Is a commercial DNA test a good idea? Pay attention to the fine print

“Ready to explore your ethnicity?” The MyHeritage app builds up the tension with game show-like music. Then suddenly all kinds of cheerful tunes sound, from bagpipes (23.9 percent British) to darboeka (9.2 percent Middle Eastern). In a slick slideshow and on a glowing world map, DNA testing company MyHeritage shows “your unique ethnic background”, not to mention newly found relatives.

Scrape your cheek with a cotton swab, send it off, and a few months later be served your entire family history. Is it really that easy to determine your ancestry with a commercial DNA test? And what should consumers know before sending their saliva in an envelope to an unknown lab?

Companies such as MyHeritage, 23andMe and Ancestry offer DNA home tests for around 50 to 100 euros. They map the genetic material in a laboratory and compare it with the DNA of previous customers. This results in ancestry percentages: whose DNA shows specific similarities with the DNA of people from the Middle East may have a distant ancestor there.

These percentages are not very reliable, according to a study by the Dutch Consumers’ Association. The DNA of the same test subject yielded different results at three companies.

What DNA tests are good at is determining direct kinship. “People are not always prepared for the possible outcomes,” says Rosanne Edelenbosch, health coordinator at the Rathenau Institute, which deals with technology in society. “What if you find out that your father is not your biological father, do you want to know?”

Never anonymous

And then there are the privacy risks. “DNA contains the most intimate data there is, you can deduce a lot from it. Not only whether you have blue eyes, but also your predisposition to hereditary diseases, such as Alzheimer’s or breast cancer. In addition, a large part of your genetic code corresponds to family members, who may not have consented to the test,” says Edelenbosch.

You also saddle your loved ones with a result that indicates unexpected family ties or a possible genetic abnormality. In addition, DNA is unique for every person. A test is therefore never anonymous, although some companies claim so.

Corrette Ploem, professor of law, healthcare technology and medicine at the University of Amsterdam, is concerned about the emerging market for DNA tests. “The companies that offer this are located all over the world. In Europe we have good privacy laws, but in the US it is a completely different story.”

After digging through the lengthy privacy statements, it turns out that the labs of 23andMe, Ancestry and MyHeritage are indeed located in the United States. Ploem: “The legislation there cannot prevent the American government from accessing the data. And international supervision of how companies handle this intimate data is completely lacking.”

Resell

Moreover, says Ploem, people are often unaware that their DNA contains a wealth of information. “Data is the new gold, for example for pharmaceutical companies developing medicines.” Edelenbosch agrees: “These companies can make more money at the back than at the front.” For example, in 2018 the American 23andMe turned out to have a multi-million dollar deal with the British pharmaceutical company GlaxoSmithKline.

In order to resell DNA to third parties, the company requires permission from the consumer. They often obtain this with veiled questions such as: “Would you like to participate in scientific research?” Ploem: “It is then uncertain whether consumers will retain access to their own data, as the companies promise. How do you know that your DNA isn’t stuck in some database?”

According to Ploem and Edelenbosch, anyone who cannot contain their curiosity about their origins would do well to read the small print. The privacy statements of DNA testing companies should, if all goes well, state where they store the data and how long they store it. “In the best situation, the company operates entirely within Europe,” says Ploem. Edelenbosch adds: “Before you do business with such a company: check whether they will delete your data if you request it. Companies are legally obliged to do this, but there is not always supervision.”