Whether DTC marketing of whole-genome testing services is legal is still unclear in many countries. In Europe, DTC genetic tests may be banned by the Additional Protocol to the European Convention on Human Rights and Biomedicine, concerning Genetic Testing for Health Purposes (the Additional Protocol) (http://conventions.coe.int/Treaty/EN/Treaties/Html/203.htm
). Under the Additional Protocol genetic tests for health purposes may only be performed under ‘individualised medical supervision.'10
The Additional Protocol, however, needs to be signed and ratified by Member States in order for it to enter into force, a process that may take several years. Even if ratified, it could be argued that the genetic tests offered by 23andMe and the like are not for health purposes, and therefore are not subject to the Additional Protocol and the limitations it entails.11
In the United States, where most of the companies offering such services are based, the legal status of these companies is also not clear. At the federal level only a minimal amount of oversight is offered over laboratories that conduct genetic testing, and at the state level only about half of the states in the United States prohibit or limit DTC marketing of genetic testing.12
Regulators from New York and California, two of the states that limit DTC testing, have warned in recent months 23andMe, Navigenics, and additional companies providing the technological tools for whole-genome testing that DTC marketing of medically relevant tests may be illegal. The companies were told that a license and the involvement of the patients' physicians are required and received ‘cease and desist' letters from the public health departments in both states.13
The companies, in response, insisted that the services they provide are in compliance with state laws and continued to offer their services (http://blog.wired.com/wiredscience/2008/06/23andme-were-no.html
). Both deCODEme and 23andMe contest that the information they provide to individuals is of educational character only; on their websites, they clearly state that the information provided is not to be seen as medical advice. Navigenics even encourages potential customers to talk to a genetic counselor of their choice before they purchase the service.
This round of highly publicized legal battle ended recently when both 23andMe and Navigenics received a license from the state of California. The license was granted to them after they adhered to the requirement to have a physician involved in the process of ordering the test.14
However, genetic counseling is still not part of the testing and the delivery of its results to consumers, a concern discussed in several recent commentaries and editorials3, 4, 5
(but which is beyond the scope of the current article). Shortly after receiving the license, 23andMe drastically lowered the cost of the test it offers from US$999 to just US$399.15
One is left wondering if the recent price reduction is the result of ‘technological advancements' as proclaimed by the company, or their wish to rapidly increase their customer base for building up the comprehensive genotype/phenotype datasets needed for their planned activities.
One may also wonder if, aside from the dispute over the quality and utility of such personal genomics testing,16
such services should be allowed to proliferate and do business on a global level without any public oversight. Such oversight is needed with regard to two main issues: whose DNA is being tested, and who has access to the information retrieved from it. What kind of regulatory framework can assure that customers send in and have access only to their own DNA samples (or samples of individuals in their legal custody, such as their children's), and not to the DNA of third parties about whom they would like to gain genetic information? In the United States, until recently relevant regulation was found primarily at the state, rather than the federal level, with only few states requiring consent prior to performing genetic tests and having specific penalties for genetic privacy violations (see: genetic information: legal issues relating to discrimination and privacy http://www.ncsl.org/programs/health/genetics/prt.htm
). The enactment of the Genetic Information Non-discrimination Act (GINA) provides protection to genetic information in the federal level, but it protects primarily from employment and insurance discrimination based on genetic testing.17
One would expect that providers of personal genomics services, avoiding the risk of damaging their reputation and loosing their clientele, would also strive to ensure that unintended consequences do not materialize. Although all three companies, 23andMe, deCODEme, and Navigenics, inform consumers that with their online purchase of the service they also confirm that the submitted DNA sample is their own (or that they are authorized to submit it), this information is ‘buried' in the small print of the service agreement and informed consent sections of their web sites. The following scenarios outlined below for illustrative purposes, albeit being somewhat extreme, are not impossible under the existing framework:
First, consider a politician looking to disqualify a rival candidate from winning an electoral race by gaining access and sending her DNA sample for analysis by a personal genomics provider, and later ‘leaking' information about that rival candidate's genetic predisposition for a particular mental or personality disorder. It could be argued that in such matters the public interest overrides the candidate's right to privacy, but what about the responsibility of the company to ensure that this does not happen? Or, consider an attorney looking to defend a client charged with sexual assault by providing ‘genetic evidence' on promiscuous behavioral traits18
of the crime victim. Next, consider someone secretly testing the DNA of several partners before deciding with whom to conceive a child, looking for a ‘genetic match' and specific desired traits in the child or rather for a partner who is most likely to remain physically and mentally healthy. Indeed, every commercial niche seems to find an eager entrepreneur: the Swiss company GenePartner (http://www.genepartner.com/
) will help you find the ‘perfect match' based on your DNA analysis, for a promotional fee of just US$199 (until the end of 2008) and a saliva sample. Finally, consider a national security alert enabling police to access the databases of personal genomics providers in a global hunt for first-degree family members of a terror activist – an action leading to the interrogation of citizens who happened to share some genetic relatedness with the hunted subject's family. Privacy interests might also be compromised in the event that a personal genetics company decides to sell its database, containing genotypic and phenotypic information of its customers (potentially along with identifying information such as customers birthdates or zip codes), to a third party. In such cases, personal information might be transferred to a company and/or a country with less strict privacy protection mechanisms. Should customers be notified and be given the opportunity to have their personal information removed from the database in such situations?
This last issue also raises the question of ownership regarding both genotypic and phenotypic information stored in the database. Who owns the information? The company that retrieved the information, or the individual who wished to explore and investigate her genetic makeup? DeCODEme, in its otherwise very clear and comprehensive section titled ‘service agreement and informed consent' (http://www.decodeme.com/information/service_agreement
), does not mention ownership at all; 23andMe, in its ‘terms of service' section (https://www.23andme.com/about/tos/
) emphasizes its ownership of the saliva sample submitted by its customers, whereas specifically not claiming ownership of other materials provided by its customers (such as postings on its website). The customers, however, are responsible to protect and enforce their rights, including their right to privacy, in the submissions they provide. Navigenics, in a section titled ‘Our policy regarding gene patents,' (http://www.navigenics.com/policies/GenePatents/
) merely programmatically mentions that ‘you own your genome,' an ambiguous statement that does not clarify much on who has ownership rights in the sample sent to them.
The consequences of having a legal title are considerable: if the sample and information retrieved from it are considered the property of the company collecting and storing it, then the company is free to treat it as any other commodity, including selling or transferring the information to third parties, a troubling outcome that many consumers may not be aware of. One possible way to prevent this is by defining the holders of genetic information to be ‘trustees' of the information which they hold.19
A trustee is one who has a legal title to property that he holds in trust for the benefit of another and owes a fiduciary duty to that beneficiary. In the genetic context it could be especially appropriate to adopt a trustee model as it would apply greater restrictions and responsibilities as to the safekeeping of the genetic information collected and stored by companies offering DTC genetic tests. Adopting a trustee model would, for example, place limitations on the transferability of the information collected and on future disclosures in the absence of the consent of the client.