Your DNA is a set of bodily instructions, a catalog of our evolutionary past and a personal warning label about your health risks. It is also a secret. No one knows what your DNA says.
Right?
That's a question looming larger in American life as genetic testing becomes a mainstream activity. Time named direct-to-consumer DNA exams its Invention of the Year for 2008, following the emergence of companies like 23andMe and Navigenics, which report on your genetic risk of illnesses such as prostate cancer or Parkinson's. Academic medical research efforts like Harvard's Personal Genome Project aim to study the DNA of volunteers, hoping to find genetic links to diseases. So do healthcare providers: In December, California-based Kaiser Permanente announced plans to study the DNA of 400,000 members.
The promise of these tests includes drugs that may someday be tailored to treat your illnesses. The peril is that your personal data could circulate more widely than you expect. DNA provides a rich digital source of medical information, which has great scientific value and lends itself to data sharing. But DNA testing currently involves a lightly regulated tangle of private and nonprofit researchers. Once you take a DNA test, it ceases to be your property. Your genetic data could circulate among insurers and employers, or even data brokers and pharmaceutical companies hoping to profit from it.
"Information can be harmful, and the risks great for individuals," says Patrick Taylor, deputy general counsel at Children's Hospital in Boston, who has written about genetic privacy. Those risks include the loss of a job or insurance -- employers or insurers might not like your DNA profile -- and the disclosure of medical secrets or the creation of family traumas. And with DNA, Taylor notes, "Once it's out, it's out." You can change your credit card number, but you can't apply for a new genetic code.
Your DNA is a kind of spiral ladder -- a double helix -- whose rungs consist of four types of molecules we call A, C, G, and T, for short. We have about 6 billion such letters, which form a code spelling out genetic messages. Within this are roughly 20,000 genes, stretches of DNA that instigate bodily actions.
A genome is a complete copy of DNA, which exists in most cells. All human genomes are similar; we share the same genes. But many versions of those genes exist. The several varieties of a gene called OCA2 can create brown, blue or even non-pigmented eyes. Stretched out over 6 billion letters, almost everyone's DNA has a unique string.
Commercial firms make DNA tests simple. 23andMe sends testing kits to its customers, who spit in a small tube and express-mail it back. For $399, you get data on roughly 100 genes, ranging from the serious (Parkinson's) to the incidental (earwax type), plus membership in the firm's online community. Navigenics offers multiple plans: A $499 fee to look at genes involved in 10 conditions over one year, or $2,500 (plus $250 in each following year) to study a larger sample of predispositions, including some forms of cancer, arthritis and multiple sclerosis. Another firm, Knome, will spell out your whole genome for a six-figure sum. But if the tests sound prohibitively expensive, stay tuned. Sequencing DNA is becoming so cheap we may decode whole genomes for $1,000 before Barack Obama leaves the White House.
Clearly, the medical possibilities are powerful. Currently most drugs are a pharmaceutical one-size-fits-all; they don't work well for everyone. For instance, some lung cancer drugs help only those with certain variants of a gene known as EGFR. Genetic tests could let doctors know which medications to prescribe. "Hopefully 15 years from now, people will be in disbelief that we took drugs and didn't know whether they were going to work for us," says Linda Avey, co-founder of 23andMe. Alternatively, genetics can provide preventive information; Navigenics will assess your predisposition for heart disease.
What's not to like? Well, your DNA can leak into the public arena. Institutions can suffer privacy lapses. In 2005, Kaiser Permanente, the same provider now starting its DNA database, was fined $200,000 by the state of California for allowing lab results concerning 150 patients to be accessible on the Web. And once your data is stored in computers, that creates more "low-tech ways that privacy can be lost," explains Stanford law professor Henry Greely, a skeptic about genetic privacy. "Laptops get stolen. Drives get stolen or lost."
Consumer testing companies and scientists acknowledge that privacy can be problematic. A disclaimer on the Navigenics Web site proclaims: "Navigenics does not and cannot guarantee that personally identifiable information about you will not be accessed by unauthorized persons." The Personal Genome Project goes further. In a warning to prospective participants, a project fact sheet states that anyone donating DNA should have "the expectation of full public data release." Genetic information is so hard to keep under wraps, it continues, that volunteers should disregard "any promises of permanent confidentiality or anonymity." This can happen due to both scientific advances and commercial practices.
To see how science can circumvent privacy, consider biologist James Watson, who with Francis Crick discovered the structure of DNA. Back in 2007, a company called 454 Life Sciences charted Watson's whole genome and published it online. But Watson redacted one thing, the DNA surrounding his APOE gene, which is linked to late-onset Alzheimer's. This was personal: Watson is 80, and one of his grandmothers had the illness. Surely even gossip-prone public figures deserve some genetic privacy.
