Genetic Stalking and Voyeurism: A New Challenge to Privacy

I. Introduction

A new website has just been launched with the URL of www.celebritygenetics.com (“Celebrity Genetics”).¹ Designed to appeal to the public’s seemingly insatiable appetite for information about celebrities,² Celebrity Genetics sells genetic information about hundreds of entertainers, politicians, athletes, and other public figures. For a fee ranging from twenty dollars to several hundred dollars, individuals and commercial publishers (such as blogs and tabloids) can purchase genetic information about selected celebrities, such as relatedness to other celebrities (e.g., paternity); ancestral place of origin; cognitive ability; behavioral genetic profile (e.g., genetic contribution to sexual orientation, propensity to addiction, and degree of risk-seeking behavior); and predisposition to various illnesses.

The analysis of celebrity DNA samples is merely the latest application of new genetic technologies to test individuals without consent and for purposes other than health care.³ In the late 1980s, law enforcement officials began matching DNA left at crime scenes with samples donated to police by suspects, often in “DNA dragnets,” to identify serial murderers and rapists.⁴ Soon thereafter, law enforcement officers began obtaining DNA samples from suspects without consent and, in some cases, surreptitiously or by ruse from licked envelopes and stamps,⁵ soft drink cans,⁶ cigarette butts,⁷ chewing gum,⁸ and other objects.⁹

At about the same time, fathers with child support obligations who were suspicious of their child’s paternity were urged by billboard advertising and other mass marketing techniques to have DNA testing of themselves and their children (without the knowledge or consent of the child’s mother) to confirm or rebut their paternity.¹⁰ At first, the “doubtful dads” brought their children to genetic testing laboratories for the sample collection.¹¹ Soon thereafter, online entrepreneurs began advertising paternity testing services using home-collection kits involving cheek swabs, which captured buccal cells in saliva.¹²

It was not long before an “anything goes” atmosphere permeated the Internet world of DNA-based parentage testing—and the trend has continued unabated. For a fee, virtually any source of DNA that can be tested will be tested—with or without consent. For example, one web-based laboratory¹³ offers a list of items it will test and the cost for each, including the following: chewed chewing gum ($240—Wrigley Juicy Fruit is claimed to work best); cigarette butts ($240—six should be sent); hard candy ($300—well-sucked lollipops are preferred); used condoms ($300); semen stains on clothing ($300);¹⁴ used tampons or feminine pads ($240); sweaty hats or ball caps ($300); “hocked loogies” ($300—best if uninfected); plucked hair ($240—three to ten strands); Q-tips with ear wax ($300—up to three swabs); snotty Kleenex ($300—best if full of mucus); and fecal matter ($360—must be frozen immediately).¹⁵

Celebrity Genetics thus entered an already sleazy world of covert genetic analysis to offer yet another unsavory DNA testing service. Unlike testing for personal use, however, Celebrity Genetics assumes that the test results will generate widespread commercial interest. Celebrity Genetics’ business depends on maintaining interest in the genetic information of celebrities and replenishing the supply of DNA for analysis, and the company uses an ingenious method to do both. Celebrity Genetics’ website has a section called “DNA Wanted.” Hundreds of celebrities are listed, each with a price or bounty for the first collector who submits a sample of the celebrity’s DNA. As a result, Celebrity Genetics has created an army of thousands of amateur “gene-arazzi” from all over the world who hope to (and in some cases, do) make money and achieve fleeting notoriety by obtaining and selling the DNA of listed celebrities. The Celebrity Genetics website does not specify the method of sample collection; it merely lists some suitable items for DNA testing, such as used chewing gum and cigarette butts.

In attempting to verify that the DNA sample submitted is that of the celebrity claimed, the collector uses a cell phone or camera to obtain a digital image of the celebrity using a particular object (for example, a napkin in a restaurant). Then the collector places the object in a special mailing envelope sold by Celebrity Genetics to the DNA sleuths. Once received, the DNA is analyzed and the results are offered for sale on the Celebrity Genetics website.¹⁶ In their frenzy to obtain samples, DNA collectors in Hollywood, Cannes, Monte Carlo, Washington, Beijing, and other places have scavenged through the trash cans of political candidates, movie stars, judicial nominees, and Olympic athletes; pilfered napkins and utensils from chic restaurants; bribed bartenders and chambermaids for used glasses, towels, and linens; stolen dirty clothes from laundries and dry cleaners; and vandalized barber and beauty shops.¹⁷ Privacy advocates and various celebrities have voiced concerns about the intrusions and disruptions in obtaining the DNA, and in publication of the test results.¹⁸

Are Celebrity Genetics and its inevitable “copy-cat” websites merely the harmless, twenty-first century versions of gossip columns and tabloid photographs from an earlier era? Or does this phenomenon represent an insidious infringement on the rights of individuals to be let alone and to prevent their intimate personal health information from being involuntarily generated, publicized, and exploited?¹⁹

This Article considers whether individuals—celebrity or not—have or should have constitutional, statutory, or common law rights to prevent the seizure, analysis, and publication of genetic information without their consent. Part II of the Article discusses the constitutional issues associated with taking and analyzing objects containing DNA, including abandoned property. Part III considers the applicability of common law actions for invasion of privacy and conversion. Next, Part IV analyzes state genetic privacy laws. Part V assesses the policy options for dealing with this emerging issue, including illustrative federal and foreign laws, and presents a preliminary legislative agenda. Finally, Part VI concludes by observing what a future world without genetic privacy would be like.

II. Constitutional Law

Constitutional law is a logical starting point for analyzing privacy law because the Constitution has long been the source of rights involving individual autonomy, marriage, procreation, and medical privacy.²⁰ Although constitutional law is unlikely to provide a remedy in cases of genetic stalking by private parties, constitutional case law may be relevant in developing legislative and common law approaches to the issue.²¹ In general, the basic constitutional issue is whether individuals have a reasonable expectation of privacy in an object containing DNA so as to implicate the protections of the Fourth Amendment,²² the Fourteenth Amendment,²³ or comparable provisions of state constitutions.²⁴

The cases with facts closest to genetic stalking involve police seizing abandoned property and using it as evidence in a criminal prosecution. In the leading case of California v. Greenwood, a police investigator, suspecting that an individual was engaged in drug trafficking, asked the suspect’s regular municipal trash collector to pick up the plastic trash bags that the suspect left on the curb in front of his house and give them to the police without mixing them with other trash bags.²⁵ The trash collector gave the police the suspect’s trash bags every week for at least two months.²⁶ No warrant was obtained by the police to search the bags,²⁷ which contained “items indicative of narcotics use.”²⁸ The police used this evidence to obtain warrants to search the house, where they found cocaine and hashish.²⁹

