SCOTT SIMON, HOST:
Consumers have flocked to buy DNA kits from popular sites like 23andMe and Ancestry.com. The idea is to send in your saliva and receive data on your ethnic heritage or even get connected with long lost cousins. Most companies have guaranteed that they'll protect their users' genetic information, but experts say a recent case in Florida makes it clear this is not so certain.
Erin Murphy is a professor at New York University's law school. She focuses on forensic evidence and the criminal justice system. Professor, thanks for joining us.
ERIN MURPHY: Thank you for having me.
SIMON: So what happened in Florida?
MURPHY: Well, law enforcement in Florida petitioned a court for a warrant to conduct a search or continue a genealogical search in a database known as GEDmatch. And listeners may remember that name because that was the same database that was used when the Golden State killer case broke the first investigative genetic genealogy kind of law enforcement investigation. And the difference in this case is that that database was about, at the time of the Golden State Killer case, was about 1.2 million users who had voluntarily uploaded their genetic information. And they had agreed to make it kind of publicly available. They had kind of put it out for the world to see.
When there was a sort of backlash against the law enforcement use in that case, ultimately, GEDmatch decided to kind of put everybody back into a pool of, you know, kind of protected users. So overnight, this database went from 1.2 million open samples to zero. So the difference in this case is that law enforcement didn't have access to an open platform that any ordinary person could use. Instead they had to go to a court and say, let us do this genealogical work in a database where users have, you know, sort of specifically not opted back in or have failed to opt back in to law enforcement access.
SIMON: So this changes everything doesn't it, potentially?
MURPHY: I think it does, although I also think it was an obvious next step. I mean, the reality is these searches are more efficient the bigger the database. And studies have shown that if you have a 3 million person database, you have effective genetic transparency for everyone in that population. You know, the example given is usually people of European descent because that's the primary consumers in the United States of these services. If 3 million people of European descent offer their genetic information to a database, you have essentially a universal genetic database for the American population of European descent.
So what this changes, I think, is the plausible, you know, claim that this is just about people who've chosen to share. Now its clear law enforcement's position is if genetic information exists, we should be able to go to a court and get it. And it really has, I think, a downstream set of consequences for databases that we may really worry about people stopping contributing to, like research databases or other kind of medical or clinical databases that are really important.
SIMON: What about the argument I gather some people in law enforcement have made, is that this could help them solve hundreds or thousands of cases?
MURPHY: You know, that's obviously always a compelling argument. And I think it has to be taken seriously. One response I would give is, if that is the case, let people decide whether they think that's valuable. And one way for them to make that decision is to say law enforcement, you can use my genomic data. The second thing I would say is, right now law enforcement says oh, you know, this is for serial killers and rapes. These are for these really compelling cases of a great, strong public interest where there's broad consensus, but there is no regulatory requirement that be the case. It's completely at law enforcement's discretion to only look for murderers or rapists. And if they're going to do that kind of sensitive testing, you know, I think there should be more regulatory restrictions. And right now, it's really all at their discretion. There's not a set of rules that law enforcement has signed on to, much less been compelled to follow.
SIMON: What if somebody wants to protect their DNA information - doesn't want to share it with government sources?
MURPHY: Well, I think there are few answers to that. I mean, I think the most important thing is call your legislator and tell them I want to be able to make this choice. I don't want to have to choose between, you know, doing this kind of recreational or maybe even clinical testing that I'm interested in and becoming completely transparent to anybody anywhere. Second, I would say if, you know, you've already participated, almost all the major platforms or all of the major platforms allow you to delete information. So you can take down your information if you're worried about it being accessed.
And the last thing I should say quickly is just, you know, the companies can make promises about their protections of privacy, but you also have to be a careful and discriminating consumer and realize they may break those promises. So Family Tree DNA, you know, signed on to a privacy statement that said we're not going to share information. They had a very prominent privacy promise on their website. And then it came out they had been secretly cooperating with the FBI.
SIMON: Forgive me for putting it this bluntly, but is the battle already over? Don't consumers make decisions on the side of convenience all the time over privacy?
MURPHY: I hope not, and I don't think so. And I think that there's something different about this kind of information because it has such profound future implications and broad implications. And I think one interesting thing about genomic data is that this is a kind of information where one person in a multi-thousand-person family tree can expose the genetic information of every other person without their consent or even knowledge because how many of us know our third, fourth cousin?
SIMON: Erin Murphy, professor at NYU Law School, thanks so much for being with us.
MURPHY: It's my pleasure. Thank you. Transcript provided by NPR, Copyright NPR.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.