Blurring lines

Companies that offer direct-to-consumer genetic testing and conduct research are blurring the line between customers and research subjects. Should these companies adhere to the same ethical regulations as academic researchers?

The research activities of direct-to-consumer genetic testing companies raise questions about consumers as research subjects

The recent rise of companies that offer genetic testing directly to consumers, bypassing the traditional face-to-face consultation with a health-care professional, has created a steady stream of debate over the actual and potential value of these services (Hogarth et al, 2008). Despite the debates, however, the reality remains that these services are being offered and have genuine consequences for consumers. As opposed to the issues that have regularly been discussed regarding direct-to-consumer (DTC) genetic testing, the fact that these companies use consumers' data to perform research has been given relatively little attention. This omission is misconceived as this practice—within the wider realm of DTC genetic testing services—raises its own questions and concerns. In particular, it is blurring the line between consumers and research subjects, which threatens to undermine the public trust and confidence in genetic research that the scientific community has been trying to build over the past decades.

Even when a company is relatively transparent about its research activities, one might still be concerned by a lack of consumer awareness of these activities

With this in mind, we analysed the websites—including informed consent forms and privacy policies—of five companies that offer DTC full genome testing: 23andMe, deCODE, Navigenics, Gene Essence—the genetic testing service offered by the company BioMarker Pharmaceuticals—and SeqWright. Two questions guided our study: Are consumers aware that the data generated by the company to fulfil the terms of their service will later be used for research? Even if this is the case, is the process of consent provided by companies ethically acceptable from the point of view of academic research?

As there are no empirical data available to answer the first question, we turned to the websites of the companies to understand how explicitly they present their research activities. At the time of the study—from July 2009 to January 2010—23andMe, deCODE and Navigenics candidly revealed on their websites that they conduct research using consumer data (Sidebar A). By contrast, SeqWright and Gene Essence provided what we identified as indirect and even ambiguous information about their research activities. For example, in a SeqWright online order form, the company notes: “Please volunteer any diseases from which you currently suffer (this can help us advance medical research by enabling us [sic] discover new SNP [single nucleotide polymorphism]/Disease associations)”. The information in Gene Essence's privacy policy was similarly vague (http://geneessence.com/our-labs/privacy-policy.html), stating that “electing to provide Optional Profile Information may enable the Company to advance the science of genetics and provide you with an even better understanding of who you are genetically”.

Sidebar A | Information provided by direct-to-consumer genetic testing companies^*.

23andMe

“You understand that your genetic and other contributed personal information will be stored in 23andMe research databases, and authorized personnel of 23andMe will conduct research using said databases.” (https://www.23andme.com/about/consent; accessed 29 January 2010)

deCODE

“Information that you provide about yourself under the security of your account and privacy of your chosen username may be used by deCODEme only to gather statistical aggregate information about the users of the deCODEme website. Such analysis may include information that we would like to be able to report back to you and other users of deCODEme, such as in counting the number of users grouped by gender or age, or associating genetic variants with any of the self-reported user attributes. In any such analyses and in presenting any such statistical information, deCODE will ensure that user identities are not exposed.” (http://www.decodeme.com/faq; accessed 29 January 2010)

Navigenics

“Navigenics is continuously improving the quality of our service, and we strive to contribute to scientific and medical research. To that end, we might de-link Your Genetic Data and Your Phenotype Information and combine it with other members' information so that we can perform research to: […] Discover or validate associations between certain genetic variations and certain health conditions or traits, as well as other insights regarding human health.” (http://www.navigenics.com/visitor/what_we_offer/our_policies/informed_consent/health_compass; accessed 29 January 2010)

^*See main text for information from SeqWright and Gene Essence.

If, as appears to be the case, these statements are the only declarations offered by these two companies alluding to their presumed research activities, it is virtually impossible for consumers to understand that their data will be used for research purposes. Moreover, despite the fact that the three other companies do state that they conduct research using consumer genotypes, even their declarations still give cause for concern. For instance, both Navigenics and deCODE ‘tuck away' most of the information in their terms of service agreements, privacy policies, or in the informed consent sections of their websites. This is worrisome, as most consumers do not even read and/or understand the ‘legalese' or ‘small print' when signing online forms (ICO, 2008).

