softer position on this, largely because of what she believes to be a good-faith effort by the largest genetic-testing companies to be transparent about their practices.
Of 23andMe's disclosures about its deal with GSK, she said, “I think they’re going above and beyond,” she said.
Hazel, a postdoctoral fellow at Vanderbilt University in Nashville, agrees that the largest genetic-testing companies do a good job of being transparent, but his year-long study of 90 U.S. companies in the field found “tremendous variability” in both their practices and what they tell consumers.
In the study, to be published later this year, Hazel and his co-investigator Christopher Slobogin examined the privacy policies of companies that offered direct-to-consumer DNA analysis for purposes of genealogy, family relationships or wellness and health. (Even weight-loss companyJenny Craig now offers DNA testing to craft personalized diets.)
About half of the companies addressed what would happen to the consumer’s physical sample. Of those, about half stored the sample indefinitely, but the majority gave the customer the ability to opt out. About 30 percent said they destroyed the sample.
It's the dramatic differences among policies that should make consumers hyper-alert to what's in the fine print, Hazel said.
Just five companies — 23andMe, Ancestry, Helix, MyHeritage and Habit — signed off on the “best practices” policy recently released, and Hazel is concerned the policy only applies to identifiable data, not the data stripped of identifying information and shared with companies such as GSK.
The worries are not so much that 23andMe or Ancestry have devious aims. The companies have pledged not to release information to employers, insurance companies, schools or government agencies without a court order. More of concern is that criminals can get access to the data and find ways to exploit it. Earlier this year, MyHeritage revealed a security breach affecting 92 million users.
At Ancestry, the largest genetic-testing company in the U.S., customers have to explicitly opt in to participate in research and can revoke participation at anytime, the company said in a statement. "Currently, Ancestry has only one research collaboration, and it's with a non-profit academic institution," the statement said.
23andMe did not respond to questions posed by the Deseret News.
GSK paints its partnership with 23andMe as altruism, an opportunity for consumers to participate in research that could result in life-saving medicines. “You don’t have to be a scientist to help discover medicines,” the company says on its website.
The company, which manufacturers Augmentin and Amoxil, two commonly prescribed medicines for childhood ear infections, is already using 23andMe data for research into treatments for Parkinson’s disease, said Matt Nelson, the company’s chief of genetics.
The opportunities presented by genetic databases are still being discovered, but some researchers believe that drugs developed with such information are twice as likely to be as successful as those developed without it, Nelson said. Five or so years ago, the largest such databases had only a few hundred thousand people; today, GSK has access to genetic information on 4 million Americans in this deal alone.
“It’s only within the past few years that the databases have reached enough scale that we are learning new and insightful things about how genes affect disease,” he said.
As for suggestions that consumers should profit from use of their data, Ancestry.com says plainly on its website that this will not happen, and Nelson, with GSK, said almost all biomedical research depends upon a “generous and interested public” to make advances. And both Larkin and Hazel agree the arrangement between 23andMe and GSK potentially has benefits for society.
“I think research is a good thing. There are certainly positives that can come out of collaborations like this. But I think it all boils down to making sure that consumers are making that informed choice about whether to have their data used for those purposes,” Hazel said.
What could go wrong?
For consumers, the worst-case scenarios that Twitter users devise — such as companies cloning you without your permission — belong to the realm of science fiction, most analysts say. Even more realistic fears — such as an insurer canceling or denying coverage because testing revealed a propensity for breast cancer — are unlikely because of the companies’ increasing sensitivity to privacy and their de-identification of data, Hazel said.
This doesn’t mean that there aren’t concerns, however, he said.
One is that consumers might be releasing data that could be ultimately used for research they might oppose on moral grounds. Another is the risk of re-identification of anonymous data down the road. As the Federal Trade Commission has warned, "Hacks happen." And 23andMe acknowledges this on its website, saying, "In the event of a data breach, it is possible that your data could be associated with your identity, which could be used against your interests."
There’s also concern about people being wrongly accused of a crime, as in the case of a New Orleans man who was investigated for an Idaho murder based on familial DNA matching through Ancestry. There is the risk of extortion if criminals obtained identifiable user data through a security breach. And some people have speculated that an individual’s genetic data could be used against them in a political campaign, job search or custody battle.
But a more plausible risk comes not from others’ use of your information, but from individuals knowing it themselves.
“I would be more worried about getting some of these health-related tests that 23andMe offers and then potentially having to disclose that information, if I’m seeking insurance, as part of an application process,” Hazel said.
That's something that consumers should think about before opting for a test, regardless of whether a company shares data with a pharmaceutical company or a nonprofit academic institution, as Ancestry does.
And consumers should remember that, as important as our DNA is, we leave it everywhere we go. Companies that offer surreptitious DNA testing can obtain it from a discarded soda can, a fingernail clipping or cigarette butt.
That said, Larkin says to protect yours by reading company disclosures. “It’s there, and it’s written in pretty easy-to-read language. If you agree to it, sign off; if you don’t, don’t,” she said, adding, “You can always change your mind later.”