Privacy of Donated Genetic Data Pierced by Researchers

Men who donate DNA to public databases can readily be identified because their Y chromosomes can be traced along with their surnames, according to a study that may raise concerns about privacy in genetic research.

Researchers led by the Whitehead Institute for Biomedical Research in Cambridge, Massachusetts, identified 50 people among male volunteers who had donated genetic data to studies such as the 1,000 Genomes Project. They checked surnames in genealogy databases, and narrowed the search by matching surnames with donors’ ages and state of residence.

The research, published today in the journal Science, demonstrates a novel way to evade privacy controls around genetic information by focusing on the Y chromosome men inherit from their father, as well as surnames typically passed down through the male line. Craig Venter, the biologist who was one of the first to sequence the human genome as well as a donor to the project, was the test case, said study author Yaniv Erlich.

“There were thousands of Venters, so we thought, what happens if we know the age and state of residency of the individual?” said Ehrlich, a geneticist and Whitehead Fellow at Massachusetts Institute of Technology. The two identifiers were chosen because they’re allowed under the Health Insurance Portability and Accountability Act of 1996 privacy rules. “So we got two matches, one of which was Craig Venter.”

It may not be possible to do this kind of identification with every genome, Erlich said. However, for U.S. white men who are upper and middle class, knowing a surname, age and state will turn up about 12 people, he said.

“At that point, you can just call all 12 and ask if they participated,” Ehrlich said.

Privacy Concerns

The findings have some geneticists concerned about privacy breaches, as well as unintended revelations about ancestry.

If someone knows what study a person is participating in, they may be able to find out whether the participant has an illness, said Leonid Kruglyak, a geneticist at Princeton University in Princeton, New Jersey. People who believed they were father and son may discover they aren’t.

“This isn’t an immediate thing, but what if someone wanted to enable this and designed a piece of software to make it easy?” Kruglyak said in a telephone interview. “I don’t think this is something that people sitting at their keyboards at home would be able to do.”

People who are going to participate in genetic studies should be informed of the risk that they may be identified, said Laura Lyman Rodriguez, the director of the division for policy, communications, and education at the National Human Genome Research Institute in Bethesda, Maryland.

“This risk that this will affect people is low,” said Rodriguez in a telephone interview. “That doesn’t mean the risk is zero.”

There’s no federal prohibition against identifying people against their will, she said. States’ laws vary, and the U.S. president’s bioethics commission has asked scientists to consider legislation.

“Informed consent is always important, to talk about the risks,” Rodriguez said.

Before it's here, it's on the Bloomberg Terminal.