NEW YORK (GenomeWeb) – Genealogy firm Family Tree DNA has challenged the constitutionality of Alaska's Genetic Privacy Act on the grounds that the statute is so vague in its definitions of terms, such as "DNA analysis," "disclosure," and "informed consent," that the firm cannot know how to comply with the law.
The move is part of Family Tree DNA's defense strategy in a lawsuit in which a customer, Alaska resident Michael Cole, is alleging the company breached his rights under the Genetic Privacy Act by publicly sharing his genetic information without his consent. Cole is seeking $100,000 in damages, but if the case is granted class action status — Cole asserts there may be 900 other state residents who may have had their rights similarly violated — then Family Tree DNA parent company Gene by Gene could be on the hook for as much as $90 million.
Alaska's Genetic Privacy Act forbids the collection, retention, analysis, and disclosure of an individual's DNA sample without their informed and written consent. The law further specifies that a person's DNA sample and test results are the "exclusive property" of the person analyzed.
Cole claims that his "full [DNA] results" were posted on the company's site without his written permission, while Gene by Gene asserts that what was really posted were snippets of non-coding DNA on the Y chromosome (Y-STRs), which have no relevance to someone's health status.
Gene by Gene has argued that the lawsuit should be dismissed because the alleged disclosure of those DNA snippets didn't cause Cole any real harm, such as being discriminated against at work or in healthcare. But in June, the US District Court for the District of Alaska denied that motion. "Alaska's Genetic Privacy Act recognizes an exclusive property interest in one’s DNA, and prohibits the unauthorized disclosure of DNA information," wrote district judge Sharon Gleason. She reasoned that because the statute grants a "substantive right” in a person’s genomic information, the alleged unauthorized disclosure of that information results in "concrete harm."
The company has also filed for summary judgment, and asserted the statute is unconstitutional because it is "brief and vague" and "applies overly harsh punitive damages." This prompted the state to intervene.
In a motion filed last month, state Attorney General Jahna Lindemuth wrote that in determining whether a statute is unconstitutionally vague "the question is not whether the Alaska Genetic Privacy Act defines every possible violation, but whether the statute is sufficiently clear to cover Gene by Gene’s conduct." But since the court hasn't yet determined the company's conduct (i.e. whether it disclosed Cole's genetic information without written consent), Lindemuth asked the court to hold off on deciding the constitutionality questions until the dispute is resolved.
Cole's lawsuit comes during a period of growth for the personal genomics industry, which markets "fun," non-medical genetic testing services directly to consumers. Detractors of the direct-to-consumer business model have long had concerns about the extent to which consumers understand the privacy risks associated with participating in recreational genomics, particularly when customers are encouraged to share and discuss their results with others.
Members of the public are also increasingly concerned about their genetic privacy. One study showed that some people's worries about genetic discrimination are only exacerbated upon learning about the Genetic Information Non-Discrimination Act, the 2008 federal law that restricts health insurers and employers from asking about genetic information, and from using it to make coverage and employment decisions. The law, however, doesn't extend to life, disability, or long-term care insurance.
This year, a Republican-sponsored bill, H.R. 1313, raised alarms among leaders in the genomics field and the public that it would chip away at GINA's hard-won protections in the context of employer-sponsored wellness programs.
Amid these sorts of concerns, the public reaction to the court's decision on the constitutionality of Alaska's privacy law will be an aspect to watch in Cole v Gene by Gene, wrote Lawyer Jennifer Wagner in Genomics Law Reportblog. "Ultimately, the outcome of this case could motivate activists seeking stronger genetic privacy protections across the United States," wrote Wagner, who is associate director of bioethics research at Geisinger Health System. "It also could prompt DNA ancestry companies and their enthusiasts to seek changes to existing privacy laws to make exception for their practices."
The privacy protections under Alaska's statute do not extend to DNA analysis that's conducted for law enforcement purposes, for determining paternity, newborn screening, or emergency medical treatment. Gene by Gene has previously argued that genetic genealogy testing should also be exempt.
In a 2015 letter to an Alaskan legislator, Family Tree DNA founder Bennett Greenspan wrote that "it makes little sense to impose written consent requirements of the [privacy] act on the field of genetic genealogy," because "informed consent is a medical concept, but genetic genealogy serves no medical purpose."
Now, in challenging the constitutionality of Alaska's genetic privacy law, Gene by Gene has continued to argue that genealogy testing doesn't neatly fit the definitions of "DNA analysis" and "genetic characteristic" in the statute.
