On 31 Jan 2021 CBS 60 minutes did a lengthy segment on data collection of individuals by foreign countries, particularly China, having access to individual biometrics data including an individual's genetic data. The segment featured access to that data from two commercial enterprises, 23 & Me and Ancestry.

What seemed to be lacking in this broadcast was how my Ancestry DNA test data might be used to my detriment, particularly by a foreign government.

Is there a single example where DNA test data has represented an improper invasion of privacy, especially one where foreign governments used DNA test data against US citizens?

If my goal in providing my personal genetic data is achieved (i.e. learning of my heritage and potential living relatives) then I am inclined to provide that data. However, I would like to know the real risks of doing so.

  • 2
    this doesn't seem like a good fit for this site. this isn't really about genealogy but about pii, government, rights, and privacy
    – depperm
    Feb 2 at 15:47
  • 2
    @depperm - it may not be a "good" fit, but I can't imagine a better SE site that attracts genetic genealogists (professional or amatuer) that avail themselves of services of Ancestry or 23&me. The 60 minutes broadcast seemed to be an warning against the use of these services.
    – BobE
    Feb 2 at 16:30
  • 1
    @user2448131 In the United States, the Genetic Information Nondiscrimination Act prohibits such discrimination en.wikipedia.org/wiki/Genetic_Information_Nondiscrimination_Act
    – Harry V.
    Feb 3 at 5:21
  • 2
    @HarryVervet Interesting. Good Information. Of course any bills protection is only good until removed, see one recent attempt: 2017 proposal to reduce protection mentioned in the linked wiki article. Feb 3 at 5:41
  • 1
    Quite a lot of overlap between this question and genealogy.stackexchange.com/q/13150/6485
    – user104
    Feb 4 at 6:53

Since you're asking about foreign governments as opposed to the United States, there's basically three answers as of right now:

  1. There isn't any.
  2. It may not invade your privacy, but your DNA may allow someone else's to be.
  3. It may not invade your privacy now, but it may in the future.

Before I elaborate on those, I also want to highlight the fact that with the direct-to-consumer companies, there is still an agreement (or lack thereof) that you are agreeing to that specifies what the company can and can't do with your DNA. You are providing them something in exchange for their service, and unless the agreement explicitly includes certain protections or caveats for how they use your DNA, you're including your consent for whatever they may decide to do with it. If it's a concern you have, make sure to read the terms of service they include, and also pay attention to what they don't include in it. Law of contracts is a la Monkey's Paw: it's all about the explicit wording and how it would "rationally" be interpreted.

Answer 1: there isn't any.

This isn't a topic nor the place to discuss if it's ethical or not, so I say this only because it is specifically about your data privacy. It has at least been proven, both in the CBS episode you are referring to as well as in other places such as The New York Times that China is using DNA samples as one of many ways to build a surveillance state. The intended goal is to track things such as "ethnic minorities and other, more targeted groups" as well as potential government "threats" (whether real threats or simply dissidents).

However, as a citizen of the United States, the Genetic Information Nondiscrimination Act of 2008 prevents your genetic information from being used against you in certain scenarios.* This does not explicitly state any qualifiers about where the genetic information is sourced from, meaning if someone wanted to discriminate against you using your DNA, it would be illegal even if it came from foreign countries. So really, it comes down to exactly what you asked: what can China actually do to you, as a U.S. citizen?

*See answer 3.

Answer 2: ...your DNA may allow someone else's invasion of privacy.

So you've decided China can't actually hurt you as a U.S. citizen. But maybe you have relatives in China, or friends, or relatives you don't know about. The technology and science exists, as you stated in your own interests in using it, to use your DNA to identify genetic connections between yourself and other people that the DNA company has profiles on. So if the DNA company has those profiles, and they pass them along to a foreign country such as China, who has their own large database of DNA, they can then also make those connections between you and potential relatives.

