On 17 May 2017, Joel Winston, a consumer protection attorney and former deputy attorney general of New Jersey, published a blog post with the claim that the genealogy website Ancestry.com was “taking DNA ownership rights” from customers and their families:
The family history website Ancestry.com is selling a new DNA testing service called AncestryDNA. But the DNA and genetic data that Ancestry.com collects may be used against “you or a genetic relative.” According to its privacy policies, Ancestry.com takes ownership of your DNA forever. Your ownership of your DNA, on the other hand, is limited in years.
The article has caused widespread concern and prompted a public response from Ancestry.com’s Chief Privacy Officer Eric Heath, who called Winston’s post “inflammatory and inaccurate”. In response to our questions, Heath emphasized that Ancestry.com does not take ownership of your DNA; rather, you license it to them:
…The consumer maintains ownership of their data. This is actually why we need a license in order to conduct our analysis, display their results, and so on. Not only do they own their own data, but we allow them to download their raw data and they can ask us to destroy the data any time.
Aside from the right to use their data to provide our services, we always ask for separate approval to use data in any other way. For example, when you activate a kit, there is a screen that pops up as part of our Informed Consent process that asks if you want to take part in anonymous third party research projects. You can say “yes” or “no” and your choice has no impact on the basic services we provide.
Heath added that you can revoke any license you give Ancestry.com to use and distribute your DNA by deleting the data or closing your Ancestry.com account:
We also allow consumers to change their Informed Consent decisions at any time. So, you could agree to take part in third party research when you first sign up, but then later decide you don’t want to and we’ll respect your change of mind. Obviously, if research has been conducted that included your anonymized data, we can’t delete it after the fact.
However, Winston objects to this distinction:
A license is a contractual form of ownership. At its most basic, a license is defined as “a permit from an authority to own or use something.”
Ancestry.com does not have “exclusive ownership” because customers still retain ownership of their own DNA. Ancestry.com does not have “absolute ownership” because customers can revoke the license. But, Ancestry.com irrefutably takes ownership of customers’ genetic data by contractual license granted in the Terms and Conditions.
Omri Ben-Shahar, a University of Chicago law professor and an expert in contracts and consumer protection pointed to the same opt-outs that Heath did, saying:
A lot of the things [Winston] says happen don’t have to happen — you have a choice over them.
Even if a customer left every opt-out unclicked, and gave Ancestry.com full permission to do anything they were legally entitled to do with your data, Ben-Shahar says that it still be licensed, not owned, and you can still legally retract it at any time.
In his blog post, Winston also pointed out that customers can revoke their consent at any time. However, he directed us towards a section of the AncestryDNA informed consent agreement that addresses the potential risks of signing up for the DNA test:
There is a potential risk that data about you could become public as the result of a security breach…There is a potential risk that third parties could identify you from research that is made publicly available, for example if published in a scientific journal…When DNA samples are physically transferred from us to collaborators, there is a potential risk that the samples could be lost or taken while in transit or storage. We take precautions to reduce the likelihood that this will happen and DNA samples are not transferred with your name or contact information.
As Ancestry.com explains in the informed consent agreement, the fact that they remove identifying information from your DNA data before they add it to their database does not remove this risk:
Although we remove common identifying information (such as your name and contact information) from any data before publication, genetic data is different from other data because it can be used as an identifier in combination with other information. It is not currently common to do this but it can be done, particularly if genetic data about you or genetic relatives is available from other public genetic databases.
Jeff Sovern, a law professor at St John’s University in New York City and an expert in consumer law, told us the circumstances under which Ancestry.com might share your DNA data with others could be wider than they first appear. One significant section of the Terms and Conditions read as follows (until it was changed in light of the May 2017 controversy):
By submitting DNA to AncestryDNA, you grant AncestryDNA and the Ancestry Group Companies a perpetual, royalty-free, world-wide, transferable license to use your DNA, and any DNA you submit for any person from whom you obtained legal authorization as described in this Agreement, and to use, host, sublicense and distribute the resulting analysis to the extent and in the form or context we deem appropriate on or through any media or medium and with any technology or devices now known or hereafter developed or discovered.
The company no longer describes the license as “perpetual”, and the phrase “to the extent and in the form or context we deem appropriate” has been removed:
By submitting DNA to AncestryDNA, you grant AncestryDNA and the Ancestry Group Companies a royalty-free, worldwide, sublicensable, transferable license to host, transfer, process, analyze, distribute, and communicate your Genetic Information for the purposes of providing you products and services, conducting Ancestry’s research and product development, enhancing Ancestry’s user experience, and making and offering personalized products and services.
In other words: we use your Genetic Information to provide products and services to you and improve our products and services for all our users. In addition, you understand that by providing any DNA to us, you acquire no rights in any research or commercial products that may be developed by AncestryDNA using your Genetic Information.
Jeff Sovern said that the privacy statement’s use of examples, rather than an exhaustive list of scenarios in which user’s information can be shared, makes him “nervous”:
That means the list is not complete, and there could be circumstances in which Ancestry could disclose the data that are not included in the list. Here’s an analogy: if someone says “examples of things I do when I go out are to see a movie or a show,” it doesn’t mean the person doesn’t also go out to get drunk.
Signing up for Ancestry.com’s DNA test does not mean that the company owns your DNA data, in the complete and permanent way in which that word is typically understood. Customers license it to the company. Customers can choose not to allow their genetic information to be used for certain purposes, and can also revoke the license and have the DNA data and sample destroyed if they wish — something that would not be possible if Ancestry.com owned them outright.
However, granting Ancestry.com that license can involve giving them relatively significant rights over DNA data, and the scope of these rights may go beyond what is immediately apparent. Furthermore, licensing your DNA data to Ancestry.com does come with risks to your privacy, as well as potentially resulting in problems obtaining life insurance or, in certain circumstances, even getting hired for a particular job.