credit: Shaury Nash (Flickr)

Dear Scicom Slug,

A few years ago I paid $99, spit into a tube and signed up for 23andMe, a direct to consumer DNA testing service. Through their site I learned my genes gave me a low chance for most cancers, a higher chance for diabetes (not much of a surprise given that both my mother and uncle are diabetics) and that I had sticky earwax – I hadn’t known there was any other kind.

It was fun poking around the site and I even signed up for their research group. After a while, I stopped visiting the site and barely gave it a thought. But recently I read that 23andMe had made several deals with drug companies, one for up to 60 million dollars, and I realized that it could be my DNA that they’re examining.

On one hand, I’m not a privacy nut. I realize that a company can get far more information about me from my internet browsing habits and Facebook pages. And yet …  that’s my DNA. Should I be freaking out?

Confused

Dear Confused,

Take solace in the fact that you are not alone in this situation. Over 650,000 23andMe customers have signed up for the research study and at the pace that genomic research accelerates more and more of us will need to evaluate how much of ourselves we’re willing to share.

The tools to explore and decipher our DNA are becoming more sophisticated while the costs are plummeting. While the technology may be complicated, the ways that 23andMe can use your data are fairly straightforward and, unless you grant them new permissions, your genome is not an open book to 23andMe or their partners.

First lets talk about that contract you signed. By signing the 23andMe research agreement you have allowed the company and any third party – which explicitly includes pharmaceutical companies – a certain level of access to the genetic results you paid for, any online 23andMe survey information you filled out and access to your remaining saliva sample for any new breakthrough analysis 23andMe wants to perform.

According to 23andMe’s Media Relations person, Andy Kill:

“We consciously put a consent form in place that is platform agnostic so we wouldn’t have to re-consent all research participants as we update our technology platform over time. “

Which means you agreed to let 23andMe do whole genome sequencing or the next hot “-omics” analysis on your spit without confirming your approval.

Before you panic, take a deep breath and remember that it’s your right to remove yourself from any study you feel uncomfortable with, including 23andMe’s research group. You can’t extract your contribution to any published or soon-to-be published data, but you can act to keep your DNA, survey results and spit from further scrutiny.

Also, the agreement you signed does not allow 23andMe, or any drug company that has made a multimillion dollar deal with them, direct access to your information. The over 650,000 23andMe customers signed into the research program have had their data pooled, or aggregated, to protect their identities.

A researcher could ask for all females age 20 to 50 separated into groups with or without a particular gene variation. Then she could ask how many in each group had breast cancer, and how many in each of those groups smoked, or had smoked. With each query, the researcher would get a number for each requested category, but no direct access to individuals’ files. It’s like doing a google search and instead of getting pages, you only find out the number of hits.

This sort of anonymized research can be conducted on individuals with a fully sequenced genome, or it could be done exclusively on the survey results.

23andMe’s deal with Genentech will include the full genome sequencing of 3,000 23andMe Research participants, most of whom have Parkinson’s disease or have a relative with Parkinson’s. This would reveal every mutation in every gene, as well as the sequences of the vast amounts of DNA that may be involved in determining what genes are turned into proteins and when. Whole genome sequencing can reveal other things, like a person’s ancestry and the identifies of their relatives, It could even be matched to a crime scene DNA profile.

These 3,000 customers will be asked to re-consent. Not because of whole genome sequencing procedure, but because Genentech will want to comb through the DNA and surveys to find clues about the genes involved in Parkinson’s that might lead to drug targets. 

Names, email addresses, credit cards and passwords — all the account information — will be stripped from each file. But, as a 2012 paper in Science showed, once you have a person’s sequence and age, it’s trivial to identify them.

So, if you get an email from 23andMe asking you to re-consent, what should you do?

You should read the contract very carefully and don’t be afraid to ask questions. 23andMe has an independent ethics board, similar to what universities and government agencies use, and the obligation is on them to be transparent and not to mislead you. If you feel uncomfortable with any part of the contract, don’t re-consent. You can still participate in the anonymized studies as before.

Remember, it’s your decision. Welcome to the brave new world.

Scicom Slug

For further information:

23andMe’s general consent form: https://www.23andme.com/about/consent/

How scientists identified people from just their DNA, age and region they lived in: “Identifying Personal Genomes by Surname Inference.” Melissa Gymrek, Amy L. McGuire, David Golan, Eran Halperin, and Yaniv Erlich. Science, January 18, 2012