Who Should Have Access to Your DNA?

A year after the FDA shut down 23andMe’s genetic testing service, personal genomics is coming back. But this time, you should own your own data.

The largest single repository of human genetic data in the world is not at any university, research institute, or pharmaceutical company. It sits on the servers of the consumer genomics company 23andMe and consists of data from 820,000 individuals.

The company was well on its way toward its stated goal of 25 million people’s DNA when the Food and Drug Administration (FDA) ordered the company to stop selling its $99 “Personal Genome Service” kit in late 2013. The FDA claimed that its decision would benefit consumers, but instead it challenged the fundamental right of individuals to access their genetic information. The questions around personal medical data are only growing more complicated, as 23andMe’s latest move illustrates.

Deprived of the ability to sell its flagship product, the company quietly shifted its priorities. It still had an extremely valuable asset in the self-reported medical information and genetic data from its users. In the first weeks of 2015 23andMe announced two multimillion-dollar partnerships with Big Pharma: a 3,000-person whole-genome sequencing project with Genentech to discover new drugs for Parkinson’s Disease, and a partnership with Pfizer that grants the company extensive access to 23andMe’s data on multiple conditions, such as inflammatory bowel disease and lupus. The company plans to announce ten more such pharma partnerships this year.

Already there are outcries about the potential for breach of privacy. More than 650,000 23andMe customers had consented to having their DNA used for research, including in studies conducted by pharmaceutical companies. At the time, 23andMe reassured its users that every person’s data would be made anonymous and aggregated with many others, to minimize the chance that anyone’s identity could ever become known. Yet critics are now questioning whether the customers really understood what they had consented to at the time of their saliva kit collection. The pharma industry, after all, does not have the best public image.

Patrick Chung, a 23andMe board member, once called the company “the Google of personalized health care.” That is a bit hyperbolic as a true “Google” medical map would include data from biosensors, medical records, the microbiome, the environment and more, as this diagram shows. Credit: Eric Topol, Individualized Medicine from PreWomb to Tomb, Cell, 157, March 27, 2014

Since its launch in 2007 with a $999 saliva test, the whole saga of 23andMe has been mired in controversy, and the pharmaceutical deals simply represent the latest chapter. But there are much bigger matters to consider. The data from 23andMe represents a first step toward a high-definition medical map of every individual — a digitized human being. It represents a single layer of genetic information, which will be greatly enriched as we progress with whole genome sequencing. We are moving into the big data-per-individual era (with your very own “Google” medical map), and we have not yet established any model for the rightful ownership of all this information.

In the months leading to the FDA’s decision to stop 23andMe’s $99 Personal Genome Service — in which customers received risk data for more than 250 medical conditions and 30 drug interactions, along with ancestry and other information — the company made two significant missteps. First, 23andMe let six months elapse between the company’s communications with FDA — a serious faux pas. Further, it unleashed a very aggressive marketing campaign that included promoting the service on TV and selling the saliva kits on Amazon. Had these disturbing actions not taken place one on top of the other, I am convinced that 23andMe would now have the DNA from millions of individuals.

The FDA shutdown of 23andMe was a visceral response. I say this because countless companies provide DNA information to consumers without succumbing to FDA scrutiny. A company called Myriad Genetics, for example, never received FDA approval for its breast cancer (BRCA) gene sequencing, yet more than a million individuals have made use of it. Neither have the roving “Who’s Your Daddy” trucks, which offer paternity tests on the street.

23andMe had been providing affordable, research-grade DNA testing to consumers for more than 6 years. Just the data on drug-DNA interactions alone represented a distinct bargain, since any one of the 30 assays might cost more than $200 in a hospital lab. Many of these tests are not even commercially available. Even when they are, physicians often don’t bother testing for interactions between a drug and a person’s DNA (which could help a patient avoid side effects or assure efficacy), though considerable data supports the practice.

That a consumer genomics company was shut down for collecting a comparatively trivial amount of genetic data is troubling. The 23andMe Personal Genome Service is just a starter kit for genomics. It only provides data from 1 million of the 3 billion letters, or 0.03% of the genome. We are now in the long-trumpeted era of being able to sequence a whole human genome for $1000. Now that Genentech has access to 23andMe’s data, the biotech giant plans to fully sequence the genomes of 3,000 individuals with Parkinson’s disease and their close relatives—not just the letters of DNA that 23andMe had tackled. In the next few years, several million individuals will undergo whole genome sequencing, making this test far more informative. What happens when whole-genome sequencing becomes eminently affordable and widely available? Are we to rely on physicians, who largely have no grounding in genomics, to actualize the genomic medicine revolution? 23andMe demonstrated a different approach, by helping its users to self-educate. Its site provides ample information for uninitiated consumers and could have served as a model for the next wave of personal genomics companies. Except that the FDA intervened.

Assuming the FDA does not start cracking down on other genetics companies, urgent issues are going to emerge around the ownership of genomic data. The individual should rightfully own such information about oneself, even though, overall, the medical community tends to not believe that consumers are intelligent enough to understand their data, or would have anxiety attacks if they were exposed to it. That doesn’t seem to be the case. In 2011 my collaborators and I published a study of more than 2,000 consumers who got their DNA data back from a company similar to 23andMe (they were research participants for a study we set up with Navigenics, which is no longer operational) in the New England Journal of Medicine. We found that people were eager to get their genomic data and did not panic at all. In fact, for a substantial proportion of the people in our study, the information helped guide them on what types of medical screening tests they should undertake. For example, those individuals with an increased susceptibility for colon cancer finally showed up for their overdue colonoscopy. Indeed, a few patients in our study felt their lives were saved because their colon cancer was diagnosed very early, and the screening procedure would not have been done without the DNA test.

Our DNA is just one component of our medical “Google” map. It has to be democratized, fully accessible and owned by the individuals who want it. Moreover, any company that collects such data has a humungous responsibility to protect the individual’s privacy. So long as 23andMe never lets up on that responsibility, their partnerships with the pharma industry might even accelerate new drug discovery. And that’s what many 23andMe customers who are afflicted with serious conditions want to see happen.