However, who knows what China will be using that DNA for. It's no longer a third-party company offering you a service of just linking you with potential relatives; China can take this data and make whatever interpretations they want with it. It has already been observed** with other technologies that China is not above using secret snooping on people's connections to one another. Alternatively, they may have only your DNA, but they have other data that can identify relatives of yours who are Chinese citizens. Without even having the DNA of the citizen themself, they can hypothetically make decisions or interpretations about this person; maybe they've decided certain markers in your DNA profile make them more likely to be a criminal, or have a certain disease, and they preemptively act on this information, such as arresting them or forcing them to get sterilized. So it's no longer about if it will invade your privacy, but now whether you are contributing a potential tool to invade someone else's.

**Article isn't specifically about genetic data, but rather highlights the way that data can be used to identify other pieces of information that isn't visible on the surface, and includes examples of seemingly innocuous acts such as posting videos or sending money to friends can be used maliciously.

Answer 3: ...it may in the future.

So you've decided China can't actually hurt you as a U.S. citizen, and there's no way you can have relatives in China that may be affected. At least, right now.

In 2017 we already saw an attempt to modify the ADA and the Genetic Information Nondiscrimination Act. Note how even in that, it states "Collection of information ... of a family member ... is not an unlawful acquisition of genetic information about another family member." This means that this bill would have allowed certain workplace programs to use genetic information that isn't even yours to make decisions about your treatment under these programs. And this is just in the United States, by elected legislative officials. Imagine a hypothetical future where a foreign country assumes control of the U.S. in some way, or controls some other asset or resource that would allow them significant influence in American politics or even your life.

Further, technology is constantly evolving. We currently do not have the technology to sequence your entire DNA from the sample given, but what if we will in the future? Or what if there is some sort of bio-recognition technology developed that utilizes something in your DNA in the same way that you can use, for example, your voice or fingerprint. That DNA sample company now is the equivalent of a database of passwords, and has handed it out to you-don't-know-who. Just like your voice can be spoofed for voice recognition (as can your fingerprints), perhaps the same will be true of your DNA. Or even more risky, perhaps your DNA will be spoofed or recreated to such a point that you can now be framed for a crime.

TL;DR: There are no current, right now examples of DNA from a U.S. citizen, provided to a DNA testing company, then passed along in some way to a foreign power, being used maliciously. However, there are some risks available that may affect people seemingly unconnected, and there are current and developing technologies which make it possible to spoof biometrics in such a way that it could put you at risk in the future. Furthermore, there is no guarantee that the current law protecting you from genetic discrimination will stay in place.

Of course, this is all a bunch of what-ifs and hypotheticals. The same could be said that hypothetically, none of these things pan out, and everyone who has concerns are concerned over nothing.

To answer your indirect question of if there is any risk: like any exchange of personal or medical information, mind your Ps and Qs with whatever contracts or agreements you participate in, and make sure to read them thoroughly. Should the hypotheticals happen, these agreements are going to be what's analyzed should you sue or take any sort of legal action against the company. You'll want to make sure you pick a company with an agreement that you actually want to agree to.

Edit: to expand on an excellent additional point brought up by BobE, when considering which company you feel comfortable with, one thing to look into in their agreement (or other "official" statements) is what they do with the physical samples during and after processing. Furthermore, once the sample is processed, certain companies may only retain the information necessary for your request, while others may maintain all information retrieved, even if it will not be utilized. The best solution for this is to do your research on these matters as well, and keep in mind that their current policies may change.

  • Well thought out answer - adding on to your last para, perhaps one of the considerations ought to be if "company" is storing DNA material (that could be used for 'medical markers' in the future) versus storing the data (that does not contain medical/chromosomal markers). It is my understanding that (for Genealogical DNA) the current providers are discarding the actual genetic material and limiting the analysis to those that focus on pedigree.
    – BobE
    Feb 5 at 3:46
  • Are you missing a line at the indicated break? "that China is not above using secret snooping on people's connections to one another in order to / Alternatively, they may have only your DNA, but they have other data that can identify relatives of"
    – Jan Murphy
    Feb 5 at 6:56
  • @BobE excellent point. I included your observation with a source that includes multiple references to situations in the same vein or adjacent.
    – candlebrew
    Feb 5 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.