Who Owns Your DNA?

How secure is your DNA? Even if you have never purchased an ancestry kit, your identity can easily be traced through the DNA samples of your relatives. 

Law enforcement use of genetic genealogy searches to identify criminal suspects is evidence of this fact. The most recent example comes from Idaho, where Bryan Kohberger was arrested for the November 2022 murder of four University of Idaho students after a search of a genetic genealogy database led investigators to Kohberger.

This case serves as an example of the power of this investigative technique. Kohberger did not provide a test sample to the genealogy company that law enforcement used to track his identity. Instead, he was identified when investigators matched DNA evidence from the crime scene to a sample previously provided by one of the suspect’s family members to the genealogy company. 

The use of commercial, genetic databases to identify criminal suspects is an example of a twenty-first century technological reality. Large databases of human identity data built on commercial transactions in the private marketplace are later repurposed to aid law enforcement in criminal investigations.

Of course, no one is upset when criminals are brought to justice, but the use of genetic genealogy to identify suspects is neither perfect, nor reasonably regulated. 

Advocates of law enforcement access to DNA databases cite the exculpatory power of DNA. The Innocence Project has estimated that over 300 individuals have been cleared of criminal wrongdoing from the use of DNA evidence. 

However, matching DNA samples from commercial providers prevents privacy and civil liberty concerns. For example, following the use of DNA to catch the Golden State Killer, GEDmatch violated its own terms of service by allowing Utah law enforcement to search the site to identify a suspect in an assault case. 

Additionally, As the analysis of genetic information becomes more complex, human rights organizations are concerned with possible misuse of data. Genetic data includes power information, including the genetic predispositions of individuals. It is not hard to imagine how predictive genetic data could be used for purposes that do not advance a free and equal society.

Unfortunately, there are few laws regulating how police can access private DNA databases. Instead, the ease with which law enforcement can access private DNA databases hinges largely on corporate policy.

Corporate Policy

Genetic genealogy companies remain divided on how to handle collaboration with law enforcement. For example, GEDmatch shares information with law enforcement at their discretion, but has a privacy policy that allows customers to remove their samples from databases used by law enforcement when comparing samples. FamilyTreeDNA has a similar process. According to their website, customers may opt-out of having their DNA samples populate in a law enforcement search. While the opt-out feature is helpful, it only affects those who have submitted their DNA, not their relatives who can be affected by this decision too.

Other companies — like 23andMe — refuse to share information with law enforcement unless a court order requires disclosure. The company’s website states individual user information will not be shared unless “required” by a “subpoena, search warrant or other requests that we determine are legally valid.” Ancestry’s policies are similar. Their privacy web page states the company does not “voluntarily share” user information with police.

Legal Policy

Corporate policies addressing these issues assist consumers in making informed decisions about whether they would like to pursue genealogical research. However, company rules are unreliable because corporate policy may change at any time. 

Additionally, it is difficult for consumers to hold companies responsible for violations of the terms of service. GEDmatch landed in hot water after it violated its own terms of service that govern when the company provides data to police. Although the company changed their policy following backlash, consumers are left with no lasting assurance that their information is truly secure.

Technology with the power of DNA comes with great power, but little legal responsibility for law enforcement. In cases where a third-party’s DNA is used to trace a suspect, individuals lose the reasonable expectation of innocence that is the bedrock of the American justice system.

As the use of DNA in criminal investigations continues to expand, lawmakers and the public must answer critical ethical and policy questions surrounding the use of the most sensitive personal information available.