In reversing the dismissal of the case in state court, the Supreme Court upheld the search and seizure under the Fourth Amendment.³⁰ The Court, in an opinion by Justice White, held that the defendants did not have a reasonable expectation of privacy in their garbage.³¹ “It is common knowledge that plastic garbage bags left on or at the side of a public street are readily accessible to animals, children, scavengers, snoops, and other members of the public.”³² The Court included a footnote about the practice of some tabloid journalists of combing through the garbage outside the home of Secretary of State Henry Kissinger.³³ In dissent, Justice Brennan asserted that because “[s]crutiny of another’s trash is contrary to commonly accepted notions of civilized behavior,” it is reasonable to expect that one’s garbage will not be subject to search.³⁴ “The mere possibility that unwelcome meddlers might open and rummage through the containers does not negate the expectation of privacy in their contents any more than the possibility of a burglary negates an expectation of privacy in the home ….”³⁵

The holding in Greenwood, however, is not limited to trash; it is part of a more general proposition that individuals have no reasonable expectation of privacy in abandoned property.³⁶ For example, in Abel v. United States, an FBI agent searched a hotel room after a suspect had paid his bill and vacated the room.³⁷ There, in a wastepaper basket, the agent found a “cipher pad” used in espionage.³⁸ The Supreme Court held that the evidence was lawfully seized because the defendant had abandoned it.³⁹

In contrast to Supreme Court precedent, some state courts have interpreted their state constitutions to be more protective of the right of privacy in abandoned property. For example, in State v. Goss,⁴⁰ the Supreme Court of New Hampshire considered a case with facts virtually identical to Greenwood. The police seized and searched the trash of an individual suspected of growing marijuana in his house.⁴¹ The trash was in black plastic bags left on a driveway about three feet from the road on a regular trash pick-up day.⁴² The bags contained “a wire scraper on which there was charred material that tested positive for presumptive marijuana presence.”⁴³ Based on this evidence, the police obtained a warrant to search the defendant’s house, where they found marijuana.⁴⁴ The court expressly declined to apply Greenwood to New Hampshire’s state constitutional prohibition against unreasonable searches and seizures because it did “not believe that conveying trash to a trash collector for disposal renders an expectation of privacy in the trash unreasonable.”⁴⁵ New Hampshire thereby joined a minority of courts in holding that there is a reasonable expectation of privacy in trash left for collection by regular trash collectors.⁴⁶

Constitutional case law is not directly applicable to the issue of genetic stalking. First, there is the matter of state (or governmental) action. Federal constitutional requirements under the Fourth and Fourteenth Amendments are relevant only when the government is conducting the search and seizure.⁴⁷ Second, there are six states with constitutional privacy protections applicable to both public and private actors.⁴⁸ Although these states prohibit unreasonable searches and seizures by both governmental and private actors,⁴⁹ it is not clear whether taking and analyzing abandoned property would be considered unreasonable in these states.⁵⁰ Finally, there is the matter of fashioning an appropriate remedy. In genetic stalking, often the person seizing the property will be the least easily identifiable and least solvent party. Consequently, aggrieved individuals and policy makers should look beyond constitutional search and seizure law to address the issue of nonconsensual genetic testing and publication of the results.

III. Common Law

A. Invasion of Privacy

In 1890, two young law partners from Boston, Samuel D. Warren and Louis D. Brandeis, published a seminal article on the right to privacy at common law.⁵¹ According to most historians, the impetus for the article was Warren’s concern about the allegedly intrusive social reporting of the Boston press, but it is not clear what, if any, specific stories aroused his ire.⁵² Brandeis collaborated with Warren to write their influential and legendary law review article, The Right to Privacy.⁵³ Although it was inspired by perceived abuses by the press, Warren and Brandeis argued more broadly in favor of a comprehensive common law right of individuals to be free from unwanted and unreasonable intrusions of their “inviolate personality.”⁵⁴

Warren and Brandeis expanded on Judge Thomas M. Cooley’s notion of privacy as “the right ‘to be let alone.’”⁵⁵ They proposed a general legal principle of protecting “the privacy of private life”⁵⁶ and urged creating a cause of action to redress “the more flagrant breaches of decency and propriety.”⁵⁷ They concluded their article by observing the irony between the different standards used by the law in dealing with public and private interferences with peaceful habitation: “The common law has always recognized a man’s house as his castle, impregnable, often, even to its own officers engaged in the execution of its commands. Shall the courts thus close the front entrance to constituted authority, and open wide the back door to idle or prurient curiosity?”⁵⁸

Despite its well-deserved acclaim in the academic literature, the Warren and Brandeis article did not immediately translate into a concrete common law doctrine that could be invoked to redress private wrongs.⁵⁹ Beginning in the 1930s, courts in several states began to recognize a right of privacy, but the contours of the right were not well defined.⁶⁰ The task of developing a cohesive doctrine fell to William L. Prosser who, in a famous law review article in 1960, proposed that the common law right to privacy was actionable in tort in four discrete situations:

1. Intrusion upon the plaintiff’s seclusion or solitude, or into his private affairs.

2. Public disclosure of embarrassing private facts about the plaintiff.

3. Publicity which places the plaintiff in a false light in the public eye.

4. Appropriation, for the defendant’s advantage, of the plaintiff’s name or likeness.⁶¹

Some scholars have argued that, in carving out limited categories of protected interests, Prosser engaged in reductionism and oversimplification of the human dignity embodied in the right to privacy.⁶² Nevertheless, the Restatement (Second) of Torts adopted Prosser’s classifications,⁶³ and the limited, categorical approach to common law torts for invasion of privacy steadily gained widespread acceptance in the United States.⁶⁴

All four of the prototypical common law invasions of privacy are implicated by genetic stalking and voyeurism, but not every jurisdiction recognizes all four types of invasion of privacy. Even in jurisdictions that do, it is not clear that courts would be prepared to apply invasion of privacy to the acts of obtaining, analyzing, and disclosing the genetic information of celebrities or “ordinary” individuals without their consent.

