Popular DNA-testing companies build databases accessible by law enforcement, third-party companies

Popular genetic testing companies 23andMe and Ancestry.com are building databases that contain a lot more than information about your family tree, according to a USA Today report.

Law enforcement and, in some cases, third-party companies can access the databases, which hold detailed information about users’ medical histories and biological relationships, the report states.

“People don’t realize that unlike most medical tests where you find out information, it isn’t just about you,” Arthur Caplan, director of the Division of Medical Ethics at New York University's School of Medicine, told USA Today.

The issue hit home with the arrest of alleged Golden State Killer Joseph James DeAngelo,  a former police officer. He was arrested after DNA found at a crime scene was compared to genetic profiles from genealogical websites that collect DNA samples. The ex-cop is accused of 12 murders and at least 45 rapes.

In his case, investigators used GEDmatch, a Florida-based website that collects genetic profiles that people share publicly, according to reports. GEDmatch does not require a court order for access. The site also states "users participating in this site should expect that their information will be shared with other users."

Who can access the information?

Ancestry.com and 23andMe both told USA Today they don't release information to police without a court order.

Ancestry.com indicated that the company shares only member information if “compelled to by valid legal process."

A 23andMe spokesman said the company “has never given customer information to law enforcement officials.” The company also indicated it does not allow any third party to compare genetic data.

Does that mean the information on these sites is private? Not necessarily. The companies collecting DNA information are largely in control of any confidentiality measures.

And some of the companies resell information, Caplan said. Even when resold information is in a format that does not directly identify users, it is still possible to figure out a user’s identity, he added.

“We have the assumption that all of our medical information is private and yet the new world of genetics is in corporate hands,” Caplan said.

The ability of third parties, law enforcement, and others to access the data isn’t clear, Caplan said.

Do police need a warrant?

Privacy laws generally allow police to browse ancestry site databases, Steve Mercer, the chief attorney for the forensic division of the Maryland Office of the Public Defender, told USA Today.

“People who submit DNA for ancestors testing are unwittingly becoming genetic informants on their innocent family,” Mercer said. He added that the sites “have fewer privacy protections than convicted offenders whose DNA is contained in regulated databanks.”

In at least eight states, investigators can search databases to identify “likely relatives of suspected criminals.” Law enforcement officials believe the research can provide valuable leads. But critics call it a gross privacy violation.