California Considers DNA Privacy Law

ananyo writes "California lawmakers are weighing a bill aimed at protecting their state's citizens from surreptitious genetic testing but scientists are voicing their growing concerns that, if passed, such a law would have a costly and damaging effect on research. The bill, dubbed the Genetic Information Privacy Act, would require an individual's written consent for the collection, analysis, retention, and sharing of his or her genetic information—including DNA, genetic test results, and even family disease history. The University of California has submitted a formal letter objecting to the bill, estimating that the measure could increase administrative costs by up to $594,000 annually — money which would come out of the cash-strapped state's General Fund. The university has also expressed concern that its researchers would suffer competitive losses in obtaining research grants."

Comments

Hard to Swallow

[lewko]

The bill, dubbed the Genetic Information Privacy Act, would require an individual's written consent for the collection, analysis, retention, and sharing of his or her genetic information

This just made sex a whole lot more complicated.

Re:Hard to Swallow

[santax]

Since both you and I are posting here, this is probably relevant to our interests, but still none of our concern.

Re:Hard to Swallow

[the simurgh]

all we really need is a law saying that a person cannot sign away their genetic code and that a corporation cannot patent human genes. we need to punish big pharm not hospitals trying to determine whose the baby daddy.

Re:Hard to Swallow

[Anonymous Coward]

The bill, dubbed the Genetic Information Privacy Act, would require an individual's written consent for the collection, analysis, retention, and sharing of his or her genetic information

This just made sex a whole lot more complicated.

And that's the thing. You can have all the consent forms in the world but, with full genome sequencing dropping to about $1,000/genome, in a couple years getting someone's genome sequence is going to be about as difficult as getting their finger prints.

That's not to say that their shouldn't be some level of informed consent but it has to be weighed against the costs. For example, let's say you've got a kid with mild mental retardation (or motor skills deficit or whatever) and you'd like to know whether it's genetic and whether there's anything that can be done (in some, rare, case there actually is). Anyway, if it is a genetic condition (the kid wasn't just dropped on his head as a baby) then more often than not it's going to be caused by a complex combination of defective genes - e.g. you married someone from the same town who happened to be a distant cousin - or you just got really unlucky.

But... in rare cases it's actually going to be possible to pin the condition down to a specific defective gene. And, here's the problem, there's still a huge number of genes in the human genome that are not well studied and/or annotated. So, chances are, even if you pin down the gene, the genetic counselor/doctor you're working with won't be able to do much.

The good news is that there are research groups who study specific genes and/or who are very good at using bioinformatics to determine the function of unknown genes. So if you had a families with defects is specific, poorly understood, genes then such researchers could search the database for genes that they were experts in. Or they could even use the database to identify genes with medical relevance for further study.

But if you encumber the data with all kinds of insane informed consent requirements then, realistically it's just not going to happen. So, ultimately, families with rare genetic conditions are going to have to choose between privacy and the chance of having their disease studied, cured, etc. Or, maybe the state of California will take that choice awaya from families in California - which is not to say that informed consent is bad - just that one has to be very careful here.

Re:Hard to Swallow

[khallow]

we need to punish big pharm not hospitals trying to determine whose the baby daddy.

We don't need to "punish" anyone who's obeying the law. If there's a problem, change the law not try to come up with punishment after the fact (which in itself is unconstitutional in the US) for legal activity.

Re:Hard to Swallow

[theshowmecanuck]

Scientists seem to only think about the consequences of actions as they relate to their own research. Unfortunately, and although with the noblest of intentions, they often suffer from ivory tower syndrome and don't consider the implications of their research in a wider general context. No-one is stopping them from researching. The only thing that is happening here is something that seems to be rather new and refreshing: the general populace is finally attaching some ethical restrictions to the work.

The human race is wired for discrimination (it's why tribes form so easily). Discrimination can take the form of racism, but can also be used by insurance companies to exclude people from what I believe should be a fundamental human right: access to health care. Things that can be used to abuse this and generally invade privacy need to be avoided within reason. This seems reasonable. No-one is stopping them from researching genetics. Doctors need informed consent before doing anything to your body, its parts, or your mind. So why the hell shouldn't scientists? Many roads to ruin were paved with good intentions.

Finally: No-one is stopping them from researching genetics.