…many studies show that participants who have agreed to have their tissue used for one type of research do not necessarily automatically agree to take part in other studies…

Even when a company is relatively transparent about its research activities, one might still be concerned by a lack of consumer awareness of these activities. Between July and September 2009, 23andMe offered a new service called the “23andMe research edition”, which was prominently displayed on the company website. This version of their service, which was part of what the company calls the “23andMe research revolution”, was offered for US$99—one-quarter of the price of their traditional personal genome scan—and it offered less information to consumers than the “traditional” service. For instance, the abridged research edition neither offered information about carrier status, pharmacogenomic information and ancestry, nor could the customer browse or download the raw genomic data (https://www.23andme.com/researchrevolution/compare).

At a glance, it seemed that 23andMe were marketing the “research edition” as a more affordable option, owing to the fact that the consumers were being given less information and because its name implied that the data would be used for research. Granted, the company did not explicitly express this last assumption, but the term “research edition” could have easily led consumers to this conclusion. However, what is particularly troubling about the two options—“research edition” and “traditional”, presented as distinct products—is that the consent forms for both services were identical. The issue is therefore whether, by calling one option “research edition”, 23andMe made it less clear to individuals purchasing the “traditional” service that their data would also be used for research purposes.

Even were we assured that consumers are at least aware of the research being conducted, we must still ask whether the companies are obtaining adequate consent compared with that required from volunteers for similar research studies? To answer this question, we considered official guidelines covering consent, public views on the topic and information gleaned from the websites of DTC genetic testing companies.

Concerning public opinion, many studies show that participants who have agreed to have their tissue used for one type of research do not necessarily automatically agree to take part in other studies (Goodson & Vernon, 2004; Schwartz et al, 2001). Furthermore, in a survey of more than 1,000 patients, 72% considered it important to be notified when leftover blood taken for clinical use was to be used for research (Hull et al, 2008). Most of those patients who wanted to be notified would require the researchers to get permission for other research (Hull et al, 2008).

…requesting additional information could still be understood by consumers as an additional service that they purchased and not an explicit invitation to take part in research

Although some of the companies in our study do mention the diseases that they might study, they are not specific and do not describe the scope of the research that will be done. Indeed, beyond the initial customer signature required to complete the purchase of the genetic testing service, it is not always clear whether the companies would ever contact consumers to obtain explicit consent for internally conducted research. That said, if they were to send out surveys or questionnaires to request supplementary phenotype information, and consumers were to fill out and return those forms, the companies might consider this as consent to research. We would argue, however, that this blurs the line between individuals as consumers and as research participants: requesting additional information could still be understood by consumers as an additional service that they purchased and not an explicit invitation to take part in research.

The issue of the identifiability of genomic data is inextricably related to the issue of consent as “[p]romises of anonymity and privacy are important to a small but significant proportion of potential participants” (Andrews, 2009). In the study performed by Hull and colleagues, 23% of participants differentiated between scenarios where samples and data were stored anonymously or with identifiers (Hull et al, 2008). The issue of anonymity is particularly important under the US Common Rule definition of ‘human subject' research (HHS, 2009). It dictates that research conducted using samples from people that cannot be identified is not considered human subject research and as such does not require consent. Although this rule applies only to federally funded research, it might become pertinent if companies collaborate with publicly funded institutions, such as universities. More generally, regulations such as the Common Rule and the US Food and Drug Administration's regulations for the protection of human subjects highlight the importance of the protection of individuals in research. Research activities conducted by companies selling DTC genetic tests should therefore be similarly transparent and accountable to a regulatory body.

On the basis of the information from the websites of the companies we surveyed, it is not unambiguously clear whether the data used in their research is anonymized or not. That said, 23andMe claims it will keep consumers informed of future advancements in science and might ask them for additional phenotype information, suggesting that it maintains the link between genotype data and the personal information of its customers. As such, research conducted by 23andMe could be considered to involve human subjects. Thus, if 23andMe were to comply voluntarily with the Common Rule, they would have to obtain adequate informed consent.

Even in cases in which data or samples are anonymized, studies show that people do care about what happens to their sample (Hull et al, 2008; Schwartz et al, 2001). Furthermore, it is becoming more and more apparent that there are intrinsic limits to the degree of protection that can be achieved through sample and data de-identification and anonymization in genomic research (Homer et al, 2008; Lin et al, 2004; McGuire & Gibbs, 2006; P3G Consortium et al, 2009). This further weakens the adequacy of companies obtaining broad-sense consent from consumers who, most probably, are not even aware that research is being conducted.

