DO YOU WANT ANYONE TO HAVE YOUR MOST PERSONAL INFORMATION? WE DON’T THINK SO, LAWMAKERS SAY

By Roy Freiman, Andrew Zwicker & Annette Quijano

We would never expect a bank to release our financial information any more than we would want the government to distribute our social security number, or a doctor to share our medical records. So why are we so compromising when it comes to the privacy of our most sensitive personal information: our genetic data.

Containing information as basic as your ethnicity to information comparably as intimate and unique as your fingerprint, genetic data can reveal a lot about who you are both on the surface and beneath it.

With the rise of direct-to-consumer genetic testing, millions of Americans began opting-in to services offered by private companies like 23andMe and Ancestry.com with hopes of discovering more about their heritage, connecting with lost relatives or identifying increased risk for disease like Alzheimer’s and breast cancer. However, as they swabbed their mouth or spit in a tube and mailed in their DNA for analysis, few paused to consider the implications for their data privacy.

As details of how your data could be used and where it could end up remained deep in the fine print of company policies, many remained unaware of what and how much they had consented to give away. A Deloitte survey from 2017 puts the number of Americans willing to consent to legal terms and service agreements without reading them at 91%. That fact, paired with limited industry transparency, has put a huge burden on consumers and made informed consent relatively elusive.

Today, it is quite likely if you submitted your DNA sample for testing, your genetic data sit anonymized in a database owned by a pharmaceutical company, academic research group or some other third-party entity. In 2018, 23andMe struck a $300 million deal to share its genetic database with pharmaceutical giant GlaxoSmithKline, and the company maintains partnerships with Procter & Gamble Beauty, Pfizer and others. Ancestry.com similarly shared data, collaborating with Google’s Calico to study aging.

And, while in the aggregate this data presents enormous opportunity for new drug development and biomedical advancement you can never really be sure that your data won’t be leveraged by bad actors for all the wrong reasons.

As a number of studies have pointed out, anonymized data are not fool proof. With enough effort, a significantly large chunk of data can be traced to the originating individual and their relatives. Running crime scene evidence against DNA profiles publicly uploaded to GEDmatch, police solved the four decades old Golden State Killer cold case. Therefore demonstrating that, despite efforts by companies to detach identifying information, the promise of anonymity and privacy is difficult to guarantee.

We are lacking a regulatory framework to address the privacy of genetic information. As strong federal policy in this specific area has yet to emerge, what has resulted is an industry that remains largely under-regulated and a public that is alarmingly uninformed.

New Jersey can’t wait. We need better safeguards for genetic privacy now. That’s why we’ve charted our own course, sponsoring legislation (A-1170) that not only requires consent to use DNA samples and any resulting genetic information, but also makes DNA samples the exclusive property of the individual.

Stipulating ownership of genetic data is about securing New Jersey consumers’ right to choose. Empowered and informed decision-making can only arise when we are the ones in control of who can and cannot access or use our data. Under the measure, we assure the power always remains in the hands of the consumer.

With this legislation, New Jersey would join 24 other states that require informed consent to disclose genetic information. The state also would become sixth after Alaska, Colorado, Florida, Georgia, and Louisiana in explicitly defining genetic information as personal property, and second only to Alaska in extending personal property rights to DNA samples.

Protecting people and ensuring all industry competitors play by the same rules are fundamental strategies to securing greater genetic privacy for New Jersey residents. Laws requiring fair and responsible industry behavior are how we keep genetic data in the right hands – the individual to whom it belongs.