The world's tiniest violin plays for UCLA

[jbeach]

The University of California has submitted a formal letter objecting to the bill, estimating that the measure could increase administrative costs by up to $594,000 annually — money which would come out of the cash-strapped state's General Fund. The university has also expressed concern that its researchers would suffer competitive losses in obtaining research grants."

Too bad for them people's rights can be so inconvenient and costly. Oh well.

Re:The world's tiniest violin plays for UCLA

[__aaltlg1547]

It's just a consent form. Make sure it assigns the right to use your genetic information for any research purpose you like, publish it, exchange it with others, etc. etc. Get your subjects to sign it and stuff it in a file cabinet. Done.

Is there an exception for law enforcement?

Re:The world's tiniest violin plays for UCLA

[Bieeanda]

Yeah. I'm sure I echo the family of Henrietta Lacks when I say 'Fuck 'em.'

Re:The world's tiniest violin plays for UCLA

[TubeSteak]

It's just a consent form.

There's a reason so many shitty things in this world are opt-out.
If you make them opt-in, almost no one consents.
If you make it opt-out, even a small amount of effort is too much for most people.

You'd think the field of Medicine, with its strong emphasis on ethics, would understand the rational behind an opt-in system of DNA collection for research purposes.

Re:The world's tiniest violin plays for UCLA

[Baloroth]

First of all, it isn't really a right, at least not yet, and second, without looking at the specific provisions and language of the bill you cannot tell whether or not the restrictions placed are reasonable. It certainly wouldn't be the first time an apparently well intentioned bill was written in such a way as to be incredibly and excessively difficult and expensive to follow. For one thing, TFA mentions that the only people who can access the information are people listed in the consent forms, which means any person doing the research as well as anyone assisting needs to be named, which is a massive PITA. It might even mean certain scientific papers couldn't be published, if it required disclosure of specifics about the genetic information (which is often the point). I feel that a scientists might object to such restrictions.

It would also require any current studies to gain the permission of anyone whose genetics they are currently studying (often thousands for each study), and it essentially means they would have to completely throw out every single data set they have collected once the study is done, too. All in all, these are scientists doing research making the complaint. I don't think their goal is to infringe people's privacy.

And ironically, the bill will probably decrease the privacy of people involved in the research. Since each use requires the authorization of the individuals whose genetics are involved, you can't permanently anonymize the data: someone needs to be able to find out to whom each strand of DNA they are working on belongs (and show proof that each individual has given consent), which means the current anonymization that is standard cannot be employed. Translation: for research purposes, the bill might well end up doing the exact opposite of what is intended.

Re:The world's tiniest violin plays for UCLA

[davester666]

The thing is, it'll become an opt-in for everyone, at the doctors office. As in, oh, you need a test, here, sign this generic permission form which just happens to sign away your DNA for any purpose [not just testing for your own personal health].

Otherwise, big pharma would have to track which DNA samples have permission to use for research and which don't, and they just want to use everything.

Re:The world's tiniest violin plays for UCLA

[nbauman]

I once read a study done in Sweden to find out how accurate a prostate cancer test was.

30 years ago, they had done a study of cholesterol, and saved the blood samples. So they could go back, thaw out the blood samples, and see what the PSA level was. Then using Sweden's wonderful medical records, they could find out how many of them had died of prostate cancer at each level of PSA.

This was very useful. If you go to a doctor, and he tells you you have an elevated PSA, you want to know whether it's something you can safely ignore or whether you have to get surgery (which leaves you impotent about half the time and with urinary incontinence about half the time).

If they had laws like the ones proposed here, they just couldn't have done it. It's one thing to have a collection of 100,000 blood samples that you can feed into an automated testing machine. Its another thing entirely (and much more expensive) to have to track down 100,000 subjects from a 30-year-old research project, many of whom have died (including the very people whose blood is most important to test).

Or suppose you turn 60 years old and go to the doctor for a routine exam. Your blood test results come back and he tells you you have chronic lymphocytic leukema. Some people die in 6 years. Other people die in 30 years. He can't tell how long you've got.

Well, now he can tell how long you've got. There's a DNA test. People with one mutation live 6 years, and people with another mutation live 30 years.

Obviously they didn't get signed permission from people with leukemia to test their DNA and follow them for 30 years. They went back and tested stored blood samples of people who died after 6 years and people who died after 30 years.

