When A DNA Testing Firm Goes Bankrupt, Who Gets the Data?

An Icelandic firm that offers private DNA testing to customers has filed for bankruptcy in the U.S., raising privacy concerns about the fate of customer DNA samples and records, according to the Times of London.

DeCODE Genetics, a genetics research firm, began offering personalized DNA testing through its deCODEme website two years ago. A customer mails in a sample taken from the inside of his cheek, and the service calculates the subject’s genetic risk for disease — cancer, diabetes, Alzheimer’s, heart disease.

The company hasn’t disclosed how many clients signed up for its service, but provides a number of customer testimonials on its site, including Dorrit Mousaieff, Iceland’s first lady. The staff of the Martha Stewart show also got their DNA tested earlier this year by deCODE when the company’s founder, Dr. Kari Stefansson, was featured on the show.

DeCODE warned investors earlier this year that it was running out of money, and filed for bankruptcy in Delaware this week. Saga Investments, a U.S. venture capital firm, has already put in a bid to buy deCODE’s operations, including the deCODEme business, though the sale of the operations must still undergo a public auction.

The company told the Times that Saga would be bound by deCODE’s privacy agreements with customers, which prohibits the disclosure of customer data to third parties such as insurers, employers or doctors.

But privacy advocates are concerned that Saga, whose primary interest is bottom-line profits, will opt to sell subscriber data — possibly in an anonymized form to researchers and pharmaceutical companies. Academic researchers have shown that anonymized data can be correlated with other data to identify people.

Helen Wallace, of GeneWatch UK, told the Times that the issue illustrates how customers that provide data for one purpose can never be certain how it might be used.

“This clearly introduces a layer of uncertainty beyond what people expected when they signed up,” she told the Times. “People do need to double check what they are signing up to. These companies often use broad consent, and I worry whether people know what their data might be used for in the long term.”