1. Intrusion upon Seclusion

The Restatement (Second) of Torts defines the tort of intrusion upon seclusion as follows: “One who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.”⁶⁵ The intrusion may be physical (as by entering a home without permission), electronic (as by wiretapping or electronically eavesdropping), or may occur by prying into private affairs (as by unauthorized scrutiny of an individual’s bank records).⁶⁶ Although the Restatement provides that no physical intrusion is required,⁶⁷ some courts have held to the contrary.⁶⁸ According to one formulation, “[p]eeping and eavesdropping are prime examples” of intrusion.⁶⁹ Two key factors used by the courts in determining the unreasonableness of the intrusion are the method used and the purpose of the defendant’s conduct.⁷⁰

In the context of genetic stalking,⁷¹ there are four important considerations. First, it is necessary to determine the act of intrusion. If there has not been any trespass to property, trespass to chattel, or conversion in the acquisition of the object to be tested, it would be more difficult to argue that there has been intrusion upon seclusion. Thus, where an interested party merely took a piece of abandoned property from a public place (e.g., a piece of used gum or a cigarette butt from a sidewalk), courts are likely to hold that there has not been any intrusion into an individual’s legally protectable interest. If there is an intrusion in this scenario, it must be from the act of performing DNA testing on the object without consent.⁷² Such a “dignitary” as opposed to “property” view of intrusion,⁷³ independent of any physical intrusion or the widespread disclosure of the test results, is based on the sensitive nature of the information revealed by the DNA testing. Although there is no case law in support of this approach, the courts have yet to be presented with facts involving genetic stalking.

Second, the courts have been reluctant to find an intrusion upon seclusion for conduct occurring in a public place because an individual has no reasonable expectation of privacy in public places.⁷⁴ The reluctance to find liability for intrusion in public places, however, is not absolute. Where special factors exist, recovery may be warranted, such as where a newspaper published a photograph of a woman who was exiting the fun house at a county fair and her skirt was blown up by air jets under the platform,⁷⁵ where there was overzealous and unreasonably intrusive surveillance including wiretapping,⁷⁶ or where there was persistent surveillance amounting to harassment.⁷⁷

Third, in the relatively few cases decided thus far, the courts have not developed a consistent doctrine for when medical testing beyond the bounds of consent constitutes intrusion upon seclusion. For example, a Pennsylvania court held that no intrusion upon seclusion occurred when a physician conducting a pre-marital blood test performed an HIV test without consent and retained the results.⁷⁸ The court held that because there was consent to draw the blood, there was no “invasion of bodily integrity.”⁷⁹ By contrast, a Colorado court held that performing an unauthorized HIV test on a student’s blood sample submitted for rubella testing, and then reporting the positive HIV test result to the state health department, constituted intrusion.⁸⁰ Significantly for the issue of genetic stalking, the court said that extracting the blood and testing the blood were separate acts for purposes of intrusion.⁸¹

Fourth, to be actionable, the intrusion must be highly offensive to a reasonable person. In the case of genetic stalking, this would seem to be the least difficult hurdle for a plaintiff. The defendants’ acts are motivated by their own pecuniary interests and, at a minimum, demonstrate an indifference to the harm caused by the disclosures.

2. Public Disclosure of Private Facts

Public disclosure of private facts is what led Warren and Brandeis to propose the right to privacy, yet it has proven to be the most difficult of the four privacy torts to apply.⁸² Public disclosure of private facts is the essence of genetic stalking and surreptitious genetic testing, but it is not clear whether the conduct is actionable in tort. According to the Restatement (Second) of Torts, public disclosure of private facts consists of the following elements: (1) disclosure to the public or a large number of persons; (2) of a fact that is private in nature; (3) which would be highly offensive to a reasonable person; and (4) is not of legitimate concern to the public.⁸³ The disclosure of information about celebrities could potentially involve all four elements.

The first element, widespread publication, is easily satisfied by the distribution of the information in any form of mass media, such as by print, broadcast, or through the Internet. Even oral communication may be sufficient if there are enough listeners.⁸⁴ There are several cases involving the disclosure of private information to co-workers. In general, courts hold that disclosure of private information to a limited number of current or former co-workers is not sufficient disclosure,⁸⁵ but authority exists to the contrary.⁸⁶ Some of these cases turn on whether the employer had a conditional privilege to disclose the information,⁸⁷ a fact that is irrelevant in the context of nonconsensual publication of genetic information.

Second, the fact disclosed must be of a private nature. Examples in the Restatement are sexual relations; family quarrels; unpleasant, disgraceful, or humiliating illnesses; and intimate personal letters.⁸⁸ Several cases involving the disclosure of an individual’s HIV-positive status have held that such information, with its attendant stigma, is private in nature.⁸⁹ Unlike HIV-positive status, however, genetic information is not necessarily “unpleasant[,] … disgraceful[,]… or humiliating” as used in the Restatement. For example, genetic information might confirm the paternity of a celebrity father and child; indicate that an individual is not genetically predisposed to cancer, Alzheimer’s disease, or some other serious illness; or indicate that a celebrity’s ancestral origins coincide with his or her public assertions. Despite the fact that the information is, in a sense, “favorable” to the individual, it is nevertheless of a private nature, and the purpose of the tort is to retain for the individual the autonomy to decide whether to undergo genetic testing and, if so, whether to disclose the results. Therefore, disclosure of any results of nonconsensual genetic testing should be actionable, but would not necessarily be under current standards.

Another aspect of private information is that it must not be within the realm of public knowledge. If the information is a matter of public record⁹⁰ or otherwise widely known,⁹¹ then even highly sensitive information cannot be considered private. In the context of celebrities, with so much information available about them—some disclosed by them or their agents for their own purposes—the range of topics considered private might be considerably narrower than for other individuals.

Third, the disclosure must be highly offensive to a reasonable person. An often-cited, but frequently criticized, case is Sidis v. F-R Publishing Corp.⁹² A former child mathematics prodigy, who had become a recluse, was tracked down and interviewed about his current whereabouts and activities.⁹³ The information was published in a popular magazine.⁹⁴ The court held that there was no liability because, despite being highly offensive to the plaintiff, publication of the information was not considered highly offensive to a reasonable person.⁹⁵ The result may be questioned as inappropriately applying an objective standard when the wrongdoer already knew of the individual’s heightened sensitivity.⁹⁶ An alternative basis for finding liability in the case is simply that the information was wrongfully obtained by deceit.⁹⁷

Fourth, the matter must not be a legitimate concern of the public. There is a clash between the interests of privacy and First Amendment protections for freedom of expression. In Sipple v. Chronicle Publishing Co., the plaintiff, a private citizen, became famous when he acted to prevent the shooting of then-President Ford.⁹⁸ Two days later, a newspaper columnist revealed that the plaintiff was gay, resulting in substantial emotional distress.⁹⁹ The plaintiff’s subsequent action for invasion of privacy was unsuccessful, in part, because his sexual orientation was considered “newsworthy.”¹⁰⁰ The court’s analysis and its implications are troubling. Because there was no connection between the reason for the plaintiff’s newsworthiness and his sexual orientation, Sipple suggests that any information about someone in the public eye, no matter how fleeting, might be considered “newsworthy.”