I don't want to oversell genetic studies. They're at a very early stage. But there are a lot of successful results. Doctors can tell who needs dangerous, debilitating medication in order to have a chance to live a little longer, and who can just skip the medication. They can get clues to new drugs. There are great promising results too complicated to explain here. But if they had to go through these specific informed consent forms described in the Nature article, they simply couldn't do it. It's like prohibiting stem cell research.

Re:The world's tiniest violin plays for UCLA

[martin-boundary]

That's what privacy is. "The state of being alone or kept apart from others". It means you don't get the benefits, but you're also not subject to the abuses.

Overall, I think that most agree that the abuses outweigh the benefits these days. With Facebook like corporations mining data from literally millions of people, the benefit of scientists having access to the names of 100 thousand people in a study isn't comparable, even if they are able to incidentally warn or help maybe 50 who exhibit certain symptoms.

We've created psychotic monster corporations, and now we have to accept the consequences, which includes a steep price to limit the privacy problem and an even greater economic one if we decide to fix it.

Re:The world's tiniest violin plays for UCLA

[Anonymous Coward]

The fact that those doctors are making *MONEY* off it, and her and her family aren't? If it was non-profit and shared with all who needed it, maybe, but as a big money business the HL cell cultures are an insult to 'supposed' medical ethics everywhere. Nevermind that they didn't ask for permission, and it was only revealed... what, 20-30 years later?!??!

And saying this as a white dude: Just another example of the rich white upper class screwing those below them for their own benefit.

Re:The world's tiniest violin plays for UCLA

[rtb61]

When it comes to ethics and psychopathy being tied to genetics, should privacy be allowed when seeking elected office or taking a major role in a corporation. When it comes to person convicted of crime should psychopathic tendencies as indicated by their genes be hidden from future partners, how far is that they find out by being beaten to death. So perhaps some genetic traits can be secret but others should be divulged under certain circumstances. No psychopaths in political office, as police or teachers. If your child was marrying a psychopath would you accept it be kept a secret from them or would you want the information to be provided to them before it's too late.

Re:The world's tiniest violin plays for UCLA

[wrook]

I have no problem with researchers using my data to help with their research. I *do* have a problem if they receive a patent based on my data. I'm quite happy to have them do whatever research they want, but I don't like the idea that they will get exclusivity for something that was derived from something I gave them for free.

Can we have a copyleft for our medical data? You can use it, but only if the result is free (as in freedom) to use.

Re:The world's tiniest violin plays for UCLA

[Jafafa Hots]

Wish I had mod points.

It's fine with me if my DNA is used to help research. It's NOT fine with me if my DNA is used to get a patent.

Re:The world's tiniest violin plays for UCLA

[WaywardGeek]

TFA of course says nothing about the lost profits to genetic researchers who may no longer being able to patent parts of your genome without your consent. Their concern over the totally inflated number of $500K/year in administrative costs is sickening.

In reality, the cost wont be in filing the forms. The cost will be in explaining to every patent who has blood drawn that the hospital wants to "own" your blood, including any patents that can be made on it, or cell lines that could be derived from it. They'll be in the embarrassing and time consuming position of explaining to patents that they actually do with parts of their bodies.

Hopefully, I will soon have my entire exome sequenced in a clinical trial. I don't mind signing a form giving them ownership of a sample of my blood, but I prefer to own the rest. I'm just upset they wont let me have a copy of my exome. They are planning on destroying the data when the trial is finished, because they don't want get distracted by the debate over ethics. I understand their point of view. They just want to do some science, and could the hysterical crowed please go away?

I have about four inherited defects I know of. My relatives get cancer at a rate not likely to be coincidence. My red cones mostly don't work, which is a rare form of color blindness. I've got a weird inherited form of ADHD thing that makes reading difficult, but seems to enhance 3D visualization ability (try imagining the shape of the intersection of three perpendicular cylinders). Likely as not, I've also got Stargardt's Disease, which is causing me to lose central vision. I'm also a big geek capable of analyzing my exome and writing code to compare it to an exome database, taking into account a genetic knowledge base. It just kills me that I wont get a copy of my data.

Re:The world's tiniest violin plays for UCLA

[RDW]

Their concern over the totally inflated number of $500K/year in administrative costs is sickening.

If anything, translating this to a $500k admin cost grossly underestimates the impact on research. Many types of work will become completely unworkable in California, if TFA is accurate:

"Under the newly proposed bill, a person's genetic information may only be accessed by individuals specifically named on a consent form, and only for purposes written on the form. Genetic information along with the original samples must be destroyed once their specified purposes are fulfilled."

