HOW TO: delete your data from commercial company databases:
The following websites provide guided instructions on how your data can be deleted from a commercial DNA company’s database:
Consumer Reports: How to Delete Your Data From 23andMe, Ancestry, and Other Sites
Know Your DNA: How to Delete Your Data from every DNA testing service
23andMe’s value plummeting, with consumers stuck with little use for their genetic information, while the company faces lawsuits for data breaches
February 2024
A new article in Deseret News reports on the plummeting revenues of the commercial genetic testing company, 23andMe. Plunges in the company’s value stem from a lack of utility for customers in finding useful applications from the genetic information provided, and increasing troubles due to rising numbers of lawsuits arising due to the issue of data breaches.
The company valuation has reportedly crashed 98 % from its peak, with Nasdaq threatening to delist it from its sub-$1 stock, according to the Wall Street Journal.
The company, which was founded in 2006 with the assistance of substantial Google funds, was promoted by the founders as a way to use DNA testing to “benefit society”, connecting customers to each other over their putative disease mutations.
However, the company’s business model is now proving to be suffering a number of fundamental flaws. Costumers only need to take a test once, so costumers do not need to return. More crucially, “few test takers get life-altering health results”, with a founder of the company saying customers are “hitting a wall” once they get the genetic information back.
The founder suggests that this lack of utility over the health data they provide is due to an absence of “preventative treatment” options within the US healthcare system, wanting to integrate their findings more with healthcare. However, it is arguable that even with such integration, healthcare for customers would not improve. As summarised in the Commercial DNA Tests page of our website, because genetic testing is generally underregulated, there is little requirement for companies to validate claims of ancestry or health benefits. With questionable accuracy, such tests may do little to improve health, and may indeed undermine it. Customers may get misleading results that may lead to wrongful diagnoses and disease predictions, such as giving false reassurance that they at low risk of a serious condition. Additionally, a false positive result may lead to unnecessary treatment when they are not sick, or overburden primary healthcare systems with worried costumers getting results that are not used in the healthcare system, which may increase uncertainty, anxiety and moreover, take up limited health resources and time.
Another major problem for 23andMe is the recent reporting of massive data breaches that have led to over 20 lawyers filing class action lawsuits against the company. Privacy of private genetic information has long been a concern surrounding the expansion of databases across different spheres, from police to commercial as well as health-related areas. Nonetheless, health related information is what the company is relying upon to generate income, launching an annual service to get “life-altering health results”. The company has come a long way from early reports of celebrities having spit parties to send their DNA off to 23andMe. 18 years later, the lack of validation over their genetic data’s use to benefit society, may be starting to catch up on them.
Massive data breaches confirm long held concerns about privacy of genetic databases
December 2023
A new report reveals that millions of users’ private genetic information uploaded onto the commercial company 23andMe’s database has been hacked. An estimated 6.9 million user profiles have been breached, representing nearly half of 23andMe’s customer base of 14 million, whose genetic data is now being sold on the dark web.
Such data breaches are coming at a time where governments such as the UK are proposing the weakening of data protection that could mean everyone in the UK would lose control over how their genetic information is shared. The loss of control of genetic data, either legally as result of potential legislative changes, company sharing or takeovers for example, or illegally via hacking incidents, makes genetic information open to abuse, commercial exploitation and security risks that may arise from misuse by governments and can facilitate the creation of a ‘surveillance state’.
The story began to emerge across social media in early October, with unconfirmed reports of a hacking incident. 23andMe initially denied claims of unauthorised access to its databases after conducting an investigation. However, a few days later the company admitted to the incident, and subsequently shut down user access to its information on DNA relatives, as ‘an additional precaution to protect privacy’. The extent of the breach has now become clear after weeks of speculation, with users’ names, family trees, ancestry reports, locations, profile pictures and birth years leaked.
This latest report of a data breach confirms long held privacy concerns regarding the global rise in genetic databases across various spheres, from commercial databases such as that owned by 23andMe, to healthcare- and police-generated databases. The fall out has caused growing anger amongst users, with multiple class action lawsuits being filed In Canada, with thousands apparently seeking to join, according toCanada’s Global News. The news organisation further reported that the lawsuit alleges that 23andMe engaged in “ ‘wilful, knowing or reckless conduct’ by not implementing and maintaining proper data retention and data protection practices.”