"DNA analysis" is defined in the statute as testing to determine the presence of absence of a "genetic characteristic," which in turn is defined as a "gene, chromosome, or alteration of a gene or chromosome that may be tested to determine the existence or risk of a disease, disorder, trait, propensity, or syndrome, or to identify an individual or a blood relative." The law does not consider family history or a genetically transmitted characteristic that can be determined without a genetic test as a genetic characteristic.
Gene by Gene states in its pleadings that it is difficult to understand where genealogy testing fits in what it calls a "shapeshifting maze of a statute." And the company continues to highlight the fact that genetic testing to determine ancestry is not medical testing because it relies on Y-STRs — repetitive segments of non-coding DNA on the Y chromosome — that it characterizes as "junk DNA" and "white noise" that do not "'say' anything in particular."
Bruce Korf, chair of University of Alabama at Birmingham's department of genetics, noted that if whole-genome sequencing hasn't been done, then Y-STRs by themselves can't be used to infer anything about a person's health status, which commonly tend to be what genetic privacy laws seek to protect. "Here, an interesting question is what's the intent of the Alaska law, which in broad terms says you can't violate a person's privacy in terms of genetic testing?" wondered Korf, who in 2013 penned a perspective piece in Clinical Chemistry, entitled "Genomic Privacy in the Information Age."
In that article he wrote that while legal protections under GINA offer a shield against misuse of genetic information in the context of health insurance and employment, "there may be some risk that no amount of legal protection can eliminate," and the public may have to accept that their privacy isn't fully protected when they take a genetic test in the way they do when they walk down the street, use a credit card, or drive.
The privacy risks inherent in genetic testing have come to light when, using test results posted on genealogy sites and other publicly available data on the internet, individuals have been able to identify biological relations who may not necessarily have wanted to be found. In a highly publicized case in 2005, a teenager searching for his biological father got tested through Family Tree DNA, identified others that matched his Y-chromosome haplotype with similar last names, and because he knew the anonymous sperm donor’s birth date and place, located him with additional data he purchased from another company.
Researchers led by Yaniv Erlich (then at the Whitehead Institute for Biomedical Research) showed in 2013 that they could identify individuals using surnames linked to Y-STRs in genetic genealogy databases, and other readily available metadata associated with the same surname, such as age and state. Although experts GenomeWeb spoke to said the risk of this type of identification is low, Cole cites this study in his complaint to allege that the pieces of his DNA data publicly available through Family Tree DNA and surname project sites could be used to expose his identity and DNA information, which he says opens the door for discrimination.
Yann Joly, research director of the Center for Genomics and Policies at McGill University, noted that online companies like Family Tree DNA usually protect themselves against lawsuits by having customers consent to their terms of service through online contracts known as clickwrap agreements. Still, he was surprised in visiting one of Family Tree DNA's project websites by the amount of genetic results available in the public domain.
"There was no barrier at all," Joly said, adding that as a minimum measure users should have to register and obtain a password in order to access this information. With the amount of information out about individuals on the internet, the risk of identification is low but not zero and Joly believes there is a good argument for putting genetic information behind controlled-access databases, where people are given access to it if they agree to use it for a specific purpose.
In their paper published in Science, Erlich and colleagues also suggested that controlled-access databases with data use agreements could limit unwanted disclosure of genetic information. However, they also cautioned that genetic privacy challenges shouldn't deter the public from donating samples or sharing their data. "These would be devastating reactions that could substantially hamper scientific progress," they wrote. "Rather, we believe that establishing clear policies for data sharing, educating participants about the benefits and risks of genetic studies, and the legislation of proper usage of genetic information are pivotal ingredients to support the genomic endeavor."
Erlich, who recently became chief scientific officer for MyHeritage, a company that offers genetic genealogy testing, declined to comment for this story. The firm's terms and conditions inform customers that they own their DNA samples, results, and information in test reports. However, MyHeritage does not currently offer genetic genealogy testing in Alaska.
Similarly, genealogy site Ancestry, which boasts of having tested the DNA of 4 million customers, in May updated its terms and conditions to clarify that it doesn’t claim ownership rights in the DNA the customers submit for analysis.
This contractual language may be an effort to ensure compliance with state laws that grant property rights in one's DNA. Florida, Colorado, Georgia, and Louisiana are some other states that have statutes that characterize a person's genetic information as his or her property, similar to Alaska.