Another case involving newsworthiness is Gilbert v. Medical Economics Co.¹⁰¹ The defendant magazine published an extremely critical article about an anesthesiologist, which included her picture and name, as well as personal facts about her psychiatric history and marital life.¹⁰² In an action for invasion of privacy, the court held that the plaintiff’s personal information was newsworthy because of the close nexus between the plaintiff’s personal problems and the underlying malpractice issues in the story, which were matters of public concern.¹⁰³

Because of the difficulty in drawing lines between newsworthy information and disclosures that invade the privacy of the individual, some states have rejected any actions for public disclosure of private facts.¹⁰⁴

3. False Light

The Restatement (Second) of Torts defines false light invasion of privacy as follows:

One who gives publicity to a matter concerning another that places the other before the public in a false light is subject to liability to the other for the invasion of his privacy, if

(a) the false light in which the other was placed would be highly offensive to a reasonable person, and

(b) the actor had knowledge of or acted in reckless disregard as to the falsity of the publicized matter and the false light in which the other would be placed.¹⁰⁵

The injury in a false light claim is the mental distress resulting from an invasion of the individual’s privacy; by contrast, in defamation the harm is to the individual’s reputation.¹⁰⁶ Thus, theoretically, it is easier for a plaintiff to prove false light than defamation because the plaintiff in a false light case need only prove that the communication was false and offensive, rather than defamatory.¹⁰⁷ As with defamation, however, the defenses of truthfulness of the statement, consent, the expression of opinion by the defendant, and privileged communication will preclude liability.¹⁰⁸

The Supreme Court added a constitutional dimension to the tort of false light invasion of privacy with its decision in Time, Inc. v. Hill.¹⁰⁹ The Court held that in false light cases, as in defamation cases,¹¹⁰ if the plaintiff is a public official or public figure, the false light statement is only actionable if it was published with knowledge of falsity or a reckless disregard for the truth.¹¹¹ The actions of an agent, such as a reporter, may be attributable to a principal, including a newspaper.¹¹²

False light invasion of privacy might be implicated in genetic stalking cases, but the facts would have to be exceptional, especially because the plaintiff, as a celebrity, would be a public figure. Liability is possible if the defendant published the results of a genetic test and falsely attributed the results to the plaintiff when the defendant knew they were not the plaintiff’s test results or published the results with a reckless disregard for the truth.¹¹³ Other possible bases of liability are publishing test results generated by a laboratory known to produce erroneous findings and reporting associations between genetic test results and health conditions known not to be based on scientific evidence. Because of the nature of the defendant’s conduct required to establish false light invasion of privacy, if this cause of action were used in the context of genetic stalking, it would likely be part of a series of tort claims rather than a single basis of liability.

4. Appropriation of Name or Likeness

The Restatement (Second) of Torts provides a cause of action for invasion of privacy based on appropriation of an individual’s name or likeness. “One who appropriates to his own use or benefit the name or likeness of another is subject to liability to the other for invasion of his privacy.”¹¹⁴ Typical cases have involved the use of an individual’s photograph in advertising without permission.¹¹⁵ One who sells another individual’s DNA profile without permission would clearly seem to be benefiting from “the reputation, prestige, social or commercial standing, public interest or other values of the plaintiff’s name or likeness.”¹¹⁶ The only issue is whether the results of a DNA test would constitute an individual’s “name or likeness.” Not surprisingly, there are no cases directly on point.¹¹⁷

In Moore v. Regents of the University of California, John Moore, a resident of Seattle, was treated for hairy-cell leukemia by Dr. David W. Golde at the University of California-Los Angeles (UCLA) Medical Center.¹¹⁸ Following a surgical splenectomy as part of his treatment, portions of Moore’s excised spleen were used by Dr. Golde and his research colleagues to develop a cell line from Moore’s T-lymphocytes.¹¹⁹ UCLA applied for, and was granted, a patent on the cell line, which listed Dr. Golde and a colleague as inventors.¹²⁰ Although the invention was expected to have substantial commercial value, no royalties or profits were ever generated and the defendants only received an initial payment from the commercial interests.¹²¹ Nevertheless, neither Dr. Golde nor anyone else at UCLA informed Moore before surgery, after surgery, or during three follow-up visits—suggested by Dr. Golde, during which additional blood and other biological specimens were obtained—that UCLA intended to use Moore’s biological material for research or commercial purposes.¹²²

When Moore learned of the use of his cell lines without his permission, he sued the defendants under various causes of action.¹²³ In rejecting Moore’s claim for appropriation of name or likeness, the California Supreme Court held that the appropriated material must be “unique” to the plaintiff, and the court stated that the lymphokines used by the defendants are of the same basic molecular structure in all human beings.¹²⁴ Such an argument is hard to square with either the science or the facts, because it was precisely the uniqueness of the cell line derived from John Moore that purportedly made it so valuable. Similarly, even though the DNA of any human is comprised of the same four nucleotides, the order of the nucleotide base pairs is unique in every human, and DNA analyses indicate, or at least suggest, certain biological characteristics of the individual whose DNA is analyzed.¹²⁵

Some states have codified the common law tort of appropriation of name or likeness to prohibit the use of a person’s photograph or name for commercial purposes without express consent,¹²⁶ although the statutory approach does not necessarily translate into greater privacy protection than the common law. In Mendonsa v. Time Inc., a statutory claim was brought under New York law by the sailor in the famous Life magazine photo depicting him kissing a nurse in Times Square on V-J Day in 1945.¹²⁷ In 1987, Life offered to sell copies of the photograph for $1600 each without offering any compensation to the sailor, whose identity was known.¹²⁸ The court held that, although the initial publication in 1945 was newsworthy and not for commercial purposes, the subsequent publication was for commercial purposes in violation of the statute.¹²⁹ It is not clear whether statutorily-based claims for appropriation of DNA information would be greeted with greater judicial solicitude than common law claims. Nevertheless, the existence of state statutes suggests a legislative intent to protect celebrities and others from commercial exploitation of their public persona.

B. Conversion

Traditionally, individuals have not been concerned about what happens to traces of their saliva or other biological material left behind on a subsequently seized object. They have been concerned about the information that can be discovered through genetic or other scientific analysis of the biological material. Conversion is a property tort and, to be actionable, the plaintiff must have an ownership interest in the property converted.¹³⁰ With abandoned waste material, it may be difficult to assert a property interest in the object taken, such as a discarded cigarette butt or soft drink can. Alternatively, even if an individual does not have a property interest in the abandoned object containing the biological material, an individual might assert a property interest in the information contained in the specimen. If so, then another party’s intentional exercise of dominion over the specimen containing the information would constitute the tort of conversion.¹³¹ In the few cases that address the issue, the courts were not receptive to either theory.