The European Society of Human Genetics (ESHG) has recently issued a statement on DTC genetic testing for health-related purposes, which states that “[t]he ESHG is concerned with the inadequate consent process through which customers are enrolled in such research. If samples or data are to be used in any research, this should be clear to consumers, and a separate and unambiguous consent procedure should take place” (ESHG, 2010). Another document was recently drafted by the UK Human Genetics Commission (HGC), entitled ‘Common Framework of Principles for Direct-to-Consumers Genetic Testing Services' (HGC, 2009). The principles were written with the intention of promoting high standards and consistency in the DTC genetic testing market and to protect the interests of consumers and their families. Although this document is not finalized and the principles themselves cannot control or regulate the market in any tangible way, this framework, along with the ESHG statement, constitute the most up-to-date and exhaustive documents addressing DTC genetic testing activities.

On the basis of the information from the websites of the companies we surveyed, it is not unambiguously clear whether the data used in their research is anonymized or not

…companies should be completely transparent with the public about whether people purchasing their tests are consumers or research subjects or both

Principle 4.5 states: “If a test provider intends to use a consumer's biological samples and/or associated personal or genetic data for research purposes, the consumer should be informed whether the research has been approved by a research ethics committee or other competent authority, whether the biological sample and data will be transferred to or kept in a biobank or database, and about measures to ensure the security of the sample. The consumer should be informed of any risks or potential benefits associated with participating in the research.” Principle 5.6 of the HGC's draft states that a “[s]eparate informed consent should be requested by the test provider before biological samples are used for any secondary purposes, e.g research, or before any third party is permitted access to biological samples. Consumers' biological samples and personal and genetic data should only be used for research that has been approved by a research ethics committee (REC) or other relevant competent authority.”

None of the companies we surveyed reveal on their websites whether internal research protocols have been approved by a REC or by an independent “competent authority”. Furthermore, no such independent body exists that deals specifically with the research activities of commercial companies selling DTC genetic tests. Additionally, if a company did claim to have internal ethical oversight, it would be questionable whether such a committee would really have any power to veto or change the company's research activities.

Moreover, while all five companies do state what will happen to the DNA sample—in most cases, unless asked otherwise by the consumer, the DNA sample will be destroyed shortly after testing—not enough is revealed about what will happen to the data. Some companies say where data is kept and comment on the security of the website, but as mentioned previously, companies are not clear about whether data will be anonymized. Traditionally, a great deal of focus has been placed on the fate and storage of biological samples, but genome-wide testing of hundreds of thousands of individuals for thousands or even millions of SNPs generates a lot of data. This information is not equivalent, of course, to a full genome sequence, but it can fuel numerous genomic studies in the immediate and medium-term future. As such, additional issues above and beyond basic informed consent also become a concern. For instance, what will happen to the data if a company goes bankrupt or is sold? Will the participants be sent new consent forms if the nature of the company or the research project changes drastically?

The activities of companies offering DTC genetic testing have not only blurred the lines between medical services and consumer products, but also between these two activities and research. As a consequence, the appropriate treatment and autonomy of individuals who purchase DTC genetic testing services could be undermined. Paramount to this issue is the fact that companies should be completely transparent with the public about whether people purchasing their tests are consumers or research subjects or both. Although an individual who reads through the websites of such companies might be considered a simple ‘browser' of the website, once the terms and conditions are signed—irrespective of an actual reading or comprehension—the curious consumer becomes a client and a research subject.

…consumers who become research participants should be treated with the same respect and under the same norms as those involved in biobank research

Companies using consumer samples and data to conduct research are in essence creating databases of information that can be mined and studied in the same way as biobanks and databases generated by academic institutions. As such, consumers who become research participants should be treated with the same respect and under the same norms as those involved in biobank research. As stated by the Organization for Economic Co-operation and Development, research should “respect the participants and be conducted in a manner that upholds human dignity, fundamental freedoms and human rights and be carried out by responsible researchers” (OECD, 2009). On the basis of our analysis of the websites of five companies offering DTC full genome testing, there is little evidence that the participation of ‘consumers' in research is fully informed.

The analysis of company websites was conducted in 2009 and early 2010. The information offered to consumers by the companies mentioned in this Outlook might have changed following the study's completion or the article's publication.

Heidi C. Howard

Pascal Borry

Bartha Maria Knoppers