Genetic testing kits sold online and in pharmacies are failing to protect consumers’ privacy and could be endangering human rights, researchers have warned.
Direct-to-consumer genetic tests which use DNA extracted from saliva samples to find out about everything from people’s ancestry to their susceptibility to male-pattern baldness, have become increasingly popular.
It has been estimated that the industry is now worth £8 billion globally, and £800 million in the UK alone.
Two Scottish academics, Claudia Pagliari, and Jacqueline Hall, examined around 50 genetic tests being actively marketed to UK consumers.
They identified 14 kits designed for quasi-medical ‘health, wellness and lifestyle’ that did not comply with all of the recommendations set down by the UK government’s Human Genetics Commission.
The academics analysed the wording of the terms and conditions available on websites of popular over-the-counter tests such as 23andme and DNAFit, and the consent statements relating to future uses of genetic information.
They found that in many cases it was unclear how customers’ data might be retained or passed to third parties and how people could opt-out.
In a small number of cases, simply buying the product was interpreted as an indication of the purchaser’s consent for the use of their personal data in ‘research’.
Glasgow-based Dr Hall, an honorary senior lecturer at Imperial College London and an expert in bioinformatics and laboratory standards for biomedical testing, said: “With some companies it isn’t clear that you are consenting to have your data used for research and the possibility to opt out of research and still buy the testing service is absent.”
“You get these long terms and conditions; information may be in there somewhere but it’s not at all obvious.”
Co-researcher Dr Claudia Pagliari, who directs the University of Edinburgh’s Global eHealth programme, shares concerns about privacy, transparency and consent.
She said: “Although many people are willing to share their data for bona-fide medical research, they’re likely to be less happy about it being passed to third parties or sold to commercial data brokers.”
“It’s not inconceivable that this information may be finding its way to insurance companies with a vested interest in identifying people who might be costly in the future, which could lead to exclusion and has important human rights implications.”
In 2009, the Human Genetics Commission (HGC) published “a common framework of Principles for direct-to-consumer genetic testing services” in an effort to encourage self-regulation within the industry.
Among these principles was one that stated firms should make information about their data policies prominently available to potential consumers in lay language.
Although laws exist to protect consumers from the unauthorised sharing of identifiable information and from genetic discrimination, there are concerns that data obtained in this way could be vulnerable to ‘re-identification’ – the process by which anonymised personal data is matched with its true owner – and misuse.
“Might you be prevented from getting a mortgage if some clever individual was able to identify you from data that has supposedly been anonymised?” asks Pagliari.
A matter of trust
The 14 companies looked at included Fitness Genes, Who’z the Daddy, DNA Vitality, Gene Planet, DNAFit and 23andme.
Run by entrepreneur Anne Wojcicki, the ex-wife of Google founder Sergey Brin, 23andme is the largest player in the genetic testing market. Although a private company, investors have estimated 23andme’s worth at over $1bn. 23andme tests are available from Superdrug for £124.99.
23andme includes a check box for consent, which can be withdrawn subsequently, but it is not clear how data is used. “It says sister companies can access the data – but you don’t know who they are,” says Hall.
People who sign up for 23andMe submit a spit sample. The DNA in cheek skin cells is analyzed for some 650,000 genetic markers. These markers reveal which common version of each human gene a person has, about 20,000 genes in all. Such “genotypes” can explain many physical traits and disease risks, although not all.
Last year, 23andme revealed that it had sold access to its data to more than 13 drug companies. The company has amassed a collection of DNA information about 1.2 million people around the world.
While 23andme has been able to offer the tests in the UK and Canada, it had run-ins with the US Food and Drug Administration (FDA) over its concerns about the accuracy of data collected.
In 2013 the FDA banned the company from selling tests directly to consumers. This decision was reversed in 2015.
So-called health-care data mining is a growing market. Some health-care and privacy experts worry that such commercial trade largely hidden from the general public carries major privacy risks.
They include director of GeneWatchUK, Dr Helen Wallace, who warned: “Gene tests are poorly regulated and people buying tests should be aware that commercial over-the-counter tests can give misleading information and may not guarantee their privacy”.
23andMe insists that it keeps data encrypted and confidential and that it does not share the information with other parties such as insurance companies without a person’s explicit consent.
In addition, 23andMe said these tests helped consumers learn more about the genetics behind traits such as whether or not they are frequent smokers, how they metabolise caffeine and respond to exercise.
A spokesperson for 23andme said its research program is “completely voluntary” and added: “For people who choose to engage in research, we believe we offer a model that provides transparency to understand how their data is being used, what they are contributing to and the choice to end participation at any time. The consumer is in control of their data.”
Hall and Pagliari have called for an independent review into over-the-counter genetic tests and for the creation of a register of certified providers.
There is no single body in the UK or Scotland with comprehensive oversight of this industry. The Human Genetics Commission’s principles for genetic testing were non-binding and the HGC itself was disbanded in 2010 by the coalition government and has not been replaced.
Its responsibilities were distributed across agencies charged with medical regulation, consumer protection, data protection and advertising standards including the Medicines and Healthcare Products Regulatory Agency and the Advertising Standards Authority. Researchers warn that this situation had led to lack of oversight of over-the-counter genetic testing kits.
“The industry needs to understand that this is a matter of quality and also trust and it will help them as well consumers. This type of testing has a lot of potential benefits but there needs to be encouragement for companies to improve and move the field forward and so create more value,” says Hall.
“We’re talking about genetic testing now but this could apply to all types of consumer-directed self-testing that may be developed in the future. We need to have proper regulation in place.”
A spokesperson for DNAFit said: “DNAFit align to the a call for a register around over the counter genetic testing. We believe that regulations are needed so that the consumer can be protected.”
“Regulation should apply not only to the very important issue of data protection but also to open transparency relating to the testing and service that the company provides, namely the genes selected, and their associated research.”
The Scottish researchers have also called for more specialists to be recruited and trained to explain the results of genetic tests to consumers.
“The information companies are giving to consumers to help them interpret these results varies enormously; from the quite good to the almost invisible,” said Pagliari.
Hall added: “You get a report back and some recommendations. It might say this is outside the normal range for the population, but is that bad, is it good? What does it mean for you?…We need more trained specialists to deal with the data. It must clear what people are signing up for, and putting the information they get back in context.”
Regulation of medical devices such as over-the-counter genetic testing kits is a reserved area in Scotland.
A Scottish Government spokesperson said: “Anyone with health concerns because of their family history should speak to their GP in the first instance. Clinical decisions on a patient’s healthcare are always matters of professional judgement but clinicians are fully expected to take account of the available guidelines.”
DNA Testing Kit Companies
| BioClinics |
| DNA fit |
| DNA Genie |
| DNA Vitality |
| easyDNA |
| Fitness Genes |
| Gene Planet |
| Genetic Health |
| GeneYouIn |
| International Biosciences |
| My-gene-diet |
| TestDiagnostics |
| Who’zTheDaddy? |
| 23andme |
Claudia Pagliari tweets about health privacy and security and the MSc programme in Global eHealth at Edinburgh University @EeHRN. Jacqueline Hall tweets about self-testing and personal diagnostics @Vivactiv.
Anyone with a problem with in-vitro medical devices can make a report to the Medicines and Healthcare Products Regulatory Agency (MHRA) here.
Second photo credit: Genetic testing result | CC | Micah Baldwin | https://flic.kr/p/5Gc5h4
