23 and who? Your DNA test results and the law

At-home DNA tests promise a lot.

There are kits that use your genetic code to find long lost relatives and detect possible diseases early. Some tests vow they’ll figure out the best weight loss plan, hair and skin products — even the perfect glass of wine — for your genetic specifications.

But, as these tests become more popular, some groups and lawmakers are starting to wonder: What if your DNA data gets into the wrong hands?

"Imagine if you're up for a job and your prospective employer finds out you're predisposed to an expensive disease such as multiple sclerosis,” said Peter Pitts, a former associate commissioner at the Food and Drug Administration who now runs a think tank called the Center for Medicine in the Public Interest. “Imagine if you're running for president and your opponents find out because of your DNA test that you're predisposed to Alzheimer's disease, and they think that's something the public should know."

Lawmakers in Congress and in statehouses across the nation are imagining what could happen and taking steps to ensure the worst doesn’t. In Minnesota, big players in the genetic testing business — Ancestry and 23andMe — hired lobbying power in May and legislators have drafted bills that they say will tighten consumer protections for Minnesotans submitting their DNA.

"If your Social Security number is stolen you can deal with that. If your credit card is stolen you can deal with that,” Pitts said. “But at the end of the day, your DNA is you forever, and allowing people to have access to it allows them to do nefarious things."

Consumer advocacy groups said they don’t think people read the fine print when they take these tests. If they did, they’d know these DNA testing companies can and often do share and sell their data to other companies or universities for research.

A bill sponsored by Rep. Eric Lucero, R-Dayton, would bolster existing law to affirm that genetic information is the property of the individual, not companies, and would it increase requirements on what companies must tell a consumer up front. It would also require any collection, use or storage of the information to be limited to what the consumer consented to.

"The law is not keeping up with technology, because innovation far outpaces what government is able to do in terms of controls," said Lucero, who works as a cybersecurity specialist for his day job.

The idea didn't get much discussion amid debates over the budget last session, but it's likely to get a closer look next year.

Congress is also considering new federal privacy rules around genetics, a move that prompted some of the top DNA-testing firms to form the so-called Coalition for Genetic Data Protection. Companies Ancestry, 23andMe and Helix are seeking “reasonable and uniform privacy regulation that will ensure the responsible and ethical handling of every person’s genetic data,” according to the group’s website.

Kathy Hibbs, chief legal officer at 23andMe, said there are a lot of ways they protect consumer data. Names, credit card information and other identifying data are kept separate from an individual's DNA, she said. And she says they also spell out clearly to customers that they can opt in to being a part of scientific research.

"We certainly understand and support consumer protection and consumer privacy we think that's critically important,” she said. “It's one of the things we spend a lot of time on our website and in our information making sure consumers understand their choices."

But Hibbs said there are benefits to sharing your DNA data, which is used by universities and biotech companies to cure diseases for generations to come.

Law enforcement has also tapped into some company databases to help them solve cold cases.

Detectives used a genetic database to track down the relatives of the Golden State Killer, and eventually the man himself. The serial killer and rapist had evaded capture for decades. And in Minnesota, law enforcement used similar data to arrest and charge businessman Jerry Westrom for the stabbing murder of a woman in Minneapolis 35 years ago.

Lucero said it’s the age-old competing forces: “security versus liberty.”

“That is always the tug of war,” he said. “That’s why it’s so important to start to get ahead of this. Innovation will continue, whether we do anything or not. People need to be empowered with the authority to say what can and should not be done with their personal and private information.”