Such data breaches are not restricted to commercial databases. Indeed, a new investigation published in the Observer newspaper revealed that the UK Biobank opened up its vast database of health data to insurance companies. This move goes against initial promises in 2002 when the Biobank was founded, that it would not share data with insurance companies after concerns were raised that such information could be used to discriminate against people by denying insurance to those deemed as having a particular genetic makeup from gaining insurance. Volunteers were even told they “need not have fear of their profiles being available to insurance companies, employers or police…”. This pledge, according to the Biobank, now no longer applies. It remains unclear what information has been shared. Moreover, it was recently announced that a new consortium to help scale up the UK biobank’s data will include former CEO and chairman of Google, Eric Schmidt and Citadel CEO Ken Griffin. The controversial company Palantir, a US spy tech firm has also recently won a £330m NHS contract to generate new data platform, raising yet more privacy and security concerns. Meanwhile in Ireland, the future of thousands of DNA samples remains unclear two years after the Irish private company who generated the health data based from Irish patients based on questionable mechanisms of consent, was bought out by a US firm.
The amassing of huge swathes of the population’s genetic information across commercial and health spheres presents inherent risks to the privacy and human rights of the public. Even anonymised data is insufficient to protect people’s identity. It is imperative that the public is aware of the situation and be fully informed of the risks of giving away private genetic information to commercial companies as well as public organisations.
Police Are Getting DNA Data From People Who Think They Opted Out, The Intercept, September 2023
Forensic genetic genealogists skirted GEDmatch privacy rules by searching users who explicitly opted out of sharing DNA with law enforcement.
A new article summarises the loopholes that are allowing police unrestricted access to commercial DNA ‘ancestry’ databases, despite people explicitly choosing to opt out from allowing access.
Before you buy DNA tests – things to consider
This video is based on research for the project Fairness and Transparency in Emerging Health Markets: Protecting New Zealanders from the Risks of Personal Genomics. It is intended to introduce you to the world of commercial DNA tests (aka direct-to-consumer genetic tests) and the risks that these services pose to consumers.
Please see SSRN Draft Paper http://ssrn.com/abstract=4180967
And for the full paper, see Shmuel I. Becher and Andelka M Phillips, ‘Data Rights and Consumer Contracts: The Case of Personal Genomic Services’ in Damian Clifford, Jeannie Paterson & Kwan Ho Lau (eds), Data Rights and Private Law (Hart Publishing 2023)
At-home DNA tests just aren’t that reliable – and the risks may outweigh the benefits, The Conversation, November 2022
Dr Andelka M. Phillips summarises the key risks surrounding commercialised tests, including inaccurate data as well as privacy and human rights concerns and commercial exploitation of people’s private genetic information
F.D.A. Warns Patients About Some Prenatal Genetic Tests, The New York Times, April 2022
A new article in the New York Times has published concerns raised by the Food and Drug Administration (F.D.A) that genetic tests performed to screen for rare genetic diseases in babies, lack scientific evidence of their accuracy. Companies are making misleading claims about their products, prompting the F.D.A to request that doctors not use commercial tests by companies on their patients.
Despite such commercially sold tests being taken by up to a third of US pregnant women, such tests are not regulated as they are categorised as ‘lab-developed- tests’ that are not covered by the F.D.A. Private testing companies and start-ups have proliferated in the last decade, prompting calls for more thorough oversight to ensure their accuracy and utility that can assist, instead of hinder, health decisions for families and their health carers.
This lack of regulation can have devastating impacts on families, with some women reportedly ending pregnancies as a result of false test results. The lack of regulation is becoming an increasingly controversial issue. This latest call from the F.D.A has no power to force companies to do anything besides apply for voluntary approval for their products, though the rising awareness of their limitations may impact on the companies’ bottom lines.
The article further highlights that lack of information in company brochures, with many not mentioning the possibility of inaccurate or uninterpretable results, for example giving a false-positive result – a result wrongly indicating the presence of mutation linked to a disease or condition. This is despite some false-positive rates for certain tests reportedly as high as 85 %.
While selling products as ‘reliable’, ‘highly accurate’ and offering ‘peace of mind’, the response from companies to this F.D.A warning is that tests should be followed up by diagnostic testing, which is performed by healthcare professionals.
However, once again, as this article shows, lack of proper regulation, commercial vested interests and genetic hype are putting the lives and the health of the public at risk.
Journal of the American Medical Association (JAMA), 2022: What Can At-home Genetic Tests Tell Me About My Health?
Consumer Federation of America, 2020: Should you buy a Genetic Testing Kit?
Boston Review (2021): DNA and Our Twenty-First-Century Ancestors. By Professor Dauna Fullwiley. Home DNA ancestry kits include no ancestors, instead comparing customers to other present-day people based on assumptions about race and ethnicity. So what are they actually selling?
House of Commons Science and Technology Committee (June 2021): Direct-to-consumer genomic testing: First Report of Session 2021–22
UK government Science and Technology Committee recommends stronger regulations on consumer genetic testing.
A new report by the UK House of Commons Science and Technology Committee recommends that commercial testing companies selling direct-to-consumer tests should be properly regulated before they are put on the market, in order to ensure that they are reliable and clinically useful. New EU laws were recently introduced to require pre-market assessments of commercial tests (‘in vitro diagnostic medical device’ regulation (IVDR)), but are not yet fully implemented.