The leading case on conversion of human biological material is Moore, discussed in the previous section. Another of Moore’s claims was based on conversion.¹³² In analyzing this cause of action, the California Supreme Court considered whether Moore retained an ownership interest in his cells after his possession of the cells ended.¹³³ The court observed that no reported judicial decision supported Moore’s claim, and furthermore, that a California statute seemed to limit a patient’s continuing interest in excised cells.¹³⁴ The court also emphasized that the patent was not issued on the excised tissue, per se, but on the cell line developed from the tissue, and that public policy supported the development of materials for biomedical research.¹³⁵ As the court stated: “[t]he extension of conversion law into this area will hinder research by restricting access to the necessary raw materials.”¹³⁶

A similar issue was raised in Greenberg v. Miami Children’s Hospital Research Institute, Inc.¹³⁷ Plaintiffs, who were parents of children with Canavan disease,¹³⁸ gave money and tissue samples to a researcher to discover the genetic basis of the Disorder.¹³⁹ The researcher successfully isolated the gene responsible for Canavan disease.¹⁴⁰ Without informing the plaintiffs, the researcher’s institution patented the gene and licensed it to a genetic test developer.¹⁴¹ The plaintiffs sued on various legal theories, including conversion.¹⁴² The court held that the plaintiffs failed to state a claim for conversion.¹⁴³ It cited Moore with approval and noted that under Florida law “the property right in blood and tissue samples … evaporates once the sample is voluntarily given to a third party.”¹⁴⁴

In considering how these cases might affect an action for conversion based on genetic stalking, there are three distinguishing characteristics. First, in both Moore and Greenberg, the samples were voluntarily given to the researchers, albeit not with the intent to authorize the subsequent uses.¹⁴⁵ Genetic stalking cases could involve either abandoned property (e.g., discarded chewing gum) or stolen property (e.g., a napkin taken from a restaurant). It is not clear if the method of acquisition of the specimen would influence the outcome of an action for conversion because the basis of the action is not conversion of the object containing the DNA, but obtaining and using the information revealed by the DNA. Second, Moore and Greenberg explicitly relied on the public policy in favor of medical research.¹⁴⁶ No such public interest is ordinarily implicated in analyzing biologically “unexceptional” DNA. There might be a public interest in learning the genetic predisposition to illness of a candidate for high public office, but in typical cases courts relying on public policy would likely find that it favors protecting genetic information from unwanted disclosure. Third, in Moore and Greenberg, the specimens had value because they formed the basis of a cell line or indicated the presence of a genetic marker.¹⁴⁷ A court might decide that the traces of saliva or other body fluids acquired solely for analysis have no value in themselves, but only as the source of information. Thus, they might conclude that nothing of value was converted.¹⁴⁸ Based on existing case law, conversion is unlikely to afford a viable cause of action for the unauthorized taking of an object for genetic testing and publication of the results.

IV. State Genetic Privacy Laws

Beginning in the 1990s, several states enacted some form of genetic privacy law,¹⁴⁹ often as part of a legislative package including prohibitions on genetic discrimination in health insurance, employment, or both. Among other things, these laws require consent (often written, informed consent) before genetic testing is performed, before access is granted to genetic information, and before genetic information is retained or disclosed.¹⁵⁰ The laws usually provide for specific penalties for violations.¹⁵¹ As of 2009, there were twelve states with laws requiring consent before performing genetic testing.¹⁵² The laws all contain several exceptions which vary by state but generally include genetic testing for law enforcement, newborn screening, paternity determinations, and other publicly acceptable purposes.

In reviewing these laws, it is doubtful that any of them would apply to genetic stalking and surreptitious genetic testing. To begin with, the laws in three states only apply to health care providers or physicians.¹⁵³ In another, the law only applies to insurance companies.¹⁵⁴ Of the states with laws of general applicability, one applies only to “predictive” genetic testing, which would characterize a test indicating an individual’s risk of illness, but would not apply to a genetic analysis of parentage, ethnic origins, or other tests likely to be performed in the context of genetic stalking.¹⁵⁵ Four states prohibit the genetic testing of a biological sample “taken from an individual,”¹⁵⁶ a “sample,”¹⁵⁷ or “bodily materials” of an individual,¹⁵⁸ all of which might not apply to genetic testing of an abandoned item. As to the remaining three states¹⁵⁹ with the most general or vague prohibitions on nonconsensual genetic testing, there is no indication that the laws were intended to address the issue of genetic stalking or surreptitious genetic testing.

V. Policy Options

New DNA technology creates great challenges for protecting privacy. Every human sheds DNA constantly in hair and skin cells; we also leave traces of DNA (e.g., in saliva and perspiration) on objects used in daily life. Does the ubiquity of DNA and the ease of obtaining, analyzing, and publishing the results of genetic testing make it futile to attempt to control genetic stalking and voyeurism? Or, are the privacy interests so fundamental and the potential harms so substantial to all individuals—not just celebrities—that a comprehensive regime of legal regulation should be developed and implemented immediately to prohibit nonconsensual genetic testing?¹⁶⁰

The range of possible answers to these questions is illustrated by quotes from two highly diverse sources. On one side, Justice Brandeis, in his famous dissent in Olmstead v. United States, rejected the Supreme Court majority’s view that the Fourth Amendment did not extend to wiretapping because electronic communications were unknown when the Fourth Amendment was adopted.¹⁶¹ He wrote: “Time works changes, brings into existence new conditions and purposes. Therefore a principle to be vital must be capable of wider application than the mischief which gave it birth.”¹⁶² According to Brandeis, privacy is such a fundamental element of civilized society that legal doctrines should be adapted to respond to new technological developments.¹⁶³ The opposite view is captured succinctly by the often-quoted statement of Scott McNealy, Chief Executive Officer of Sun Microsystems, who responded to consumer privacy concerns about new technology by stating: “You have zero privacy anyway. Get over it.”¹⁶⁴

A. Additional Sources of Public Policy

Sections II–IV discussed the applicability and adequacy of constitutional law, tort law, and state genetic privacy laws in preventing genetic stalking and remedying its harms. In formulating public policy, it is also valuable to consider instructive legislative responses to emerging privacy concerns.

Genome sequencing, digital communications, the Internet, and other technologies complicate the task of protecting genetic privacy. Nevertheless, the following three laws enacted since 2003 strongly suggest that measures to prohibit genetic stalking and voyeurism could receive popular and political support. Collectively, these laws show the inclination of legislatures to respond to new privacy threats, even if the response is slow in coming and incomplete in coverage.

