The mother of adopted twin girls, Joan Romano said the only information she had about her daughter’s background was their Chinese heritage.
“Nothing,” she said. “We had no idea of anything.”
The mystery prompted her to buy two home DNA kits.
“I have friends in the adoptive community, and they were saying this way, we could get some health ideas," she said. "I really wanted to know if there was something we needed to worry about.”
The test cost less than $100 and was easy to take – just spit in a tube and drop it in the mail. In two weeks, Romano sais it was “immediate relief.” Nothing in the girls’ health profile showed risk for disease.
For Romano, the test offered reassurance. But increasingly, some researchers are concerned about how the tests are being used and what happens to your DNA once it’s mailed off.
“It’s just click click click -- and you’re not really thinking about it,” said Dr. Katherine Drabiak, a lawyer and assistant professor at the University of South Florida’s College of Public Health. Drabiak has been studying the rise of genetic testing in the age of big data, and worries the kits are being sold as novelties, with little appreciation for the personal information they convey.
“You can buy them at Walmart,” she said. “It's the kits of shower gel, and the scented candles -- and the 23andMe.”
Drabiak recently authored a study that exposed concerns about how DNA information is stored and sold. She noted that most companies obtain consent via “clickwrap," or the fine print that consumers click past in order to purchase or access information. But the disclaimers can include broad and troubling usage policies.
For instance, AncestryDNA's fine print claims a "perpetual, worldwide, transferable license to use your DNA."
And while 23andMe promises only to sell anonymized information – not linked to a customer’s name or contact – the company's terms of service agreement gives it the right to change the rules at any time, with just an email notification.
Customers may not realize that several DNA companies sell their data to pharmaceutical companies. 23andMe sold its database to at least 13 pharmaceutical companies, each deal worth millions.
“What might not be transparent is the financial motivations [of each company] or the privacy risks that come with sharing your information,” Drabiak said. “To have this group [of voluntary DNA donors] already here there, it’s like a gold mine."
And it’s not just pharmaceutical companies. Data isn’t covered by the Health Insurance Portability and Accountability Act (HIPAA), so genetic testing companies can legally share it with a staggering number of clients.
“Your information could be used by a data brokers, employers, health insurers and law enforcement,” Drabiak said. “Potentially subjecting you or your family to shame, discrimination, or criminal investigation.”
The transfer of DNA information -- like any cloud storage of data – offers opportunities for hacking. Given that many customers also disclose family histories, health conditions and personal details like sexual orientation, the potential for exposure is large.
“Once you open Pandora’s box, it can go off in multiple ways,” Drabiak said. “It’s hard to put the lid back on again.”
DNA is typically separated from identifying data when it's aggregated. However, researchers have been able to cross-reference genetic markers with social media and surnames to re-identify a specific person. One MIT scientist was able to identify the people behind five samples in less than a day. And a 2013 study in the journal Science found that researchers could correctly find people’s surnames from their genetic data alone between 12 percent and 18 percent of the time.
These concerns prompted warnings from the Federal Trade Commission and Sen. Chuck Schumer late last year. But given the popularity of home kits last Christmas season (AncestryDNA alone sold about 1.5 million kits), the amount of DNA info circulating will only increase.
For some, the rewards still outweigh the risks. Romano, who subsequently did a DNA test with her husband, isn’t particularly worried about privacy issues.
“There’s nothing they can do with my DNA -- they can’t change me physically,” she said. “It’s not like my credit information or something, where they could ruin my future.”
As for the resale of her DNA for research purposes, Romano said she supports it.
“I think research opportunities could be kind of exciting for a scientist,” she said. “Having all these people, it could be really helpful. And if they could cure someone or help someone with disease, that would be really cool.”
If you do plan to submit a home DNA kit, or have already done so, the Federal Trade Commission offers some advice:
- Know whether your profile will be available to others online, and limit that access
- Don’t accept a site’s automatic settings. Select the most protective options, and revisit your choices later, if you choose.
- Store any printouts of your DNA profile in a secure place, and use unique, well encrypted online passwords
- Click here for more advice from the Council for Responsible Genetics