Read the fine print
What do we give up in DNA privacy?
There isn’t a day that goes by at The Legal Genealogist without at least one person asking about DNA testing: “What test should I take?” “What’s the best test for…?” “Which test if I wanted to find out…”
But it’s a rare day when someone stops to ask the question that everybody should ask, before testing: “what am I giving up in terms of my own data if I do test?”
This rare question came from reader Cherry Britton, who wrote that she had come across a comment in a New York Times book review. “It shouldn’t have shocked me,” she said, “but it did.” The comment:
We give our data away. We give it away in drips and drops, not thinking that data brokers will collect it and sell it, let alone that it will be used against us. There are now private, unregulated DNA databases culled, in part, from DNA samples people supply to genealogical websites in pursuit of their ancestry. These samples are available online to be compared with crime scene DNA without a warrant or court order.1
The article is mostly about the collection of personal data on sites like Facebook and GMail, even from our Fitbit trackers… but does include the comment above. So, Cheryl, wanted to know, did The Legal Genealogist have any comment?
Oh, yeah… Sure do…
Now… in some respects, it’s overblown. There are no “private unregulated DNA databases” that are publicly available that are “culled” from genealogical samples: any public DNA database that exists does so because people voluntarily chose to include their samples. And no DNA testing company makes its data available to be compared with crime scene DNA “without a warrant or court order.”2
But that doesn’t mean we don’t give up some of our privacy when we DNA test or when we upload our information to a third-party sharing site like GedMatch or DNALand. To some extent, we all do — and we need to be aware of just what we are giving up when we test.
Before I go on, let me make it clear: I don’t think the risk is a big one. I personally have tested with just about every DNA testing company that’s out there and have a couple more kits on order. I have contributed my DNA to those third-party sites.
I’ve done that because the genealogical upside of connecting with cousins who may have data critical to my family research is enough — to me — to outweigh any downside of making my DNA data available.
But that’s a decision each and every one of us needs to make individually — and we can’t make an informed decision if we don’t know what we’re being asked to give up in terms of our own data.
So here’s the key point: before we test, before we ask a family member to test, before we buy a kit for someone we hope may turn out to be a family member, we have to read the fine print. And we need to make sure the person who’s testing, if the kit is for someone else, reads the fine print too.
Every testing company requires the person tested to sign or provide a consent in some form. What that consent extends to is set out in lengthy documents called either terms of service or something like privacy document — or both.
Every testing company’s requirements are different, and you need to read carefully the fine print at the specific company where you’re testing.
Every testing company requires a certain level of consent in order to test with the company at all, and then may have an opt-in where you can choose to participate in studies ostensibly for the benefit of science and medical advances (but — let’s face it — are ultimately intended to benefit the testing company).
So the first thing we need to do is carefully distinguish between permissions that are required and those that are optional. It’s only the required permissions that we have to agree to in order to do the testing.
The least onerous permissions are those at Family Tree DNA. Family Tree DNA only requires blanket consent “to use … deidentified DNA samples and test results for the purposes of migration and population genetics studies.”3 The privacy document explains that: “Your consent will allow Gene By Gene to share your test results, anonymized and aggregated with those of others who have consented, with our third-party research partners for the purposes of general scientific research intended to lead to publication in peer-reviewed scientific journals.”4
For anything beyond that, Family Tree DNA states that “(f)rom time to time, (it) may ask for explicit consent” to use a specific person’s DNA in a specific way — but nothing more is required.5
At AncestryDNA, the up-front required consent is broader:
AncestryDNA will analyze Users’ genetic, genealogical, and health information, to provide results, including an ethnicity estimate, to each User (the “Results”) and will use aggregated Users’ Results to make discoveries in the study of genealogy, anthropology, genetics, evolution, languages, cultures, medicine, and other topics. …
By submitting DNA to AncestryDNA, you grant AncestryDNA and the Ancestry Group Companies a perpetual, royalty-free, world-wide, transferable license to use your DNA, and any DNA you submit for any person from whom you obtained legal authorization as described in this Agreement, and to use, host, sublicense and distribute the resulting analysis to the extent and in the form or context we deem appropriate on or through any media or medium and with any technology or devices now known or hereafter developed or discovered.6
There’s a broader opt-in for more detailed research, but this much is required — you can’t test with AncestryDNA without accepting this.
