WPF Resources Page: Genetic Privacy Page

About genetic privacy, World Privacy Forum publications on genetic privacy, genetic privacy issues, and other resources

What is Genetic Privacy?

Genetic privacy relates to the complex set of issues surrounding how DNA information about individuals is handled and used. Some genetic privacy issues relate to the acquisition of DNA samples from individuals, other genetic privacy issues relate more to what is done with the DNA information later.

One of the challenges with genetic privacy is that genes reveal information about the person they are directly attached to, but they also reveal information about the blood relatives of that person. This means that a person making a decision about, for example, getting a commercial gene test. is actually making decisions that can impact other blood relatives. How does privacy work in this kind of situation? In the area of genetics and privacy, there are more questions than answers.

The World Privacy Forum has focused on several aspects of genetic privacy, including the use of genetic data in research, pharmacogenomics and personalized medicine, direct-to-consumer marketing, and genetic data in electronic health records and exchanges.

Key Issues in Genetic Privacy

Genetic privacy is an area rich with policy issues related to privacy and human rights. A few of the key policy areas include, (among many others):

Use of genetic material to discriminate against individuals (for example, for employment and insurance);

Storage issues related to genetic material after sample collection (for example, how long are samples kept and why, how securely are the samples kept, how are the samples destroyed, and so on);

Access and purpose specification issues who has access to genetic material that has been collected, and is that access in tandem with the original purpose for which the DNA was collected? (For example, are newborn screening samples also used for law enforcement purposes, etc.);

Identifiability issues — can “anonymous” research be re-linked with a person? The answer is increasingly yes. The World Privacy Forum believes that the capability of identifying individuals from subsets of genetic information will expand greatly in the future.

Consent issues, especially related to the genetic ripple effect, that is, the ability to tie other members of a family to a single source of genetic material. While robust consent may have been obtained for a single original use, if the DNA is used for secondary purposes to identify or describe a relative that has not given consent, challenging ethical questions arise. The issue of compelled or coerced consent also raises numerous ethical and legal issues.

Direct-to-Consumer marketing issues, the marketing of genetic tests directly to consumers through the Internet and generally outside the clinical setting has many difficulties attached to it. Much of the material about direct to consumer tests focus on the quality issues. But there are plenty of privacy risks. In particular, the privacy risks for consumers come in through privacy policies that may allow for further uses of the genetic materials, or the inappropriate marketing uses of consumer genetic information, even marketing uses of consumer requests for genetic tests.

World Privacy Forum Resources and Work

Following are links to information the World Privacy Forum has created as part of its work in the area of genetic privacy.

WPF Report – Privacy, the Precision Medicine Initiative, & the All of Us Research Program: Will Any Legal Protections Apply?

March 16, 2017

Medical treatments tailored to each individual’s physiology and genetic history have long been a dream, but this dream is data-intensive. Until recently, the lack of a broad set of detailed health information from a wide variety of research subjects stymied medical research efforts. The most current effort to turn personalized, tailored medicine into a reality is the Precision Medicine Initiative (PMI), which now includes the All of Us research program. It is this full PMI/All of Us research program, begun in 2015, that hopes to gather an unprecedented amount of detailed biomedical data sets — including biospecimens and detailed personal health information — from over one million volunteers, the largest group of medical research volunteers that has been assembled thus far in the United States, if not the world.

PUBLIC COMMENTS: Comments of the World Privacy Forum on the U.S. System of Oversight of Genetic Testing

December 19, 2007

The World Privacy Forum filed extensive comments with the Secretary’s Advisory Committee on Genetics, Health and Society (SACGHS) regarding its draft report on genetic testing oversight, U.S. System of Oversight of Genetic Testing: A Response to the Charge of the Secretary of HHS. The World Privacy Forum requested SACGHS pay more attention in its final report to the privacy consequences of unregulated genetic testing that occurs outside the health care sector. The WPF comments note that current and proposed remedies for the misuse of genetic information tend to focus on the use of the information within the health care treatment, payment, and insurance systems. What is crucially important is to analyze how to protect genetic information in the realm of commercial collection, maintenance, use and disclosures. Another area the comments discuss is the potential for new forms of fraudulent activity related to genetic testing (Phantom genetic testing, that is, genetic tests marketed to consumers that are not even real or viable genetic tests.) The World Privacy Forum specifically recommended that the National Committee on Vital and Health Statistics be tasked with looking at this matter, that an independent pre-market assessment mechanism is created for genetic tests offered outside the clinical setting, and that privacy be expressly discussed in the overarching recommendations in the final report.

Download the comments (PDF)

Read the comments

PUBLIC COMMENTS: Comments of the World Privacy Forum on Proposed GINA Regulation, Title II Proposed Implementation.

April 22, 2009

The World Privacy Forum filed comments on the proposed regulations on the Genetic Information NonDiscrimination Act, or GINA. The comments request that the Equal Opportunity Employment Commission close down several potential loophole in consumer protection in the regulations. The Forum specifically asked the EEOC to consider curtailing the amount of commercially available information employers could access about employees, for example, through marketing databases. WPF also requested that those covered under GINA be required to maintain audit trails in certain circumstances, and urged that wellness programs be structured in such a way as to prevent information leakage through billing and other activities.