However, in late 2007 a research team from Brisbane, Australia, privately contacted Watson to say they knew which variant of the APOE gene he possessed. Certain bits of DNA strongly suggest the presence of certain other DNA sequences. By looking at the variants Watson had of other genes, especially one called TOMM40, which may help move proteins around the body, the group could deduce his secret. In October 2008, they published their finding, noting it "has considerable relevance to concerns about privacy, confidentiality, discriminatory and defamatory use of genetic data."
In response to the group, Watson blacked out a bigger stretch of DNA from the online database devoted to his genome. That will keep his APOE data private for now. But as the researchers noted, "it will become even more necessary to redact" larger chunks of DNA in the future. As more genomes enter databases, the method will become more powerful.
While genetics marches forward, privacy retreats. In September, the National Institutes of Health shuttered an online database after David Craig, a University of Arizona researcher, identified individuals' DNA in its data. Moreover, we are still learning what all of our 20,000 genes do. If you make your genome public knowledge today, scientists might discover something tomorrow you'd rather keep private.
There are other reasons to keep your DNA to yourself. Genetic testing can unearth painful paternity surprises. Estimates vary, but between 1 and 10 percent of the presumed fathers in the United States are not the biological parents of the children they raise. Once recorded, your genetic information can also be subpoenaed and used against you in court.
In May 2008, Congress and President George W. Bush approved the Genetic Information Nondiscrimination Act (GINA) to prevent employers and insurers from using DNA data to deny people jobs or coverage. Most observers applauded GINA, which will take effect this May, but it's a limited measure. A person with an above-average Alzheimer's risk cannot be denied basic health insurance for that reason, but could be denied a long-term healthcare policy, life insurance or disability insurance.
Furthermore, GINA does not apply to the "incidental collection" of genetic data by employers and insurers, an ambiguous term yet to be defined in practice. Many testing companies reserve the right to sell your data. It could end up with employers and insurers in some "incidental" fashion — or parts of your DNA that seem "incidental" now could become relevant later. It's your responsibility to understand the privacy policies of any testing company. Moreover, "those policies are changeable, and you may not notice that," Taylor says. "With all that complexity, who knows what will happen?"
The same uncertainties apply to labs practicing covert genetic testing -- in which, for instance, spouses with paternity or infidelity concerns will send another person's DNA to be tested. "I don't think people realize how much DNA we leave around every day," Greely says. "There is a possibility that if somebody cared, they could get a sample and sequence by following you around." You might leave enough DNA for a test in a glass at a restaurant or office cafeteria.
Meanwhile, your DNA is one of two strands of valuable scientific information you possess. The other is your personal health information. Indeed, the power of contemporary genetics lies in its ability to correlate the two for your whole genome -- though environmental factors and personal habits must be taken into account, too. Ever taken drugs? Been treated for an addiction? Had a sexually transmitted disease? What's in your medicine cabinet? Academic researchers and testing companies will ask for personal information.
That personal data is supposed to be kept anonymous. But anonymity can be flimsy. In the 1990s, Massachusetts put medical information of anonymous state employees in a database. A Carnegie-Mellon computer scientist, Latanya Sweeney, promptly identified the medical record of then-governor William Weld, using only his birth date and city of residence. (Weld was the only person in his ZIP code, in Cambridge, Mass., with his exact birthday.) Most genetic databases figure to have richer information. The more data you provide, the more recognizable it is as yours.
It's for these reasons that the Personal Genome Project essentially tells its volunteers to forget about privacy guarantees. "I like the Personal Genome Project approach," Greely says. "It's honest. They're saying, 'If you want to take the risks, great.'"
For their part, the commercial testing companies swear your data is safe. "The Personal Genome Project is very important," says Amy DuRoss, vice president of policy and business affairs at Navigenics. "But it's fatalistic to believe you can't protect something as important as this data. Navigenics takes the position that we can keep it sacrosanct."
Early-adopting customers tend to agree. "They have every incentive to keep information private," says Blaine Bettinger, a law student and genetics blogger in New York state and a 23andMe customer. "A security breach would be devastating for those companies." Certainly well-funded firms like Navigenics and 23andMe can devote substantial resources to data protection.
Case closed? Not exactly. The testing companies also have partnerships with groups that want your data, from biotech companies to nonprofit researchers. 23andMe just announced one such deal with the Swiss firm Mondobiotech, and has an ongoing project with the Parkinson's Institute; Navigenics is conducting studies with the Mayo Clinic and Scripps Institute. The testing companies will act as a middleman between customers and researchers, in some cases earning a profit by, in effect, arranging the sale of your personal information.