At 23andMe, you can opt in to allowing the use of your DNA with identifying information or for peer-reviewed scientific research, but that’s not required. What is required is that you agree that your collective DNA can be used perform research & development activities, which may include, for example, conducting “data analysis and research in order to develop new or improve existing products and services, and performing quality control activities.”7 23andMe explains what that means:
We may share aggregate information with third-parties, which is any information that has been stripped of your Registration Information (e.g., your name and contact information) and aggregated with information of others so that you cannot reasonably be identified as an individual (“Aggregate Information”). This Aggregate Information is different from “individual-level” information. Individual-level Genetic Information or Self-Reported Information consists of data about a single individual’s genotypes, diseases or other traits/characteristics information. For example, Aggregate Information may include a statement that “30% of our female users share a particular genetic trait,” without providing any data or testing results specific to any individual user. We may provide such Aggregate Information in commercial arrangements with our business partners. In contrast, individual-level Genetic Information could reveal whether a specific user has a particular genetic trait, or all of the Genetic Information about that user. 23andMe will ask for your consent to share individual-level Genetic Information or Self-Reported Information with any third-party, other than our service providers as necessary for us to provide the Services to you.8
If test with any other service, like the new testing at MyHeritage, or if you go further and choose to upload your DNA data to a third-party site like DNALand or GedMatch, each of those sites will have its own required privacy statements and rules. Under any of them, you will be agreeing to give up some degree of privacy in and control over your data.
Bottom line: read the fine print. You may well decide, as I have, that the risks are well worth it given what we can learn when we test. But we can’t give informed consent if we don’t read the terms of what it is we’re consenting to.
- Sue Halpern, “They Have, Right Now, Another You,” New York Times Review of Books, 22 Dec 2016 issue (http://www.nybooks.com/articles/2016/12/22/ : accessed 11 Dec 2016). Yeah, I know… it’s weird to be accessing an issue dated in the future, but that is what the site says. ↩
- As to the likelihood of police use of any genealogical database and how likely it is except in the most unusual of circumstances, see Judy G. Russell, “Facts matter!,” The Legal Genealogist, posted 3 May 2015 (https://www.legalgenealogist.com/blog : accessed 11 Dec 2016). ↩
- See FTDNA Release Form, PDF, Family Tree DNA (https://www.familytreedna.com/ : accessed 11 Dec 2016). ↩
- Ibid. ↩
- “AncestryDNA Terms and Conditions, Revision as of September 30, 2014,” AncestryDNA (https://www.ancestry.com/dna/ : accessed 11 Dec 2016). ↩
- Paragraph 4a, “Full Privacy Statement,” 23andMe.com (https://www.23andme.com/ : accessed 11 Dec 2016). ↩
- Ibid, paragraph 4d. ↩
Thank you again for this. I visit frequently with patrons at our Family History Center about reading before choosing.
Over a year ago I removed my DNA account from ancestry.com. I have to assume that they kept their own copy of my results. I put my raw data at GEDmatch, DNALand and FTDNA.I often wonder what ancestry.com is using my data for now.
I was a blood stem cell donor for my sibling who has leukemia. The hospital where the collection/transplant was done had a optional program in which I could donate two teaspoons of my blood for future DNA research, where it would be stored with a sample of my siblings’s pre-treatment blood. The release form for participating was SEVEN pages long, and full of promises of privacy! The release form for the actual collection of stem cells, with side effects up to and including death, was only one page. The doctor was extremely grateful that I opted in to the research program–and amused when I explained that my DNA was “already out there all over the internet,” linked with my email, for genealogical purposes.
The segments of DNA reported for genealogy are different from those tested for your leukemia
That may be true in terms of reporting, but in terms of information that’s captured… maybe not.
The trouble is that the upside is short term and actually pretty trivial, whereas the downside is long term and actually potentially serious. Given how touchy everyone was even five years ago about taking a test at all, the way the herd has now stampeded to give away their DNA is mindboggling. I would not touch any site that wont guarantee the security and privacy of their data – whcih includes Ancestry, 23andme, and gedmatch
Nobody, under any circumstances, can “guarantee the security and privacy of their data” — including secret government agencies, which are hacked as well.
I’m a big believer in spreading my personal info around so no one company will have all my data. While I am a big user of Ancestry, I’ve chosen to do DNA testing with Family Tree, despite the inconvenience. We just can’t assume that ticking a privacy box will protect us. It’s all ultimately hackable or even just subject to security neglect. We should treat our personal data like nuclear fuel, it can hang around for a long, long time, and we can never assume that someone in the future won’t find a nefarious use for it.
What I find disturbing is there are more and more stories like this. “Washington state man, 55, is charged with the brutal 1991 slaying of a 16-year-old schoolgirl after the cold case was cracked ‘when DNA from the crime scene was uploaded to a genealogy website'” Daily Mail 5 October 2019
I don’t think anyone ever thought that the police would be allowed to rummage through our DNA. We just “assumed” it would be for genealogical research. To me it is like the police saying, “We found these footprints and now we are going through everyone’s closet looking for shoes that match.