You Are Not 23andMe's Customer, You Are Their Product

The online genetic testing service 23andMe is looking to sell your genetic data to big pharma, and you ain't gonna get nothin for it:

Since the launch of its DNA testing service in 2007, genomics giant 23andMe has convinced more than 5 million people to fill a plastic tube with half a teaspoon of saliva. In return for all that spit (and some cash too), customers get insights into their biological inheritance, from the superficial—do you have dry earwax or wet?—to mutations associated with disease. What 23andMe gets is an ever-expanding supply of valuable behavioral, health, and genetic information from the 80 percent of its customers who consent to having their data used for research.

So last week’s announcement that one of the world’s biggest drugmakers, GlaxoSmithKline, is gaining exclusive rights to mine 23andMe’s customer data for drug targets should come as no surprise. (Neither should GSK’s $300 million investment in the company). 23andMe has been sharing insights gleaned from consented customer data with GSK and at least six other pharmaceutical and biotechnology firms for the past three and a half years. And offering access to customer information in the service of science has been 23andMe’s business plan all along, as WIRED noted when it first began covering the company more than a decade ago.

………

“I think we’re just operating now in a much more untrusting environment,” says Megan Allyse, a health policy researcher at the Mayo Clinic who studies emerging genetic technologies. “It’s no longer enough for companies to promise to make people healthy through the power of big data.” Between the fall of blood-testing unicorn Theranos and Facebook’s role in the 2016 election attacks, “I think everything from here on out will be subject to much higher levels of public scrutiny,” Allyse says.

23andMe maintains that transparency is a core tenet of the company. “I think a really important distinction to make is that 23andMe operates under an independent ethical review board that oversees all of our research,” says Emily Drabant Conley, 23andMe’s vice president of business development, who oversaw the announcement of the GSK deal. “The guidelines we follow are essentially the same as what other research institutions follow.” So they should apply to any of the analyses GSK might want to run on 23andMe data, like a PheWAS, which connects constellations of symptoms and conditions across many people with a single genetic mutation they all share.

Yeah, sure.

It's there in a very small print at the end of a long and confusing document.

Here is the money quote:

It’s also worth pointing out that 23andMe can, in theory, unilaterally change those terms and conditions and privacy policies at any time, says Katherine Drabiak, a legal expert in health law and research ethics at the University of South Florida. As a commercial enterprise, it’s not bound by the same obligations as medical professionals. 23andMe doesn’t have to take an oath to act in the interest of consumers or to promote their well being.

They say not to worry, because they will obey the voluntary guidelines of the Future of Privacy Forum, whose supporters include, "AT&T, Comcast, Facebook, Google, Intelius and Microsoft," which is kind of like the, "Knife Safety Forum," founded by noted barber Sweeney Todd.

I will leave you to this: Self-regulation is to regulation as self-importance is to importance.