1. Genetic Information Nondiscrimination Act (GINA)

The Genetic Information Nondiscrimination Act of 2008 (GINA)¹⁶⁵ was enacted after a difficult, thirteen-year battle in Congress.¹⁶⁶ GINA prohibits discrimination in health insurance and employment on the basis of genetic information, defined as information about an individual’s genetic tests, the genetic tests of family members, or the occurrence of a disease in family members of the individual.¹⁶⁷ GINA prohibits health insurers and employers from requiring genetic testing or using an individual’s genetically-enhanced risk of illness to discriminate in health insurance coverage or cost, or in any terms and conditions of employment.¹⁶⁸

Despite the lack of many documented incidents of genetic discrimination,¹⁶⁹ GINA was enacted because numerous individuals at risk of genetic disorders declined testing out of fear of the consequences.¹⁷⁰ Thus, by prohibiting certain uses of genetic information generated by the tests, in theory, at-risk individuals would be more willing to undergo potentially beneficial genetic testing.¹⁷¹ The congressional findings section of GINA states that federal legislation “is necessary to fully protect the public from discrimination and allay their concerns about the potential for discrimination, thereby allowing individuals to take advantage of genetic testing, new technologies, and new therapies.”¹⁷²

It is unlikely that GINA will have its desired effects. The law is notoriously limited in scope.¹⁷³ It does not apply to life insurance, disability insurance, or long-term care insurance.¹⁷⁴ Significantly, GINA only applies to individuals who are asymptomatic.¹⁷⁵ Thus, it would not prevent a health insurance company from declining to renew or substantially increasing the rates for an individual health insurance policy after an individual becomes ill, even if the individual is affected by the condition for which he or she was at a genetically increased risk.¹⁷⁶ GINA explicitly provides that the statute does not apply if there has been a “manifestation” of a disease or disorder,¹⁷⁷ but the term is not defined. It is not clear what effect increasingly sophisticated biomarkers that measure presymptomatic biological changes will have on statutory coverage.¹⁷⁸

GINA is not totally without value.¹⁷⁹ It prohibits discrimination against individuals at increased risk of a genetic-related condition, and many such individuals will never develop the condition despite their increased risk. GINA also is important for policy reasons. It is the first federal law expressly intended to prevent discrimination based on genotype.¹⁸⁰ It is also the first federal law exclusively intended to ameliorate the negative consequences of new genetic technologies.

2. Video Voyeurism Prevention Act

The federal Video Voyeurism Prevention Act of 2003 amended the federal criminal code to prohibit a person within the territorial jurisdiction of the United States from intentionally capturing an image of a private area of an individual’s unclothed or “undergarment clad” body without the individual’s consent under circumstances in which the individual has a reasonable expectation of privacy.¹⁸¹ An individual convicted of such an offense is subject to a fine of up to $100,000, up to one year imprisonment, or both.¹⁸²

According to the House Report on the law, “video voyeurism” was becoming a growing privacy concern because of the “development of small, concealed cameras and cell phone cameras, along with the instantaneous distribution capabilities of the Internet.”¹⁸³ Many states lacked legislation making such conduct unlawful.¹⁸⁴ The federal law was designed to protect a reasonable expectation of privacy on federal land, such as national parks and federal buildings,¹⁸⁵ as well as serving as model legislation for states that had not yet enacted their own laws.¹⁸⁶

The video voyeurism law has no direct relevance to genetic stalking, but it is instructive. Congress demonstrated its willingness to enact legislation to protect the reasonable expectation of privacy of individuals from surreptitious, intrusive conduct facilitated by modern technology, including the use of the Internet to broadcast private images. On the other hand, Congress was unwilling to enact a federal law of general applicability beyond federal property.

3. Human Tissue Act (United Kingdom)

The United Kingdom’s Human Tissue Act of 2004 is a long, detailed, and comprehensive statute regulating human organ transplantation and the collection, analysis, storage, and use of human tissue.¹⁸⁷ The law was enacted in response to reports of abuses at certain hospitals where the organs and tissue of children who had died were removed, stored, and used without proper consent.¹⁸⁸ The law supersedes earlier transplantation laws and created a system of regulation directed by the newly established Human Tissue Authority.¹⁸⁹ The law provides for substantial criminal sanctions for violations. A person found guilty of violating the Act is subject to a fine, imprisonment for up to three years, or both.¹⁹⁰

Although the primary purpose of the law is to deal with the use of human tissue for transplantation and research, the law prohibits any nonconsensual analysis of DNA. Section 45 makes it unlawful for any individual, without proper consent, to possess any “bodily material” with the intent to have DNA testing performed.¹⁹¹ There are exceptions for medical treatment, law enforcement, research, and other uses.¹⁹²

The inclusion of Section 45 is a direct result of concerns about genetic stalking. In 2002, there were press reports about an alleged plot to steal hair from Prince Harry and perform surreptitious genetic testing.¹⁹³ The purpose of the plot was to determine if Major James Hewitt, with whom Princess Diana was said to have had an affair, was the father of Prince Harry rather than Prince Charles.¹⁹⁴ Section 45 was intended to make such conduct a crime.¹⁹⁵

Baroness Helena Kennedy, a member of the House of Lords and Chair of the Human Genetics Commission, clearly recognized that the new law bans surreptitious, nonconsensual genetic testing. She described the purpose of Section 45 in more general terms:

Until now there has been nothing to stop an unscrupulous person, perhaps a journalist or private investigator, from secretly taking an everyday object used by a public figure—like a coffee mug or a toothbrush—with the express purpose of having the person’s DNA analysed. Similarly, an employer could have secretly taken DNA samples to use for their purposes.¹⁹⁶

The law took full effect on September 1, 2006, but as of June 2008, there had not been any prosecutions under section 45.¹⁹⁷

B. Developing New Policies

Any comprehensive approach to regulate genetic stalking should consider the four parties involved in the process: (1) the individual stalkers who collect the DNA, (2) the laboratories analyzing the DNA, (3) the publishers of the genetic test results, and (4) the websites encouraging and facilitating the stalking.

1. The Collectors

Individuals engaged in genetic stalking could violate several statutes and common law provisions. If they were actually “stalking” the celebrities,¹⁹⁸ this would be actionable in tort¹⁹⁹ as well as criminal law.²⁰⁰ They might also be committing a separate violation in the process, such as civil or criminal trespass by entering property without permission or the crime of larceny or the tort of conversion if they stole something of value to obtain the DNA sample.

