Commercial genetic genealogy and health websites such as Ancestry, 23andMe and MyHeritage offer a range of testing possibilities related to genetic genealogy and health analysis. You click “I agree” on a consent form, spit in a tube, send it off to a lab and await the results.
For Lisa Pottie of Glen Haven, N.S., doing this helped uncover her adopted mother’s birth family. Her quest ignited when she found notes indicating that her father, who died in 2013, had been trying to find information on his wife’s birth mother.
“I think a lot of people lose out because they don’t do this,” she said.
But the process is much more than uncovering things about oneself. It involves the sharing of deeply personal information, making it critical for consumers to thoroughly research a company’s website and consent form before agreeing to send away their DNA.
Taking advantage of informed consent
Most companies provide detailed policies on their website, along with a phone number or email address to contact, according to Daniela Bassan, Halifax partner with law firm Stewart McKelvey.
“Always read the fine print, one hundred per cent. You have to do that,” said Bassan. “Ask questions if you’re not sure … it’s really important because you may be agreeing to (the policies) by virtue of paying for the kit.”
Signers usually share contact information, biological samples, payment information and web behaviour data. They could also agree to have their results shared with the database or anonymized for researchers and published studies.
How long data and samples are kept, what happens in the case of death and if consumers can remove their data later are also policies to review.
Pottie said that she feels reassured by the control she has.
“If I go and I delete my test, like download it and delete it, it’s gone,” she said. “They don’t have it anymore. They don’t retain a copy of it. It’s all in their terms of service.”
As with any instance of giving away information, there is no guarantee that it is safe from a data breach or that the sample will not be misplaced, said Bassan. Even a clever investigator could connect the dots and identify someone.
Pottie recognizes concerns people may have but points out that people leave their DNA in places every day.
“I think people fail to realize that, if I go to Tim Hortons, for example, and I pay with my $5 bill, well I’ve left traces of my DNA on that $5 bill,” said Pottie. “If someone really wants to get it, they’ll get it.”
As DNA testing grows in popularity, Bassan said there could be more information added to consent forms and policies. If complaints are made to the Office of the Privacy Commissioner, that could lead to further decisions or reports down the road.
The federal Genetic Non-Discrimination Act, upheld by a July 2020 Supreme Court of Canada decision – it was passed in 2017 but challenged by Quebec because of its overlap from criminal law to property and civil law – prohibits a third party, such as a government department, insurance company or employer to demand DNA or DNA data from an individual, even if they already did a test with another party. As well, the law makes collecting, using or sharing results without the individual’s written consent a crime. Penalties reach millions of dollars in fines and years in prison.
“It is definitely criminally sanctionable … if you’re entering into a contract with an insurance company or any kind of company, and they’re asking about your genetic tests, then you need to provide written consent,” said Bassan. “If you don’t consent in writing, you don’t need to provide it.”
The company may also operate under another state’s laws, meaning that Canadian law will not protect individuals under every circumstance.
Companies often publish transparency reports stating the number of information requests they have received from third parties and government officials, and if the data was granted or challenged.
“Law enforcement could potentially look for a subpoena or warrant to get access,” said Bassan. “(They could) get an order against the company, potentially to the database, or to the results that the company has.”
Some police forces have reportedly uploaded DNA samples in an attempt to identify them, such as Vancouver police in the capture of Golden State Killer Joseph James DeAngelo. This means users could be contributing to the identification of family members even when they have not taken a test.
New information about yourself and others
Pottie initially took her test in secret when she saw a sale on MyHeritage, but once potential relatives started messaging her on Facebook — including a second cousin — she told her mother, Gay Durnford. This sparked a genetic genealogy quest, with her mother and other family members submitting their DNA.
At the same time, a request for adoption records revealed that the birth parent had died. Nova Scotia is the only province without open records, meaning that an adopted person cannot access identifying information about themselves without the consent of a birth parent or if the parent dies.
After waiting seven months for the worker to gather all the documents, they learned a lot about Durnford’s birth family and were able to connect those records to the matches they made online.
Nova Scotia is considering amending the Adoption Disclosure Act — consultations happened in 2019 and early 2020, with one survey revealing that 82 of respondents did not believe that the current law gives enough identifying information. Prince Edward Island’s records opened in January and Newfoundland and Labrador’s in 2003.
“The province puts up a lot of roadblocks for people in that situation,” said Pottie. “It’s a touchy subject. I get (that) it’s not easy to change those laws. How do you protect everybody, but still give access?”
Finding out about new family through genetic genealogy databases can also be a touchy subject, with the decision to take a DNA test impacting many more people than the individual giving consent. And assuming the testing was done at an accredited lab, Bassan said that consumers should be prepared for potentially bad news in terms of health.
“People may find that personally very disturbing, to learn more information about their ancestry that is maybe different from how they understood things … at the end of the day, you have to know yourself,” she said. “Are you prepared to take the good with the bad in terms of the information that comes through?
In the two years since her first DNA test, Pottie has connected with new family members and written about that genealogy journey on her blog.
“As someone who spent years searching … we never would have found the things that we found out if had we not done that test, even with all the adoption papers,” she said. “We might have known things, but we wouldn’t be 100 per cent sure, like we are right now.”
Her tip is to do one DNA test and upload the data to additional genealogy websites to yield potential matches in those databases.
Pottie believes that DNA testing is not just for people with special circumstances. Her husband did a test, and the old saying that many Maritimers are related through the generations ended up proving true when she matched with his father, giving them a good laugh.
“We’re just starting to discover their story, which is equally as interesting and stuff he knows nothing about,” she said. “It’s a really good winter project.”