Curious About Your Genes? Companies Standing to Profit Are Too!


The Human Genome Project was a 13-year-long project that mapped the make-up of the human DNA. Completed in April 2003, it paved the way for the development of precision medicine, where “genomics, epigenomics, environmental exposure, and other data would be used to more accurately guide individual diagnosis,” according to the National Human Genome Research Institute. The advancements in the understanding of human DNA also spawned a lucrative, growing industry: commercial genetic testing services.

For less than $100, consumers can order a test kit to collect cell samples from a saliva swab, mail the sample to a laboratory, and receive test results in few weeks. These tests can search for people’s ancestry, hereditary traits, and other genetic information.

However, learning about your heritage may come at the expense of your privacy. 

According to FBI Supervisory Special Agent Edward You, many genetic testing companies are outsourcing the testing process to companies located in foreign countries, such as China. “The money is not in the test kits,” You recently said at an American Bar Association event at the University Club in Washington. These companies may realize the immense profit once they sell the data sets to pharmaceutical companies or other companies. 

Making matters more complicated, according to Liisa Thomas, chair of Winston & Strawn LLP’s privacy and data security practice, there aren’t enough laws in the U.S. addressing privacy- and security-related issues in this budding industry. This technology is still in the early stages, and we don’t know the full privacy and security implications, Nathan Kottkamp, senior data privacy and security counsel at McGuireWoods LLP in Richmond, Va., told Bloomberg BNA.

According to attorneys, U.S. laws, such as the Health Insurance Portability and Accountability Act (HIPAA) don’t apply overseas, and therefore, companies that outsource processing to third countries may be outside of U.S. jurisdiction. There could be meddling by state actors but jurisdictional limitations would prevent U.S. agencies from taking action abroad, Kottkamp said. There’s no U.S. law that prohibits data storage in a third country, so the real issue is whether those countries are providing enough protection, Thomas said. 

Representatives for 23andMe Inc. and LLC, two of the leading mail-in consumer genetic testing companies, told Bloomberg BNA that all of their sequencing and genotyping is done in the U.S.

To keep up with the constantly evolving world of privacy and security sign up for the Bloomberg BNA Privacy and Security Update.