The structure of such deals vary. For instance, Mondobiotech will find research subjects and pay 23andMe to do the testing. In other cases, 23andMe has signaled that they will solicit volunteers for research on behalf of drug companies. "A pharma may come to us and say, 'We would like to recruit people with a certain disease and a certain genetic profile,' and we can become the facilitators of that," explains 23andMe's Avey. It's part of the 23andMe business model. "We think there is value in our database by being able to connect people to the right studies."
To be clear, it's your choice. "We never sell data" without customer consent, Avey says. For personal data, customers consent every time they volunteer for a drug manufacturer's research project. But 23andMe will not notify customers every time they sell genetic data; in that case, a customer's initial consent -- given when first signing up for a 23andMe test -- suffices.
At least some potential customers object to the limited control they have over their data. "I don't believe 23andMe has nefarious purposes," says Diana Gale Matthiesen, a Florida resident who runs a genealogy Web site. "If I were younger, I might be applying for a job there. But certain people might have genes that drug companies could make a fortune off of." After discussing the policy with a 23andMe employee in an online forum, Matthiesen says she will not use any testing company claiming ownership of her genetic data in order to sell it.
Given this downside -- a potential loss of privacy or inadvertent boost to the bottom line of a Big Pharma firm -- who would disclose any personal medical secrets?
Misha Angrist is a professor at Duke's Institute for Genome Sciences and Policy. He suffers from depression and anxiety and recently began taking the prescription drugs Lexapro and Budeprion. He's one of the Personal Genome Project's first 10 volunteers and agreed to have his medical history posted online this fall. Wasn't it difficult to do that?
"I ruminated on it for a while," Angrist says. "And I discussed it with my primary-care physician." They agreed the benefits made it worthwhile, but Angrist's doctor did have a wry suggestion: "She said, 'Stock up on long-term care insurance.'"
Admittedly, Angrist works with colleagues who grasp his medical issues. Would he admit to depression if he were, say, an air-traffic controller? "I don't know," Angrist acknowledges. "That's a difficult question."
But Angrist has well-considered reasons for going public. Treating depression matter-of-factly may help de-stigmatize it. Noting the communities that spring up around illnesses, he says, "The question is how we take that ethos and make it normal."
Then there's the greater scientific good. Donating DNA does more than personalize medicine -- it helps us study common maladies. "Personal genomics promises autonomy in spades," says Angrist. "But how are we going to use it to reduce health disparities and give everyone a fair shake?" Becoming a data point could be one way, assuming that the availability of healthcare expands. Similarly, Bettinger says further DNA testing beyond his initial 23andMe sample "is something I would do to help people."
Doing so may also help us appreciate the complexity of genes. They interact with the environment, switch on and off, and express themselves thanks to larger somatic networks. Genomics may be a powerful tool for studying our bodies, but genes do not write the script for our lives. "Everything we've seen from studies of common diseases suggests we'd better unlearn that," Angrist says. "Otherwise we're not going to understand heart disease, most forms of cancer, diabetes, most forms of Parkinson's."
This is the seeming paradox of DNA: The better we understand our genes, the less important we might find them. "People believe in the magic of genes, and buy into the idea that they are the deepest secrets of our being," Greely says. "Whereas maybe my credit card records come closer to being a deep secret of my being."
If we refuse to be awed by DNA, though, we would be more attuned to genetics and less likely to overreact to it. That wouldn't remove the specific vexations of genetic privacy, but it would be a timely change.
After all, the advent of cheap genome testing could sink us further into the swamp of unwarranted genetic determinism. Our culture is steeped in ideas of genetic authority and in the talk of a gene for everything from addiction to adventure seeking to intelligence. Consumer testing firms, while full of people who emphasize the intricacies of gene expression, depend on this public belief in the power of genes. This is one reason genetic privacy matters: Data that circulates widely is likely to end up with an ill-informed person who believes genetics is destiny. It's why ethicists are still seeking ways to ensure our privacy: Taylor, for one, recently argued in Nature for stricter industrywide controls on genetic data, in which a few administrators could act as gatekeepers, providing access only for valid research queries.
Still, perhaps the highly personal nature of DNA testing will help us form more supple genetic ideas. "The public is set in an older, more determinative view of genes," Greely says. But as we learn more, he suggests, "it's entirely conceivable we'll see genes as independent risk-enhancing or limiting factors, but not particularly important in and of themselves." Surely we're capable of recognizing the complexity of our bodies and realizing that our inclinations, abilities and health are all heavily dependent on the nature of our contact with the world.
Right?
Shares