Your DNA Can Be Stolen

Use these links to jump to different sections:

• Your DNA is Out There
• An Unregulated Frontier
• Using Your DNA Profile Without Consent

Mapping the human genome has provided previously unimagined opportunities to understand biology, the past and the future, and to potentially prevent and cure diseases.

As access to genetic testing and genetic information widens, and testing itself becomes affordable and noninvasive, regular folks have access to genetic data that can help find ancestral relatives and reveal genetical proclivities.

Your DNA is Out There

But easy access has its price in the technological age. It is now possible to obtain someone’s ‘abandoned’ genetic material and have it tested without their knowledge or consent. And abandoned DNA is present on everything from a cigarette butt to a soda can, and DNA samples can be submitted for testing without identifying the owner of the material.

In fact, this type of retrieved material is used all the time by law enforcement to determine the identity of suspects for criminal prosecution.

Recently, in a cold case dating back to the 1970s, police uncovered an alleged serial killer, the golden state killer, in Sacramento, California, by piecing together crime scene evidence, abandoned DNA and, in a relatively new approach, DNA of the alleged killer’s relatives submitted to a gene-collecting website. The website’s stated purpose is to connect people with lost biological relatives, but its use in this type of investigative context is entirely foreseeable.

An Unregulated Frontier

The direct-to-consumer genetic testing market—which includes popular test kits for genetic testing companies, like 23andMe and AncestryDNA—is not currently regulated by the FDA or the FTC, leaving the industry susceptible to individual discretion.

What, for one person, is a desire to satisfy curiosity about heritage, family tree, paternity or markers for disease, may be, for another, unethical interference with things that are not ours to know. State laws vary widely as to how to interpret genetic privacy or ownership, although most require informed consent to use one’s genetic material for research purposes. T

o date, criminal liability for misappropriation of genetic material remains largely an academic and legislative discussion.

Using Your DNA Profile Without Consent

What If you’ve had your own DNA tested, are there any protections in place to secure your DNA profile from being used for a purpose to which you don’t consent?

Well, yes and no.

Most websites tout their privacy practices and provide options to have all information returned to the consumer. However, as the Sacramento case reveals, there are not many controls on DNA databases and how your genetic profile is processed or catalogued, and you may have no way of knowing for certain how well your information is protected. Hackers steal information; you must scrutinize a website’s privacy policies carefully.

As noted, it isn’t necessary for you to consent to someone else submitting your ‘abandoned’ genetic material for analysis.

Additionally, your unknown family members who do consensually provide their genes are essentially giving info on you, too. For now, you are probably limited in your ability to pursue any sort of criminal prosecution for DNA theft, but you may have some legal action available through a civil suit— such as negligence, fraud, or unfair trade practices against the testing company—if your privacy rights are violated.

In addition, report any problems to the FTC, which investigates claims against DNA testing services.

Ultimately, the law on genetic privacy is still developing. If you have a DNA misuse issue, talk to a personal injury attorney with experience representing clients on privacy claims. For more information on this area of law, see our overview of personal injury.