Privacy risks of direct to consumer genetic testing Emily Christofides and Kieran O’Doherty University of Guelph OPC Contributions Grant

Direct-to-consumer genetic testing (DTC GT) Previously, genetic testing provided only through health care system Often, mandatory genetic counseling Recently, commercial companies are offering genetic testing directly to consumers Often health related Paradoxically, advertised FOR privacy

Current debates & regulations Tests vary greatly in quality analytical validity clinical validity clinical utility Agreement on need for regulation; Disagreement on how this should be done Varying responses across jurisdictions

Genetic information Generally seen as requiring special protection Denial of health insurance Denial of financial products Denial of employment Other forms of discrimination Social and ethical challenges well recognised in academic literature Genetic counselling Genetics/genomics research Human tissue biobanking

Genetic information and DTC GT companies Transfer of genetic material and information incidental to primary purpose of transaction Exchange of service for fee In the process of conducting business DTC GT companies accumulate very detailed personal information about customers

Our OPC project 1.How do Direct-to-Consumer Genetic Testing (DTCGT) companies communicate privacy risk information to customers? 2.What do customers understand of their risks?

Review of DTCGT Company Websites Compiled up-to-date list of companies providing DTC genetic testing Because of on-line nature of tests, examined ANY company that was accessible to Canadians Exclusions Incomplete or inaccessible websites Services directed towards physicians or researchers Total of 86 companies examined

Categories of tests Health tests (primary focus) Traits & talents Ancestry & genealogy Relationship & paternity Forensics & infidelity Prenatal testing Other

Assessment of privacy information What privacy related information do companies make available to consumers? Do they have a privacy policy? If not, are they making privacy information available elsewhere? Evaluation based on Past research Most comprehensive privacy policies (e.g., 23andMe)

Evaluation criteria 1.Accessibility of Policy 2.Completeness of the Privacy Information 3.Content of the Privacy Information: Access 4.Content of the Privacy Information: Disposal 5.Content of the Privacy Information: Consequences 6.Content of the Privacy Information: Secondary Use 7.Content of the Privacy Information: Recourse Ranking range: “excellent”, “good”, “fair”, “poor”

“Health” tests 29 companies Drug response tests (e.g., risk of severe side effects to Statins) Disease predispositions (e.g., diabetes, Parkinson’s) and carrier status (e.g., cystic fibrosis). Telomere length tests Diet and nutritional tests For example, 23andMe advertises that it offers over 240 tests of health conditions (e.g. predisposition to celiac disease) and over 40 tests for inherited conditions (e.g. carrier status for cystic fibrosis).

Health rankings Excellent – 4 Good – 6 Fair – 11 Poor – 8

Key findings Of the companies that do post privacy policies, many do not talk about genetic privacy Customer information intended to be used for secondary purposes Of particular concern: Companies allowing for ‘discreet’ samples