Privacy questioned in DNA-test boom
Study raises possibility of identifying even those who haven’t given samples
Consumer DNA testing has become pervasive enough and has generated enough data that it’s possible to identify about 6 of every 10 people in the U.S. who are of European descent, even if they’ve never given samples, according to a new study.
The study, recently published in the journal Science, found that Americans of European extraction are more likely than not to have close genetic ties with someone who has had a consumer DNA test through a company like 23andMe Inc. or Ancestry.com Inc.
“We are getting very soon to the point that everyone will be potentially identifiable using this technique,” said study author Yaniv Erlich, an assistant professor at Columbia University and the chief science officer at the consumer DNA testing firm MyHeritage.
Erlich said DNA tests from only 2 percent of the population are needed to ensure that virtually everyone’s genetic information is represented in the data.
More than 15 million people have taken consumer DNA tests, and more than 1 million have uploaded raw DNA data files to GEDmatch, a third-party, open-source website set up to let users of different genetic-testing services hunt for relatives across platforms.
Combining genetic information with other material that people have shared online, as well as government and other databases, could be a powerful tool for finding even those who don’t wish to be found. With enough overlapping data, anyone could be identified using connections unearthed in genetic databases.
“It’s a combination of genetic data with social media, with public records,” said Debbie Kennett, a British genealogist and author. “The conversation should not just be about genetic data but about what other information people are revealing to the public.”
Privacy concerns around consumer genetic testing have increased amid several high-profile instances of law enforcement agencies using DNA information to generate leads. In April, police arrested a suspect in the case of the Golden State Killer, who terrorized California in the 1970s and 1980s, after uploading crime-scene DNA to GEDmatch and locating relatives of the suspect. The tactic has led to more than a dozen arrests in other investigations.
In the study published in Science, researchers looked at the genomic data of 1.28 million people who have tested with MyHeritage, about three-quarters of whom were of European descent. They attempted to find second, third or fourth cousins who had also taken the company’s test — the same kind of familial matches recently used by police. About 60 percent of the time, they found matches.
The researchers found a similar likelihood of finding relatives even if they haven’t joined genetic-testing databases.
Erlich has long been interested in the privacy threats posed by DNA. In 2013, his lab at the Whitehead Institute showed that it was possible to discover the identities of people who participate in genetic research studies by cross-referencing their data with other publicly available information.
Research participants, the latest study found, could be identified with this newer technique, too. Using publicly available data, within a day researchers were able to find the identity of a Utah woman whose DNA data were available publicly as part of the 1000 Genomes project.
Erlich said genetic information should be considered identifiable and, particularly when it comes to research, protected. He proposes that direct-to-consumer testing companies implement cryptographic signatures for DNA data files to ensure the data’s authenticity. Such a measure might even allow users to specify when and how they want their data to be used.
“The last thing I want is for people to think from our study that it’s dangerous to give data for genetic research,” he said. “We need people participating in research studies.”