Protecting Your DNA Data

Knowing a little bit about your heritage is a good thing. It's great to find out you have an Aunt Fanny and Uncle Pete. But more importantly, maybe you find out there's a family history of disease that could be passed on. We know cystic fibrosis, hemophilia, Huntington's disease, muscular dystrophy, sickle cell disease and Tay-Sachs disease are some of the more common conditions to "run in the family."

What this means is there may be a genetic marker in your DNA, or DNA data, to indicate the presence of a medical condition that could be a problem for you in the future. In 2017, for example, researchers discovered 72 genetic variants that could indicate a higher risk of breast cancer.

Not all genetic diseases are hereditary, but they are caused by gene mutations, thus, a study of your genetic makeup should show evidence of any mutation in your DNA.

Evyatar Ben Artzi, co-founder and CEO of Darrow, a Justice Intelligence platform powered by artificial intelligence, explained that genetic data is the code for the human machine. It has all the information needed to build us throughout our lives. It has the key to our future as well as unimaginable data about our past.

"Thinking about humans like a piece of software allows us to understand genes as source codes," said Ben Artzi, whose company is based in Israel. "You wouldn't share the source code of a precious piece of software you built without proper protection, right? Then the same goes for genetics."

What could go wrong?

Mykolas Rambus, co-founder and CEO of cybersecurity startup Hush in Detroit, has posed questions about the blurring of privacy rights in an increasingly digital world.

"Who has access to your health data, how can that information be used against you and whose responsibility is it to protect your personal data?" Rambus asked. "We need to stop focusing on commercialized data and start looking at weaponized data. U.S. consumers are still so far behind on this."

Ben Artzi acknowledged the potential of more thoroughly understanding genetic code. You could predict illness in advance, cure unknown disorders and improve your mental state. However, he recognizes there are also potential harms: Genes are code, so someone could use them to make observations and predictions about us without our control.

"If someone can predict your future illness in advance, they may make decisions that affect you by using characteristics out of your control," Ben Artzi said. "For the same reasons that we deny racist considerations in employment, insurance or politics, so must we deny them in genetics."

'You wouldn't share the source code of a precious piece of software you built without proper protection, right? Then the same goes for genetics.'

Ben Artzi explained that if people knew of a potential health impairment, they could do something now to help deal with it in the future. He suggested an analogy: Think of a workplace making adjustments to accommodate an employee who uses a mobility scooter. Without the company's knowledge of the condition, the employee might have been asked to climb six flights of stairs to get to work every day. The same goes for genetic data. It can be helpful to have a glimpse into the future; forewarned is to be forearmed, so to speak.

According to Ben Artzi, the major risk of allowing others to use your genetic data, or digital data, is losing the liberty to direct the course of your life without interference.

"If you provide your genetic information to private companies, you should be prepared that it would fall into the wrong hands following a data breach," he said.

If that happens, Ben Artzi said you might be able to receive compensation before the harm becomes concrete by actual misconduct, in light of the Supreme Court's recent decision in TransUnion LLC v. Ramirez, in which a private company was held liable for failing to use reasonable procedures to ensure the accuracy of files.

"The beauty and risk with DNA records is that we don't yet know all of the ways this data can be used for good or mal-intent," Rambus said, adding it's possible that one day, decisions on organ donor eligibility, medical coverage and even auto insurance could hinge on what your DNA suggests about the future and your so-far unrealized medical conditions.

How safe is your data?

One problem is how countless companies, even governments, are hacked each year, Rambus explained. Your information is or at some point will be for sale on the "dark web." He added that these dealings increasingly include the theft and ransoming of medical records.

"Whether your data can be sold, in many cases, is at the discretion of the provider," Rambus said. "However, you should rest assured that the answer is generally no."

What are the rules of engagement?

According to Ben Artzi, like with all private data or digital data, autonomy is the guiding principle. Genetic data should be captured and collected only with informed consent from the subject. The data should not be shared or used in any form without further informed consent.

"Because of its unique sensitivity, consent to transfer genetic data cannot be given alongside the consent to use other data, for risk that someone neglects to pay proper attention," he said.

'Whether your data can be sold, in many cases, is at the discretion of the provider.'

Michael Arrigo, managing partner and CEO at No World Borders, headquartered in California, serves as an expert in federal and state courts regarding HIPAA privacy and security and electronic health records, as well as genetic testing and federal and state standards regarding the privacy of DNA data and human subjects in research. (HIPAA refers to the federal Health Insurance Portability and Accountability Act of 1996.)

"First, what most people do not realize is that DNA testing companies who perform these tests are subject to privacy rules; that the customer can opt out of DNA sharing," Arrigo explained. "The company, as a vendor of a personal health record, is regulated and subject to similar privacy rules."

Second, Arrigo added that there are instances when consumers should be notified if their information is shared in ways that allow them to be identified. You can read the Federal Trade Commission's guidance here.

However, Rambus said it's possible that anonymized versions of your data can be sold with little or no guarantee it couldn't at some point be reverse-engineered to determine your identity.

Currently, DNA data isn't being used to assess your ability to get a job or determine eligibility for insurance policies. But there is no guarantee this won't change in the future, Rambus said.

"There have been cases where police have gained access to DNA data to solve cold murder cases," he added.

Steps to keeping your DNA data safe

The most important question for you to consider is how you can protect yourself and your DNA data.

The first step occurs when you send in your DNA sample to a company, which expects you to carefully read its terms of service and privacy policy.

"Of course, if we were to read these every time we provide our data, we would waste 20 percent of our time every year," Ben Artzi said. "Therefore, even if we do want people to be able to engage in free dealings online, there are some areas in which we need rules respected by every corporation regardless of consent."

He explained that we still lack such rules.

In order to protect your DNA data, Ben Artzi has three tips:

1. Simply refrain from handing over any genetic data to others. If you do submit it, make sure you read the full terms of service and privacy policies. If you don't understand or want clarification on some parts, send an email asking the company to clarify its statements.
2. Vote for elected officials with clear agendas about genetic data protection. If they don't have any public statements about their position, write to them and ask.
3. Join the fight against the abuse of genetic data. If you or someone you know has been hurt by the misuse of your genetic data, seek legal counsel and get advice on how you should proceed.

"Genetic registries are still evolving their policies, and certainly, there is not yet enough state or federal case law to know how protection of this information will evolve," Rambus said. "But if Roe v. Wade is any indication, there may well be surprises down the road."