2.1 Introduction

The DTC industry is centred around the online sale of genetic tests. The industry has emerged and has been able to develop because of rapid advances made in two technological areas: genetic and genomic science; and computing. The rate of technological advances in genetics and genomics is continuing on an almost unprecedented scale. This chapter provides a brief introduction to the scientific advances that have enabled the DTC industry to develop and an overview of the types of service currently available.

2.2 The Nature of Genetic Information and Genetic Exceptionalism

(a) What is Genetic Information?

Genetic information can be defined as ‘the information carried in a sequence of nucleotides in a molecule of DNA or RNA’. For present purposes, genomic sequence data can be understood as the data generated by sequencing technology. It has recently been suggested by Raymond McAuley that the cost of sequencing a genome will be less than the cost of flushing a toilet by 2020. ‘As of January 2014, sequencing a human genome cost just under $1,000 – less than the cost of a chest X-ray’ and ‘genome scanning is dropping in cost faster than computers can keep up. Moore's Law observes that computing power doubles every two years, but the cost of sequencing a genome drops by 5 or 10 times per year.’

DTC services normally only sequence a portion of an individual's genome, rather than the entire genome sequence. However, this may change, as more companies begin to offer whole genome sequencing.

The original work upon which this book is based began almost a decade ago and as with many other new technologies, the personal genomics industry is still developing at a rapid pace. This is also a period of change for the law and so this book captures the industry and the state of the law at a particular moment. I intend to be able to update this volume in the future, but as this manuscript was submitted in late 2018 and will be published in mid-2019, some things may change in the interim and I will only be able account for these changes in the future. I ask readers to bear this in mind and to please note that this book is intended to provide an introduction to a complex area and provide some suggestions for reform, which it is hoped will contribute to stimulating a wider discussion of regulation of personal genomics and of technology more generally and the ways in which we all interact with contracts and privacy policies online.

The Table of Abbreviations for DTC Contracts provides links to the Wayback Machine wherever possible. Efforts have also been made to provide archived links throughout.

5.1 Introduction

This chapter sets out the findings of a review of the wrap contracts used by DTC companies that provide testing for health purposes.1 This takes the form of a descriptive comparative document analysis of these contracts. It provides an outline of the typical terms likely to be included in a DTC contract and a discussion of terms which are likely to be deemed unfair and unenforceable under UK law. In this chapter it will be argued that several terms commonly included in DTC contracts are likely to be deemed to be unfair terms under UK law and consequently unenforceable. Given the frequency of use of these terms it is suggested that the best means of enhancing protection for consumers in this context in the short-term is for the Competition & Markets Authority (CMA) to begin to take pre-emptive action and work with the industry to discontinue the use of such terms. Specifically, the following terms are likely to be deemed to be unfair or fail to meet transparency requirements:

• 1. clauses allowing for unilateral variation of the contract

• 2. clauses disclaiming liability for fitness for purpose or for personal injury caused by the company's negligence 3. clauses limiting scope of purpose

• 4. clauses purporting to bind the consumer to resolve any disputes in another jurisdiction

• 5. consent clauses

This chapter will also provide a brief overview of contract and consumer protection law, as it relates to DTC contracts. In so doing it will make reference to the applicable UK legislation, namely the Consumer Rights Act 2015 (CRA) and the work of the CMA. As it will always be difficult for an individual consumer to pursue litigation against a large company, if certain terms currently included in these contracts seem likely to be deemed as unfair, it is desirable that the CMA works with the industry to prevent the use of such terms.

4.1 Introduction

The nature of the DTC industry as providers of genetic tests means that privacy and data protection law have relevance to industry governance. As with many other digital service providers, security is also a significant issue here. At present, the European Union is undergoing a time of transition with the implementation of the General Data Protection Regulation (GDPR).1 Although the UK is also undergoing a broader period of transition with Brexit, the Data Protection Act 2018 (DPA18) transposes the GDPR into the UK's national law. As DTC companies collect genetic data, as well as other types of personal data, which they often use in ongoing research, companies should be complying with the GDPR and applicable data protection law in EU Member States and also other countries that have similar law.

This chapter provides a broad overview of privacy, data protection and security issues raised by DTC services. The aim here is to provide an introduction to a complex area and provide some suggestions for how industry practices and governance could be improved. In the context of privacy policies and notices, it is important to recognise that these documents are often linked with wrap contracts on DTC websites. This is often done through incorporation of terms by reference and for an individual to understand their legal rights in this context, they should really be reading all of these documents. This is problematic, as a number of studies have demonstrated in relation to privacy policies and contracts more generally that consumers are not reading these.