We routinely run genetic tests, all the way up to whole exomes, on tumour and normal samples from a collection donated by thousands of different patients (anonymous to us). Most ot the people curently working in our lab (not to mention collaborators in other labs) had not even joined when the bulk of the samples were collected. It would be completely impractical to seek fresh consent from every relevant patient whenever a new researcher needed to run a test or access a piece of data. It would be a tragic waste to destroy data and precious samples prematurely (and usually against the wishes of the donors, who typically want us to do all we can with the material).

Far from being worried about 'lost profits', many researchers share your concern about gene patents (and very few profit from them directly!). But this is not the way to the address the problem - we need reform of the patent system, not unduly restrictive 'DNA privacy' laws.

It just kills me that I wont get a copy of my data.

Usually you'll be anonymous to the people with access to the raw exome data, and there's probably no mechanism for feeding it back to a named donor. This type of research will also be subject to a strict legal and ethical framework which will not permit the researchers to act as providers of genetic tests to named individuals. If you want an exome you'll probably have to get it done privately - should be about the price of a mid-range laptop right now, with whole genomes falling into this range within a couple of years. How useful it will actually be to you at this point is unclear, unless you happen to have a condition with a simple and well-defined genetic association. Note also that comparisons with anyone else's data will not be possible if DNA privacy laws become so strict that public databases can't be created in the first place...

Re:The world's tiniest violin plays for UCLA

[Mr. Slippery]

So perhaps some genetic traits can be secret but others should be divulged under certain circumstances. No psychopaths in political office, as police or teachers.

Thank you for perfectly illustrating the danger here.

There is no genetic trait that corresponds one-to-one with psychopathy. There may (or may not) be certain genetic traits associated with a increased risk of psychopathy. As this distinction is pretty much lost on the general public, it is important that we do on brand people who have a greater change of developing psychopathy as actually being psychopaths. This is why genetic privacy is crucially important.

Half a mill? Really?

[atari2600a]

Seriously that's like chump change to the UC system...

DNA testing of criminal suspects

[davidwr]

They should go one further and replace "uniquely identifying" DNA testing of criminal suspects with "just enough DNA to exclude the suspect" tests, repeated as needed with different parts of the DNA until the suspect is cleared or it's really his DNA.

Instead of testing a few dozen markers all at once and keeping that data on file, test only one or two. If it's a match, test another marker or two, and so on. Stop and cut the guy loose as soon as you find a mis-match.

Not only is this more morally justifiable than taking a full DNA "fingerprint," it will cut down on people who object to having DNA taken because they either know or believe they have left DNA at a place where a crime occurred in the past (even if they didn't commit any crimes) or they believe they are likely to do so in the future.

Also, change arrest-expunction laws for those who aren't convicted so that once the case is closed OR once it's obvious that the state isn't still looking at a given suspect, his DNA, fingerprints, etc. are automatically destroyed, without the former suspect having to hire a lawyer or pay fees to make it happen.

Re:DNA testing of criminal suspects

[reve_etrange]

These are all good steps. For me, though, the main issue with DNA testing of criminal suspects is its unreliability. Hopefully as sequencing costs continue to fall rigorous testing will become required.

Re:Half a mill? Really?

[geekmux]

Seriously that's like chump change to the UC system...

Congratulations. You just re-affirmed how a state can manage to get over $600 billion in debt. Like my old boss used to say, a million here, a million there...pretty soon, we're talking about real money.

Yeah, right

[markdavis]

>"would require an individual's written consent for the collection, analysis, retention, and sharing of his or her genetic informationâ"including DNA, genetic test results, and even family disease history."

Unless, of course, it is the government taking the samples on people just ACCUSED of a crime. And that information will never be wiped and will be stored and forwarded to every shady agency that wants it..... in the name of keeping us safe from terrorists. Just like fingerprints.

Doesn't matter. Such legislation would never pass, and even if it did, it is just California and has nothing on the Fed.

Warning

[EnsilZah]

DNA is known to the State of California to cause cancer and birth defects or other reproductive harm.