Download the comments (PDF)

Read the comments

PUBLIC COMMENTS: Comments of the World Privacy Forum on GINA clarification

December 9, 2008

In response to a Request for Information (RFI) from U.S. federal agencies regarding the recently passed GINA (Genetic Information Nondiscrimination Act), the World Privacy Forum filed a detailed response with suggestions on what aspects of GINA need clarification. The comments focus on a number of privacy issues the RFI raised, including model privacy notices and the issue of what the GINA statute calls “incidental collection” of genetic information. Currently, GINA states that some kinds of information are exempted from being considered as regulated for medical underwriting purposes. For example, medical information gleaned about patients for underwriting purposes from medical databases is regulated. But medical information gleaned about patients for underwriting purposes from, for example, marketing lists containing robust patient information may be unregulated if the law is not clarified in the regulatory process. The World Privacy Forum urged HHS and the Department of Labor to substantially clarify what constitutes “incidental collection,” and urged the agencies to consider lists containing identifiable patient information to be considered in the same category as a “medical database.”

Download the comments (PDF)

Read the comments

PUBLIC COMMENTS: Comments of the World Privacy Forum on protecting privacy in pharmacogenomics research

May 23, 2007

The World Privacy Forum believes that the capability of identifying individuals from subsets of genetic information will expand greatly in the future. In public comments filed with the National Institutes of Health on pharmacogenomics (PGx) research, or research using genetic information to create highly personalized medicine, the World Privacy Forum recommended that all research activities that involve any type of patient-specific genetic information be required to have certificates of confidentiality, whether that information appears identifiable or not. The WPF also urged the NIH to require strong data use agreements to protect individuals’ privacy. The WPF also urged NIH and the Department of Health and Human Services to reinstate the position of “privacy advocate” so as to provide oversight in this area.

Download the comments (PDF)

Read the comments

PUBLIC COMMENTS: Comments of the World Privacy Forum on genome-wide association studies

July 18, 2006

The collection of DNA material from 500,000 to 1,000,000 or more individuals as part of a large U.S. medical research project raises many challenging ethical, legal, and privacy issues. An advisory committee reporting to the Office of the Secretary of Health and Human Services ( the Secretary’s Advisory Committee on Genetics, Health and Society) has published a detailed analysis of the issues such a project would raise in a draft report. The committee’s final report and policy recommendations will be submitted to the Secretary of HHS. The World Privacy Forum has submitted public comments on the draft report; the comments include key policy recommendations. The Forum’s recommendations include the need to provide protection from compelled disclosure of information, the necessity for a full-time project privacy officer with enforcement power, and the need for a far-reaching and robust privacy policy that exceeds the requirements of HIPAA, among other recommendations.

Download the comments (PDF)

Read the comments

PUBLIC COMMENTS: Comments of the World Privacy Forum on privacy and personalized health care

February 5, 2007

The World Privacy Forum filed public comments with the Department of Health and Human services in response to an HHS request for information regarding the use of patients’ genetic data for research, health care, and for use in electronic health records. The World Privacy Forum is requesting that HHS use all Fair Information Principles in any personalized health care projects, and is requesting that a formal ELSI (ethical, legal, and social implications) committee be set up to oversee any projects, among other requests.

Download the comments (PDF)

Read the comments

New Report: Risky Analysis: Assessing and Improving AI Governance Tools

We are pleased to announce the publication of a new WPF report, “Risky Analysis: Assessing and Improving AI Governance Tools.” This report sets out a definition of AI governance tools, documents why and how these tools are critically important for trustworthy AI, and where these tools are around the world. The report also documents problems in some AI governance tools themselves, and suggests pathways to improve AI governance tools and create an evaluative environment to measure their effectiveness. AI systems should not be deployed without simultaneously evaluating the potential adverse impacts of such systems and mitigating their risks, and most of the world agrees about the need to take precautions against the threats posed. The specific tools and techniques that exist to evaluate and measure AI systems for their inclusiveness, fairness, explainability, privacy, safety and other trustworthiness issues — called in the report collectively AI governance tools – can improve such issues. While some AI governance tools provide reassurance to the public and to regulators, the tools too often lack meaningful oversight and quality assessments. Incomplete or ineffective AI governance tools can create a false sense of confidence, cause unintended problems, and generally undermine the promise of AI systems. The report contains rich background details, use cases, potential solutions to the problems discussed in the report, and a global index of AI Governance Tools.
National IDs Around the World — Interactive map

About this Data Visualization: This interactive map displays the presence...
Report: From the Filing Cabinet to the Cloud: Updating the Privacy Act of 1974

This comprehensive report and proposed bill text is focused on the Privacy Act of 1974, an important and early Federal privacy law that applies to the government sector and some contractors. The Privacy Act was written for the 1970s information era -- an era that was characterized by the use of mainframe computers and filing cabinets. Today's digital information era looks much different than the '70s: smart phones are smarter than the old mainframes, and documents are now routinely digitized and stored and perhaps even analyzed in the cloud, among many other changes. The report focuses on why the Privacy Act needs an update that will bring it into this century, and how that could look and work. This work was written by Robert Gellman, and informed by a two-year multi-stakeholder process.