There are many people I wish to thank for their help, friendship and guidance along the way. This work began in Oxford and it has been written in three countries: the UK; Ireland; and finally, New Zealand (Aotearoa), which is my original home. It is ongoing work and I plan to do other things with my existing datasets and build upon them in the future. It is hoped that this book will provide an introduction to this complex area, but it is just that: an introduction. The references provided in the footnotes and bibliography should allow readers to explore issues they are interested in further.

I should firstly like to express my gratitude to Lilian Edwards, Burkhard Schafer and Edina Harbinja, the editors of the Future Law series for Edinburgh University Press. This is my first book and I am delighted to be able to contribute to such an interesting and timely series. I should also like to thank Laura Williamson, David Lonergan, Eddie Clark, Naomi Farmer, Zuzana Ihnatova, Rebecca Mackenzie and everyone at Edinburgh University Press, and my copy-editor Helen Johnston and my indexer Lesley Wilson.

I wish to particularly thank Jonathan Herring for his guidance and invaluable feedback on earlier drafts of this book. I also wish to particularly thank Stuart Newman for his comments at a much later stage. A special thank you also to my friend Saira Mian. From my time at Oxford, I also wish to thank my doctoral supervisor Jane Kaye and everyone at Oxford's HeLEX Centre, and thank you as well to my friends and colleagues, Charles Foster, Marina Jirotka, Sigrid Sterckx, Julian Cockbain, Donna Dickenson, Thana de Campos, Teresa Finlay, Michael Morrison, and Fiona Coldwell.

1.1 Introduction

We are all made up of DNA (deoxyribonucleic acid). We all have our own unique genetic code. When any one of us gives up a physical sample for the purpose of a genetic test, that code becomes decipherable. Through genetic testing, information that is contained in our bodies is encapsulated in digital form. This genetic data has the potential to be stored indefinitely and it can serve not only as a unique identifier for you, but also to identify family members. The shared nature of genetic data also means that data collected for one purpose can be used for a variety of secondary purposes, including criminal investigations and tracing family members.

Our DNA is part of each of us as individuals and we might assume that we own it in the same way that many of us might assume we own our bodies. Yet in many places the law does not actually provide for property rights in samples of DNA, once they are extracted from us or in our own bodies. While we might often feel that we in some sense own our bodies and their parts, this is not the case for the most part at present. For example, in the United States of America, tissue samples such as skin and saliva that we leave behind us are often treated as abandoned and can be used by law enforcement in criminal investigations. This has been exemplified by the recent involvement of the geneology database GEDmatch in the investigation of the Golden State Killer case, which will be discussed in Chapter 4.

3.1 Introduction

As discussed in Chapter 1, this chapter draws upon research originally conducted between 2011 and 2016 and which involved the compilation of a list of companies offering DNA testing services online. This included data regarding companies, including their location and the type of test offered as well as screen shots, wrap contracts and privacy policies, where these were available. All companies identified were tabulated with one master table and then tables of the various sub-categories were created, with each company being assigned to a particular category. The categories were: health (subdivisions of pharmacogenetic; predisposition; pre-symptomatic; nutrigenetic; carrier testing; and testing available through physicians); ancestry; paternity; surreptitious (‘infidelity’); DNA match making; child talent; and athletic ability.1 In 2018, several versions of the master table were released via Zenodo2 and further updates will be released over the coming years. Version 1.3 lists 287 companies that offer some form of DNA testing online, but at October 2018, 289 companies are on file.

It is important to recognise that as most companies only perform tests on a portion of an individual's genome, their utility for individual consumers is inherently limited. This idea has been highlighted again in an op-ed piece by Sarah C. Hopkins for the Los Angeles Times.3 Sarah is training to be a genetic counsellor and the article is based on her experience purchasing a DTC test. As she has previously undergone genetic testing and genetic counselling in a clinical setting, having been diagnosed with bilateral breast cancer she was particularly interested in 23andMe's BRCA testing.

Today's world is one of constant tracking, where personal data fuels many new products and services. Numerous emerging and new technologies offer novel opportunities for us to learn about ourselves and allow companies to learn about us as well. The Internet of Things is rapidly expanding the range of entities that can profile us and analyse us. Smartphones and travel cards track our movements across cities and across countries. Wearable fitness monitors track our exercise and can also reveal our location. New consumer services such as DTC promise to give us insights into our identities, our essence – but at what cost?

This book has sought to provide an introduction to the DTC industry and the challenges it poses for regulation. This chapter will discuss possible future directions for improved industry governance. Several suggestions are made, as given the nature of DTC services and the variety of areas of law which might be drawn upon to regulate the industry, there are both shortterm fixes and longer-term solutions to be considered. While the law often struggles to keep up with technology, with the wide range of new technologies coming to market which have the potential to change the way we live and affect our lives in significant ways, regulators, legislators, lawyers, researchers, technology companies and the public need to come together and engage in open discussion so that laws can be created that can respond to the specific issues raised by particular technologies and regulate them appropriately.