Abstract

Our genomic sequence constitutes the most sensitive and personal of information: uniquely identifying us, revealing our propensity to develop certain diseases and conditions, and exposing familial connections of close genetic relatives. Big Data enables consumer-genomics companies to collect, store, and electronically share genomic-sequence data in conjunction with numerous pieces of private health and personal information. Consumer curation of data currently occurs largely outside pertinent federal regulations ordinarily governing the handling of private health information, which means consumers may not fully understand the implications of the transaction during the process of submitting their genomic and health information. This article describes 23andMe's corporate model, including relevant terms contained in its consent and privacy policies of which consumers should be aware, and discusses practices currently permitted by law that pose significant informational risks to individual privacy, including exposing the consumer and his close family members to stigma, bias, discrimination, and criminal investigation.

Contents I. Introduction II. Big Data and Consumer Genomics A. The Explosion of Big Data and Health Information B. Technology's Impact on the Availability and Revocability of Genomic Information C. Examining 23andMe's Business Model 1. 23andMe's Initial Business Model and FDA Noncompliance 2. 23andMe's Revived Business Model 3. Transforming the Traditional Research Model 4. Consumer Curation of Genomic and Health Data a. Tompkins v. 23andMe's Holding: Read the Clickwrap b. A Closer Examination of 23andMe's Research Consent and Privacy Statement c. Integrating Tompkins with 23andMe's Policies III. Regulations Governing Consumer Genomics A. Outside the Regulatory Framework B. Commercial-Law Standards and the Federal Trade Commission C. Anticipated Changes to Common Rule D. Applying Anticipated Changes to 23and Me IV. Connecting Database Information Back to the Consumer A. De-identification and Re-identification B. Predictive Analytics Paint a Data Mosaic V. Informational Risks Arising from Participation in Consumer Genomics A. Raising Concerns about Privacy B. Defining Privacy and Disclosures C. Entities Interested in Accessing the Consumer Genomics Database 1. Data Brokers and Marketing 2. Pharmaceutical Corporations 3. Discrimination in Employment and Insurance 4. Police Power and Law Enforcement a. Big Data as a Resource for Targeted Policing b. Using Consumer Genomics for Medical and Behavioral Genetics c. Accessing Consumer Genomics Databases to Aid in Active Criminal Investigations VI. Conclusion

I. Introduction

Our genomic sequence constitutes the most sensitive and personal of information. It uniquely identifies us, revealing our propensity for developing certain diseases and conditions and exposing familial connections to close genetic relatives. (1) In the era of Big Data, research using genomic information has moved beyond simply utilizing a physical biospecimen to including electronically stored genomic-sequence data, which permits infinite reproduction and limitless sharing. (2) Inexhaustible avenues for genomic data-sharing increase the potential for research advancements that could potentially uncover markers to identify an individual's risk of contracting a disease, provide new and more effective treatment options, and provide targeted information for preventive measures. (3) Corporations such as 23andMe attempt to merge society's dual interest in learning more about one's own genome while capitalizing on the attractive utility of a large genomic database...