PI files complaint about online DNA genealogical testing firm

22/10/2007

The leading online genealogical site Ancestry.com has embarked on a new service offering to test the DNA of its customers. This commercial service has been provided to assist genealogical tracing through familial lines.

However there are a number of troubling questions that Privacy International believes must be resolved before people can have confidence in this new service. Until these questions have been satisfactorily answered, we believe the service presents a number of substantial dangers for customers.

Our complaint to the UK Information Commissioner's Office is available here (in pdf).

For more information please see below.

Background

By way of background, Ancestry.com was created and launched in 1997 by a Utah based private company, “The Generations Network”, and now claims fifteen million users. Other Web sites owned by The Generations Network include MyFamily.com, Rootsweb.com and Genealogy.com. The company is based in Provo, Utah.

In 2007, in return for a majority interest, The Generations Network received $300 million from Spectrum Equity Investors, a company specializing in the online and communications markets..

Privacy International believes that the acquisition of DNA carries with it the most profound implications for privacy and security, and any such arrangement must be accompanied by stringent protections. It is for this reason that we are raising the following important questions.

• The FAQ (Frequently Asked Questions) on Ancestry.com states: “Ancestry.com will provide complimentary storage of samples submitted for DNA testing (..)”. This means that the Generations Network will maintain custody of the original genetic sample provided for testing. This raises two further questions:
• Is the duration of storage indefinite?
• Will ancestry.com customers be given a right to opt-out of storage of their genetic material?
• The Generations Network has entered into a partnership agreement with Sorenson Genomics, a Salt Lake City based DNA testing facility owned by billionaire James LeVoy Sorensen, a prominent member of the Church of Jesus Christ of Latter Day Saints (the Mormon Church).(1) What contractual relationship, if any, exists between Sorenson Genomics, the Mormon Church and/or the Generations Network that might permit the transfer to the Church of DNA data and DNA samples?
• A number of cooperative arrangements have been established between the Generations Network, Ancestry.com and the genealogical operations of the Mormon Church.(2) Will the details of these agreements be published?
• The FAQ on the DNA section of Ancestry.com is evasive on the point of lawful access to genetic data and genetic material. In the section “If I choose to have my DNA tested, will my DNA information be safe from medical insurance companies, the government, etc?” the FAQ merely says “Ancestry.com will not share your testing results with other organizations without your consent. In addition, as with all user submitted content Ancestry.com gives you control over your privacy settings that determine whether your information is public or anonymous.” This statement skirts the obvious issue of access by security and law enforcement agencies or seizure by way of court order. However the privacy policy on the main ancestry.com site advises that disclosure may occur “as required by law”. Is Ancestry.com prepared to advise potential customers that by submitting their DNA samples they are placing this material at the potential disposal of government and other authorities?
• What protections have been put in place to ensure that a person’s DNA is not submitted without consent by a third party? (for example, a child or partner covertly obtaining a saliva sample and submitting it in the person’s name).
• People submitting DNA samples to ancestry.com are given the option of communicating with anyone who has been identified as a genetic match. However, have people who are potential matches also been given the right not to receive such communications?
• The Ancestry.co.uk privacy policy makes no mention of obligations under the EU Data Protection Directive and related national laws regarding the export of sensitive personal data outside the European Economic Area. Nor are either Ancestry.com or The Generations Network listed as certified under the Department of Commerce “Safe Harbor” program for export of personal data from the EU. This raises the real possibility of breach of EU and national law.
• In its privacy policy, ancestry.com describes genetic and genealogical data held by it as a transferable asset. Does this mean that ancestry.com regards itself as the “owner” of a person’s DNA?

(1) See interview with Sorenson at http://deseretnews.com/dn/view/0,1249,685193155,00.html Salt Lake Tribune, July 15, 2007

(2) For a discussion of such arrangements see “Online genealogy just got easier” By Peggy Fletcher Stack, The Salt Lake Tribune, May 22nd 2007.

Related:
Mass Screenings of Volunteers helps to build UK DNA Database
Canadian Supreme Court upholds DNA databank
UK Early Beginnings of the DNA database
The United States and the Development of DNA Data Banks