The FTC’s PrivacyCon, an all day event that included presentations and discussions from a number of privacy researchers, one presentation focused on the data privacy risks associated with direct to consumer genomic data services. Many of these risks apply to any consumer health data service.
Researchers Jan Charbonneau and Andelka Phillips, of the University of Tasmania and the University of Oxford respectively, presented the paper.
“What we have to realize is genetic data is the most personal data out there,” Charbonneau said. “Not only is it a unique identifier of us personally, but because of the familial nature of DNA, it can also identify our family … We also know that this data is inherently identifiable. There’s growing recognition that it is not possible to de-identify this data in a way that it is not possible to re-identify it later. The other thing is, this data is irrevocable. If there’s been a privacy breach, you can’t change it. It’s not like your iTunes password.”
The unique nature of genomic data should mean that stricter laws govern how it’s shared and used, Charbonneau and Philips said. But this isn’t the case today. And the reason for that is that laws were made under the assumption that genomic data would be collected in the doctor’s office, where patient protection laws like HIPAA would apply. Direct to consumer companies throw a wrench in the works.
“When an individual gets the genetic test in their healthcare system, they’re deemed a patient,” she said. “By being called a patient, that enlivens a whole host of professional and regulatory oversights, existing duties of care, and things like doctor-patient confidentiality. … When an individual engages with DTC, they engage as a consumer. What that means is that enlivens each country’s consumer protection legislation — a very different situation.”
Phillips added that genomics is a new enough field that it’s hard to really articulate the risks associated with someone else having your genetic data. While today the biggest threat might be discrimination based on genetic makeup, in the future risks could include identitiy theft, targeted marketing, especially of drugs, employment or insurance discrimination, and, some day even, the risk of someone creating synthetic DNA.
Charbonneau and Phillips found a big gap between the expectations of consumers about the privacy of their genetic data and the reality of companies’ contracts. Contracts are long and hard to read, they said, and can be changed without notice — 39 percent of the contracts Phillips examined included a clause that allows them to change their terms at any time, and only 6 percent promised to notify signees directly by email of changes.
“These contracts need to be written in a more easily understood way that will enable consumers to make more informed decisions,” Phillips said. “Often if you look at website claims there will be quite a gap between what the contract actually says and what the website encourages consumers to believe when they are trying to get them to purchase tests.”
In the discussion session following the presentation, Charbonneau and Phillips were asked what changes the FTC could make to improve the situation.
“One of the things we have to acknowledge is we’re moving into the commercialization of health and we’re moving into the monetization of health data,” Charbonneau replied. “What we’re observing now is not industry-specific. And that’s what our recommendation would be. Whether it’s genetic testing, whether it’s your Fitbit, whether it’s an online forum where you talk to other patients about your medication, this is now being monetized. And our protection of the data was created for the traditional healthcare system. And we aren’t doing anything industry specific as we move into this new form of commercializing healthcare and monetizing health data.”
