Genomic Privacy: Advocating for the Convergence of Legal and Technical Solutions

Genomic Privacy:Advocating for the Convergence of Legal and Technical Solutions Can Kockan (bio), Dov Greenbaum (bio), Danielle Lee (bio), and Mark Gerstein (bio) The economy of DNA: consumer genomics and its risks Genomic data collection and analysis is an incredibly valuable sector within the information economy, yet genomic information has never been more pervasive nor publicly accessible. Just this past spring, the National Institutes of Health's "All of Us" program announced that it would make nearly one hundred thousand unique and diverse whole genome sequences available for researchers, and several other public efforts have similarly set out to collect and disseminate enormous amounts of genomic data for research.1 Beyond such institutions looking to innocuously advance their research and even beyond amateur genomic sleuths combing through our genetic information to try and crack unsolved crimes,2 there also exists reason to be concerned about matters relating to genetic privacy on the corporate side. [End Page 246] Companies such as MyHeritage and Ancestry. com collect client DNA in various degrees of quantity and quality, at times even using this data for commercial purposes and selling clients' genomic information to drug companies for hundreds of millions of dollars.3 In addition to the growing size of both public and private DNA databases, these databases have also grown increasingly more revealing as research continues to uncover additional correlations between genes and disease and hereditary conditions. For example, identical twins share 100 percent of their DNA, parents and siblings share up to 61 percent of their DNA, and even distant third cousins share up to 2.2 percent of their DNA.4 Thus, if even one of these individuals chooses to disclose their genomic information, they are in effect disclosing not only theirs but also much of the genomes of their close relatives. One study showed how the genetic information of the majority of Americans of European ancestry can be identified through their distant relatives' DNA that already exists in various public and private current databases.5 The result of such data is an ever-expanding genomic panopticon, as predicted by the late Supreme Court Justice Antonin Scalia.6 Following the COVID-19 pandemic, the genomic information consumed and produced around the world has only further contributed to expanding the realm of genomic data available to us. Genetic tests have become especially de rigueur when traversing borders, and it was even reported recently that various heads of state refused PCR testing when meeting the Russian president Putin out of fear that Russian intelligence might abuse and misuse the resulting genetic information.7 Yet, this fear is not limited to politicians, celebrities, or sports personalities whose genetic information could contain exploitable knowledge.8 In fact, given all the sunk costs for the infrastructure of pandemic genetic testing, some countries will likely continue to find excuses to collect and examine the DNA of visitors for a host of potentially actionable genetic data, including controversial correlations like propensity to violence or depression.9 As such, now would be the best time to enhance genetic data protection and privacy laws before we become too complacent with giving away our genes at the border, or anywhere else. A brief history of the technical and legal solutions for genomic privacy U.S. legislators have long assumed the primary role of protecting our genetic data, from instituting federal regulations like the Federal Genetic Information Nondiscrimination Act of 2008 (GINA) to state laws including those that target the limited use of genetic information in areas of health insurance, employment, and even direct-to-consumer genetic testing companies like 23andMe.10 However, laws are slow to change, and regulations are slow to implement. The Health Insurance Portability and Accountability Act (HIPAA) is exemplary of slowness in responding to outdated regulations. The 1996 law outlines limitations on the use of protected health information (PHI). Under HIPAA's Privacy Rule, individually identifiable health information is protected. Deidentified information is exempt from this rule, as is other data deemed unidentifiable.11 This definition is anachronistic in our world of big data, and even heretofore perceived benign data has long been shown to be as revealing as PHI.12 Practically speaking, these regulations are also...