It would be of questionable utility to prosecute individuals who obtained abandoned property, even if they obtained the property with the intent to sell it or have its DNA content analyzed. Overly broad legislation could prohibit young fans from saving the used chewing gum²⁰¹ or soft drink cans of rock stars or athletes. There is no reason to prohibit such collection, even with the intent to sell this “memorabilia,” any more than banning the sale of photographs of celebrities taken in public places.

If a criminal statute were enacted prohibiting the sale of an object with the intent to analyze the DNA on the object without consent, it might be very difficult to prove intent, unless the sale is to a commercial website such as Celebrity Genetics. The U.K.’s Human Tissue Act of 2004 prohibits the sale of “bodily material” with the intent to analyze DNA.²⁰² Although such a prohibition would be valuable in the United States, other measures are also needed to outlaw genetic stalking.

2. The Laboratories

A variety of public and private bodies regulate genetic testing laboratories. Laboratories performing genetic testing for clinical purposes are regulated by the College of American Pathologists²⁰³ and the Department of Health and Human Services,²⁰⁴ pursuant to the Clinical Laboratories Improvement Amendments of 1988 (CLIA).²⁰⁵ Although about half the states have some degree of statutory authority for oversight of clinical laboratories, only California, New York, and Washington require any review of clinical validity for individual assays.²⁰⁶ Laboratories performing genetic testing for forensic purposes are regulated, albeit voluntarily, by the American Society of Crime Laboratory Directors and the National Forensics Science Technology Center.²⁰⁷ Laboratories performing genetic testing for paternity are accredited by the American Association of Blood Banks.²⁰⁸ Home-collection test kits for clinical use are regulated by the Food and Drug Administration.²⁰⁹

Despite the involvement of numerous professional and regulatory bodies, laboratories performing genetic testing for nonclinical, nonforensic, and legally inadmissible purposes currently are not subject to any regulation. New Internet-based companies performing genome-wide association studies or more limited genetic risk assessments do not submit any claims to public or private payers for reimbursement and assert that they are providing their services for informational rather than diagnostic purposes.²¹⁰ These laboratories also are not covered by the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule because they do not submit claims for payment in electronic format.²¹¹ Therefore, there are no federal statutory or regulatory limits on the uses and disclosures by the laboratories of genetic information they acquire from genetic tests. Laboratories performing “curiosity” testing to assess paternity also do not require regulatory approval, although the results from an unaccredited laboratory generally are not admissible in court.²¹²

There are no reliable figures about the number of laboratories offering various types of unregulated genetic testing services, but there are at least one hundred Internet-based genetic testing companies, and the number is growing.²¹³ Focusing new statutes and regulations on the laboratories would be effective, at least for the laboratories located in the United States. Thus, if laboratories were prohibited from performing genetic testing without the express consent of the subject, then genetic stalking and obtaining items containing DNA would be pointless. Even as to genetic testing with consent, there are substantial concerns about analytical validity,²¹⁴ clinical validity,²¹⁵ clinical utility,²¹⁶ misleading conclusions, and the lack of genetic counseling.

3. The Publisher

In this section, the term “publisher” is used to include any person or entity disclosing information in any form, including orally, in print, electronically, or by broadcast. In the context of genetic stalking, publication presumably will be in a form to reach numerous people. Publishers of genetic information without consent might be liable for common law invasion of privacy.²¹⁷ An important but difficult question is whether a statutory restriction on publication would be feasible or constitutional under the First Amendment.

The HIPAA Privacy Rule applies only to three specific types of covered entities involved in the submission of electronic health claims data: health care providers, health plans, and health clearinghouses.²¹⁸ With certain exceptions for public health, law enforcement, and other uses, the Privacy Rule prohibits uses and disclosures of protected health information beyond treatment, payment, or health care operations without the written authorization of the individual.²¹⁹ To take an extreme example of HIPAA’s possible applicability to genetic stalking, suppose a hospital (a covered entity) published in its weekly newsletter for patients, staff, and others the genetic or other health information about a particular patient (e.g., a celebrity patient) without the patient’s authorization. Such conduct clearly would violate the Privacy Rule. It is unlikely that the hospital would be successful in asserting a First Amendment defense.

Suppose the HIPAA Privacy Rule were extended by Congress to be a comprehensive health privacy law, applicable to all uses and disclosures of protected health information by any individual or entity.²²⁰ Would it violate the new privacy law for a newspaper to publish genetic or other health information about a patient in the local hospital? Should it matter how the newspaper obtained the information? Should it matter what information is disclosed? Should it matter why the information is being disclosed? Should it matter if the patient is an ordinary resident of the community or an important elected official or candidate for a high political office?²²¹

Some statutory and regulatory measures to protect the privacy of individuals from publication of their health information will withstand constitutional scrutiny.²²² At some point, however, the public’s interest in having access to the information will outweigh the individual’s right to privacy and come within the protections of the First Amendment.²²³ Because of the difficulties in discerning and defining such a point, it is appropriate to consider the larger question of whether efforts to prevent genetic stalking and nonconsensual publication of genetic information should focus on the publishers of the information or should target other parties.

4. The Websites

Celebrity Genetics initiated the collection of the specimens, contracted to perform the genetic testing, and offered to sell the genetic test results. Thus, Celebrity Genetics is more than a content-neutral bulletin board or Internet service provider; it is a content provider.²²⁴ From a regulatory standpoint, however, it is not clear whether Celebrity Genetics is engaged in any illegal conduct. Under current law, Celebrity Genetics might be subject to civil liability for invasion of privacy,²²⁵ but criminal liability would be possible only if the website analyzed the samples in one of the twelve states that require express consent for genetic testing,²²⁶ and it is not clear that any of these state laws would apply.

There are at least four ways in which the conduct of Celebrity Genetics could be regulated. First, a law could be enacted to prohibit possession of a biological specimen with the intent to perform a genetic test without consent. This approach, treating the specimen as contraband, is used in the U.K. Human Tissue Act.²²⁷ Second, assuming that obtaining human tissue without consent is made unlawful, a law also could be enacted to prohibit the solicitation of human tissue obtained without consent. This prohibition on soliciting unlawful conduct would likely be upheld despite any First Amendment claims.²²⁸ Third, a law could be enacted to prohibit the sale of genetic information revealed by the testing of a biological sample obtained without consent. Finally, a law could be enacted to require that Internet service providers block the sites of purveyors of genetic information, such as Celebrity Genetics. Such a law, however, is unlikely to withstand constitutional scrutiny.²²⁹

C. A Preliminary Legislative Agenda

Existing laws are inadequate to address the issue of genetic stalking. Because of the potentially national scope of the genetic stalking enterprise and the desirability of uniformity, congressional action should be undertaken to address the issue. The following recommendations are based on the assumption that a possible statute would be directed specifically and exclusively to unauthorized seizure, testing, and disclosing of genetic information. Such an approach, often referred to as “genetic exceptionalism,”²³⁰ has been criticized by commentators²³¹ but embraced by legislators.²³²

In my view, genetic tests and genetic information generally should not be treated differently from other medical tests and information in the absence of a compelling reason.²³³ Conceptually, it would be better to regulate any individual or entity performing any biological testing of human specimens. Nevertheless, it might be extraordinarily difficult to craft broad legislation that would ban any ill-advised, poorly performed, and nonconsensual medical testing without having unintended consequences such as prohibiting harmless biological analyses.²³⁴ Furthermore, at the present time, the principal risk of testing biological specimens left on discarded objects is that the sample will be subjected to genetic testing. It is possible that the development of new, non-genetic analytical techniques would require amendment of the statute.

