So, you’re thinking about using a commercial DNA testing kit! You’re not alone. Tens of millions of people have already spit into a little vial and mailed it away to a company promising to tell them where their ancestors are from, to show them cousins they didn’t know they had, and to explain once and for all why they hate the taste of cilantro.

“Begin your DNA Journey,” invites the FamilyTreeDNA kit. “Welcome to you,” says 23andMe’s gift box. DNA feels intensely personal: It is in us … it is us, after all.

But what else are you doing when you send your DNA away? Where are all the places that your DNA could end up as a result of your genealogical curiosity?

Medical Researchers and Drug Companies

When you send your DNA to a company like 23andMe or Ancestry.com, you can opt in to allow the companies to send your data to researchers who are studying genetics, demographic patterns, and diseases. 23andMe also says it sends your personal data to its “collaborators,” which include Pfizer and other pharmaceutical companies, and it announced last year that it would give people the option of getting alerts for clinical trials nearby that may be relevant to those with certain medical conditions.

The company says that genetic information and names are stored in separate databases, so that when it sends your genetic data to researchers, “you cannot reasonably be identified.” (As you’ll see below, though, that depends on your definition of the word reasonable.)

Bad Guys

Sometimes your data can get stolen. Veritas, a startup that says it can sequence a person’s entire genome for $599, has admitted that it experienced a data breach—although it also said that the portal that had been breached did not include genetic data.

Meanwhile, researchers at the University of Washington recently demonstrated how the free and public genealogy database GEDMatch was “vulnerable to multiple kinds of security risks,” and “a malicious user could also construct a fake genetic profile to impersonate someone’s relative.”

Two geneticists at the University of California, Davis, also showed in an experiment last year that it was not that hard to “hack” the GEDMatch database—someone can locate a specific person in the database by bulk-uploading publicly available sets of DNA profiles until there is a match to either that person or to one of the person’s relatives. (GEDMatch has since been acquired by a private company that may change its policies.)

If that doesn’t persuade you to be wary, unnamed “personal and operational risks” even prompted the Pentagon to advise U.S. troops not to use consumer DNA tests.

“We can’t change our genetic information, and so once it’s out there, it’s a hard decision to reverse,”

says UC Davis geneticist Michael Edge.

“It’s not like a credit card, where you can get a new one if need be.”

#dna #23andme #healthcare #bigdata #health #data science