A few months ago I received an email from someone asking if we could be related. He was contacting me, he said, because we share the same last name, an unusual name outside of Germany or the American Midwest. (In Ireland, it’s limited to my brother and me.)
a few emails in the exchange, he asked if I had done any of those family tree genetic tests with sites like Ancestry.com or 23&Me. I hadn’t, but it got me thinking.
Now I’m a tech journalist in the data protection regulatory capital of the world, Dublin.
I write about things like GDPR and the horrible things that can happen to your personal data online. It’s fair to say that most of my peers are, and let me say this politely, unenthusiastic about filing personal DNA tests with commercial companies on the Internet.
Fears range from insurance companies buying your genetic health data to targeted bioweapon, as some members of the US Congress are now warning.
But journalism sometimes goes beyond the theory of potential process pitfalls. Sometimes you have to try the thing you are warning about. In this case, there was also the allure of knowing more about my origins, my heritage and my broader family tree.
It’s more valuable than any browser data or location tracking. This is a real status report on my body’s needs, abilities and limitations.
So last December, I spat in a little plastic tube and sent it to 23&Me. About a month later, I got the results.
I was slightly surprised. It wasn’t all I was looking for. But it told me a lot of things that I really didn’t expect.
In summary, the piece of ancestry was a dud. I learned little or nothing about the identity of my distant ancestors or members of my extended family. A few possible third and fourth cousins were identified, a few of whom emailed me (for the exercise, I chose to be reachable).
But the health section was quite fascinating. I have received nearly 100 separate reports of possible genetic predispositions, ranging from cancer and diabetes to Parkinson’s and Alzheimer’s. The analysis generally looked like this: “Chronic kidney disease: undetected variants… cystic fibrosis: undetected variants… type 2 diabetes: typical probability”, and so on.
Even though 23&Me keeps all its promises by not marketing me to the world, we all know that companies holding sensitive personal information get hacked.
Of the 59 serious medical conditions I could deal with, diabetes was the only one that showed up as likely to affect me. That doesn’t mean those other conditions are clear at all – it just means that the specific variants they tested didn’t raise any red flags.
The reaction of friends and family to my testing for these conditions was interesting. Many couldn’t understand why I might want to fish for results that might suggest future death.
But of all the reasons not to do a genetic test online, and there are good ones, this seems to me to be the weakest. If I have a gene known to overlap with a particular serious medical condition, isn’t it better to find out and possibly seek pre-treatment or a lifestyle change?
Perhaps equally interesting, if not equally vital, was the accuracy with which this single spit test could predict a staggering array of seemingly unrelated physical and even psychological predispositions. He correctly identified 35 of the 37 “traits” I have.
It wasn’t just about physical issues like back hair, eye color, dimples, and “toe length ratio.” He somehow knew that I hate chewing noises, that I’m not afraid to speak in public, and that I love vanilla ice cream as much as chocolate ice cream. To be clear, many of these predictions came from surveys associated with test takers like me.
Even still, I was surprised how a tiny plastic saliva vial could so accurately detect my likelihood of suffering from motion sickness or early hair loss.
Of the 59 serious medical conditions I could face, diabetes was the only one that was found to affect me.
Sorry, not just surprised. Nervous too. Let’s be honest: this stuff is absolute gold for a million different commercial and institutional interests. It’s more valuable than any browser data or location tracking. This is a real status report on my body’s needs, abilities and limitations.
Which brings us to the obvious question: am I worried that some of the genetic data extracted by 23&Me will now be marketed or transferred online to other companies or organizations?
The honest answer is yes. 23&Me blindly swears it won’t, pointing to the many protocols and processes it has in place to protect itself from it. But the thing is, my extracted DNA is now on a database controlled by 23&Me. Also, this is mostly happening outside of the EU, which could dilute the rights I would normally rely on with GDPR.
And even though 23&Me keeps all of its promises by not marketing me to the world, we all know that companies with sensitive personal information get hacked all the time.
I may not know much more about my great-great-great-grandparents. But testing serious disease variants at the genetic level does not seem like a totally useless exercise.
That said, in Ireland insurance companies – as well as employers and other authorities – are not allowed to ask for details of genetic tests and are not allowed to use them to assess things like the applicability of coverage or annual dues. This is mainly due to the Disability Act 2005.
But this kind of legislative background is only partially reassuring. I know that I now live with the possibility of my DNA data being, over time, somehow leaked to an entity that I would not like to have. And it’s not just an email address or a login password.
And yet, at the risk of enraging my data privacy friends, I’m not sure I regret doing it. I may not know much more about my great-great-great-grandparents. But testing serious disease variants at the genetic level does not seem like a totally useless exercise. And if I suddenly start seeing ads for rabies medicine that other people are chewing, I’ll know where it’s coming from.