Basic math

[slashdyke]

I have to ask why written consent is going to cost the university $594,000 annually. Surely, one of their law students could draft a consent letter to be reviewed by a practicing lawyer - maybe one already on staff. That should only cost a few hundred dollars - maybe a couple of thousand if the lawyer is famous and expensive. Then there is the cost of a filing cabinet to store the letters. Maybe paper for photocopies. And Say 15 minutes per client in time to print, collect the signature and file the document. Surely that can not cost more than $10,000 a year. If it was run by a government, I could see it a little higher, but not 60 times that amount.

Grow some backbone, CA

[Okian Warrior]

The University of California has submitted a formal letter objecting to the bill, estimating that the measure could increase administrative costs by up to $594,000 annually — money which would come out of the cash-strapped state's General Fund.

So, to paraphrase: "Let's not protect peoples' rights! It will cost us money! And it will come out of the general fund! WAAAAAAH"

Gimme a break. California will *always* want more money, will always be strapped for cash, and sacrificing morality for expediency is an argument that could be used to avoid all responsibility and fairness.

Balance your budget, reduce your spending, and grow some backbone. Let your people live in privacy and safety.

Re:Half a mill? Really?

[nbauman]

You can't process 10 forms per hour.

First, you often can't find people. There was an article in the New England Journal of Medicine by a doctor who made the point that it's often impossible to find patients, once they walk out the hospital door. The hospital had treated an infant, then afterwards somebody decided that there was a slight possibility that the infant had a life-threatening but treatable condition. They called the cell phone number the mother had given in her hospital intake, and it was disconnected. She had given the name of somebody to call in case of emergency, and that number didn't work either. With the end of landlines, it's much harder to find people. They frantically tried to track her down, and finally found her because of a lucky break.

Then there's the problem that when you're researching fatal diseases, the people you're trying to find are often dead. So they can't give permission.

Their relatives often move. Sometimes a doctor calls them and they just don't want to talk about it any more.

A lot of people don't want strangers to track them down, so they make it difficult. A lot of people are worried about debt collectors (often because they have big unpaid medical bills), process servers, police, immigration authorities, etc. So when you call somebody's mother, she may not want to give the person's new address.

Furthermore, it's not just a matter of calling up and getting permission on the phone. It has to be in writing. Does the signature have to be witnessed? Notarized? What do you do, send a witness over to their house with a notary?

It has to be informed consent, so you can't just have a minimum-wage clerk do it, you need somebody to explain the risks and benefits.

You could wind up spending more money getting permission than you do on the actual tests.

One of the big problems with getting permission is that you get a biased sample. For example, the people who are dead can't give permission. So you might wind up getting the DNA sequences of people with a less aggressive disease.

Should not cost as much as they claim

[pesho]

Research subject consent and the associated paperwork is already required by ethics rules that are strictly enforced in US. I am not aware of signal study in US that does not do that. In fact the US government and all private sponsors of research that I know of will not fund such studies. From what I see most of the law is just formalizing the status quo. The only silly thing is the requirement that only people named in the original consent from will be allowed to access the information. I am sure that this will be ironed out before the law goes into effect. Usually there is tiered access to such data that allows data that can not directly identify a person to be shared, while protecting information that can harm the privacy of the individual. My guess is that the bill is aimed against 'ancestry' web sites that also offer genetic testing and can do as they please with your genetic information according to their typical EULAs.

A far bigger concern

[Grayhand]

Insurance companies would love to get their hands on this data. Got the genetic tendency for a form of cancer it doesn't matter if you never develop it your rates will go up or better yet you get canceled without notice.

good in concept

[Gravis Zero]

the issue here is NOT about having DNA on file, it's having DNA on file that can be associated with an individual. having tons of DNA data with a full medical history's for each sample would be super awesome for research. research doesnt need names of people, just information/associations with other real world factors. however, if you can be associated with a particular sample then there are a lot of bad guys out there (and good guys with bad ideas) that would love to get their hands on that kind of information.

i'm not ok with the government having DNA on file in a way that gives a direct association. so having DNA_Sequence=Plummer_Joe is bad. what i am ok is with them storing a hash result using my DNA as a key. HashFunction(DNA_Sequence)=9je4H2 and Plummer_Joe=9je4H2 is ok. that way if they actually have DNA (evidence), they can look people up but they cant get DNA arbitrarily.

also, "asking" for DNA by a company should be as illegal as the whole facebook password thing. as a precaution, i'm deleting my DNA.

it's just too bad that the only thing a politician will understand about a hash is that they "didnt't inhale"