The following eight elements should be included in genetic stalking legislation.

1. Comprehensive Regulation of Laboratories

All laboratories performing genetic testing of human specimens should be subject to federal regulation, and only tests certified as meeting acceptable scientific standards of analytical validity, clinical validity, and clinical utility should be approved.

2. Regulatory REORGANIZATION

A new or reorganized regulatory authority should be created within the Department of Health and Human Services to oversee the approval of all new genetic tests for clinical, forensic, or commercial use, as well as to ensure compliance with good laboratory practices. The professional organizations currently involved in the regulatory process should continue to have a defined advisory role in the new regulatory system.²³⁵

3. Consent

Verified,²³⁶ express,²³⁷ written consent of the individual whose biological specimen is tested should be required for all genetic testing not ordered by a health care professional with statutory authority to order a genetic test. This requirement would apply to both “walk-in” and home-collection testing. Genetic testing in health care settings would continue to be governed by established standards of medical practice, state medical practice acts, and professional accreditation standards. Written consent should not be required for all genetic testing in health care settings.²³⁸

4. Testing Minor Children

Any genetic testing of minor children to determine their parentage should be unlawful without the verified, express written consent of both legal parents, except pursuant to a court order. Much of the current, Internet-based genetic testing without consent involves men with child-support obligations who are suspicious of the paternity of their children. Curiosity parentage testing by noncustodial fathers has the potential to disrupt families and should be restricted.²³⁹ Genetic testing of minor children for health care purposes should be regulated by state laws dealing with parental authority to consent for the health care of minors.

5. Specimens

Subject to narrowly defined exceptions for law enforcement, national security, public health, and other specific purposes, no genetic testing should be permitted using a specimen other than a blood sample, a buccal swab, or another specimen collected using generally accepted laboratory practices, except where the testing is pursuant to a court order. The effect of this provision would be to prohibit the testing of chewing gum, cigarette butts, and other abandoned or pilfered items obtained without consent. If testing is performed with consent, then only standard laboratory collection methods would be used.

6. Solicitations

Advertising or soliciting to perform any genetic testing service in violation of these requirements (e.g., testing abandoned objects, testing without consent) using any medium (including the Internet) or misrepresenting that any laboratory or genetic test has received the appropriate regulatory approval should be unlawful.²⁴⁰ Although aggressive enforcement of this provision is essential, it remains to be seen whether federal or state regulators would have the resources or political support to undertake such action.

7. Sale of Information

Selling individually-identifiable genetic information without the verified, express, written consent of the individual should be unlawful,²⁴¹ except that the sale of an object containing or possibly containing genetic material should be permissible so long as the sale is not for the purpose of analyzing the genetic material without such consent of that individual. For example, the sale of a letter and envelope from a famous person should not be unlawful merely because there may be DNA on the envelope or stamp.²⁴²

8. Sanctions

A range of civil and criminal sanctions for violations should be provided, there should be stringent enforcement of the regulatory provisions, and individuals harmed by unlawful conduct in violation of the statute should have a private right of action for damages and other appropriate relief.

VI. Conclusion

In the futuristic film Gattaca, the female lead, played by Uma Thurman, Surreptitiously obtains a hair of her romantic interest, the film’s protagonist, played by Ethan Hawke.²⁴³ She takes the hair to a laboratory that appears to specialize in the stealth genetic assessment of prospective mates.²⁴⁴ For a seemingly nominal fee, and in a matter of seconds, the laboratory presents her with the results of a full genome sequence analysis and an overall assessment of “9.3,” which, she is told, makes the sample source “quite a catch.”²⁴⁵ This aspect of the futuristic world portrayed in Gattaca is not science fiction; it is here today. The only differences are that today’s genetic testing is not available “while you wait,”²⁴⁶ only genome-wide association analyses rather than full sequence data are commercially available today,²⁴⁷ and the genetic testing of the future presumably would be more accurate than what is commercially touted today.²⁴⁸

Genetic stalking and voyeurism involving celebrities serve to draw attention to the issue, but the underlying privacy concerns of surreptitious genetic testing are anything but frivolous and have population-wide applicability. Genetic information is among the most sensitive health and personal information about an individual.²⁴⁹ Without legislation prohibiting nonconsensual DNA analysis, human dignity and public civility will be irretrievably lost. Society will have succeeded in reaching a level of “zero” privacy and it will not be easy or desirable to “get over it.”

The recommendations for legislation in this Article address only one part of the wider problem of the lack of privacy protections for health information, including the commercial exploitation of health information. For example, the United States does not have a comprehensive health privacy law;²⁵⁰ the closest thing to such a law is the HIPAA Privacy Rule, which has limited coverage,²⁵¹ weak protections,²⁵² and virtually no enforcement.²⁵³ The newly enacted federal genetic nondiscrimination law, GINA, does not address the use of genetic information in life insurance, disability insurance, long-term care insurance, mortgages, or numerous other contexts.²⁵⁴ The proposals in this Article are directed primarily at commercial uses of genetic Information; they do not address the exploitation of genetic information that is not a direct sale, such as by posting genetic information on a commercial site supported by advertising revenues. These and numerous other issues are beyond the scope of this Article.

Today, in the health care setting, a genetic test intended to benefit the patient may be ordered only by a licensed physician with informed consent from the patient,²⁵⁵ the testing must be performed by a certified clinical laboratory,²⁵⁶ and the confidentiality of the results must be maintained in accordance with the HIPAA Privacy Rule.²⁵⁷ Should strangers be permitted to acquire an individual’s DNA sample on an inanimate object surreptitiously without any consent, arrange for an unregulated laboratory to perform genetic testing on the sample, and widely publish the results when the motivation is curiosity, commercial exploitation, or some other trivial, voyeuristic, or nefarious purpose?