However, with UK exiting the EU before these new laws were implemented as a result of Brexit, England may continue with existing legislation that allows companies to self-declare if their tests are at all accurate or reliable in giving health-related information.
(Though Scotland has implied that they will continue to follow EU rules going forward, and it is likely that Northern Ireland will have to follow such laws).
Some of the issues raised in the report include the limited number of instances where genetic tests can accurately diagnose or predict disease risk. The report warns that consumers may overestimate their risk as a result of a genetic test, which may lead to unnecessary treatments or avoiding particular activities. Meanwhile others may underestimate risk due to favourable result, and thus delay seeking medical assistance. Moreover, such results may impact on people’s mental health if a disease is untreatable. Individual accounts of harms are described, with one example of a woman considering potentially dangerous medication following results of a commercial test.
Evidence of inaccurate or misleading results are described, noting that different results were obtained when identical samples were sent to different companies, with one report citing 40% of tests as being incorrect, and another showing that up to 80% of samples tested resulted in false-positive, incorrect results. Such inaccuracies may add unnecessary burdens to the NHS who have to confirm the commercial result, only to find that a substantial number of results are incorrect. There is a lack of study currently to be able to properly estimate the burdens and costs that such tests may place on the health service, and the report recommends that information is gathered to further understanding of this issue, as well as considering the possibility that companies can contribute to any additional costs incurred by the NHS as a result of commercial testing. There is also inconsistency between companies with regard to what gene variants are tested for. Some companies will for example test for hundreds of genes for cancer, but only 15% of genes were present across all eight companies’ testing methods, when analysed in a study. In other cases, not all genes associated with disease risk are included in tests, giving rise to the risk of false assurances.
Concerns for tests for diet and lifestyle are also raised, with one scientist’s submission describing such tests as merely ‘sexing up’ standard dietary and exercise advice to make money from people when there is no evidence that the product works.
Privacy and consent issues are also covered, with concerns surrounding potential lack of consent when companies make broad permission requirements for ‘research and development’, or that data may be used for criminal investigations, immigration enforcement, or insurance or job applications. Further, data may be vulnerable to security risks, or transferred to other parties if ownership changes when a company is sold. Privacy issues include the ability to identify distant relatives from any individual’s data.
In light of the above concerns, the report recommends that consumer tests are independently validated in line with many of the new requirements in the new EU law, with clear standards on technical performance. Currently, there are no requirements for commercial tests to meet the standards required in other settings such as the NHS. As such, commercial test results should not be integrated into NHS patient records.
The report also recommends, in line with the new EU legislation, that clinical ‘utility’ is independently tested prior to any test being sold to the public. The report also recommends that claims made to customers are accurate and not misleading. Performance requirements do not currently include the clinical performance of a test, which means that any test result does not necessarily lead to providing any useful information on diagnosis, treatment, management or prevention of a disease. As such, results might merely serve to give information on a genetic variant, which in itself may not translate to a beneficial clinical outcome. Experiences to date suggest that how important a genetic variant is considered to influence health and disease can change over time, and can even be disproven very quickly in the light of new understanding.
For a test to have good clinical utility also requires that any result is placed in the wider context of an individual’s circumstances e.g. family history and symptoms, which is needed to improve the interpretation of the genetic result. The NHS already takes into consideration such contextual factors, with expert supervision along with genetic counsellors provided to assist the whole testing process. Such contextual analysis is thus recommended to be incorporated as a safeguard against inaccurate commercial testing outcomes.
Other recommendations include that specific requirements be considered with regard to pre-natal testing, which may influence decisions on terminating pregnancies. Restrictions on such tests should be considered, along with restrictions on tests being performed on children that do not have any symptoms of ill health.
Phillips A (2018): Direct to Consumer Genetic Tests: analysis of contracts and list of commercial companies
BMJ (2019): Direct-to-consumer genetic testing.
Why using DNA to trace ancestry is problematic:
Mathieson I & Scally A (2020) What is Ancestry?
Position Statement on Direct to Consumer Genomic Testing by the UK Royal College of General Practitioners (2019)
The Royal College of General Practitioners (RCGP) and the British Society for Genetic Medicine (BSGM) recommend that health professionals should exercise caution when asked to offer, or provide, clinical expertise about the results of Direct to Consumer (DTC) genomic or genetic testing.
The analytical validity, sensitivity and clinical utility of such testing may be much lower than is popularly perceived. For certain types of DTC results, there is a very high chance of false positive or false negative results. This means that patients should be offered the NHS care which would otherwise have been offered (e.g. family history and risk assessment, healthy lifestyle advice, or referral to specialist care)1 regardless of their DTC result.