By Valerie Gutmann Koch
23andMe announced its $300 million partnership with GlaxoSmithKline late last month, a move that will allow the drug behemoth to develop drugs based on “deidentified” DNA and other information collected from the direct-to-consumer (DTC) genetic testing company’s five million customers.
Over the last decade, 23andMe has confronted – and survived – various challenges and existential threats to its existence. However, this announcement, while representing an incredible success for 23andMe’s business, presents potential obstacles for informed consent and the research enterprise.
It may also undermine public trust in the company.
Since the introduction of DTC genetic testing services, it has been recognized that such testing might provide growing opportunities to use extensive genetic data and family medical history for research purposes. DTC genetic testing companies like 23andMe have spent years amassing large collections of genetic data. In essence, the customers pay for services that enable the companies to collect, store, and conduct research utilizing their DNA.
In other words, 23andMe’s business model is based not on the services it provides to its customer base – the provision and interpretation of genetic testing results – but on sharing or selling the vast amounts of information and data that it collects to research institutions and pharmaceutical companies. And while 23andMe (and similar companies) herald a novel and primary role for participants of human subjects research through the “democratization of research” and the collaborative nature of “patient-driven research,” it is clear that customers will not share in the profits of 23andMe and its partners.
Endeavors such as 23andMe’s could produce a number of transformations in the model for clinical research, resulting in the advancement of research across entire populations as well as for precision medicine. A partnership like the one between 23andMe and GSK promises diminished recruitment and enrollment problems due to easy access to databases of personal, genetic, and health-related information. It may also facilitate simplified reproduction of clinical research, thereby reducing doubts about the validity of the results and uncertainty about conclusions.
According to reports, 80 percent of 23andMe’s customers have consented to share their deidentified genetic and phenotypic information for research. While the company promises that customers can opt out of research by closing their 23andMe account, “any research involving your data that has already been performed or published prior to our receipt of your request will not be reversed, undone, or withdrawn.”
Studies of DTC genetic testing companies’ approach to informed consent in research generally have concluded that “the consent procedure currently used is ethically inadequate.” DTC genetic testing companies have ever-changing and sometimes conflicting methods of obtaining consent, ranging from study-specific consent to broad consent.
Importantly, these companies may not be in the best position to protect the needs, desires, and rights of customers who participate in their clinical research initiatives. They may blur the line between what is considered “recreational” and “clinical,” and individuals may not be fully informed of the risks and benefits of participating in research advanced by DTC genetic testing companies.
The apparent de-medicalization of health information and analysis into a form of social entertainment has raised serious questions about informed consent. This lack of clarity regarding uses of one’s genetic (and other) information implicates an individual’s agency. Just because an individual shares his or her biospecimens or information for recreational purposes may not demonstrate a desire or intent to participate in research.
Although the mechanisms to consent to research have evolved since I first wrote about this issue in 2012, many may still not understand that they “are paying for the privilege of 23andMe working with a for-profit company in a for-profit research project.” Additionally, customers may be misled regarding the collaborative nature of the research and ownership of data, information, and discoveries.
The legal and regulatory system that currently exists to protect human subjects in research may be inadequate to address participants in social networking-based genetic research. In 2012, I concluded that whether research arising from DTC genetic testing companies is subject to the Common Rule – the set of regulations that govern the majority of research involving human subjects in the United States – remained unsettled.
And the 2017 revisions to the Common Rule may not adequately protect individuals who use DTC genetic testing services and whose information and biospecimens are used in future research protocols. Despite extended efforts to revise the Common Rule to address the use of biospecimens in human subjects research, there is little in the revised Rule to direct or guide DTC genetic testing companies to ensure a more robust informed consent process for the use of customers’ biospecimens and data.
The final (to presumably be implemented in 2019) Common Rule likely helps clarify the scope and extent to which the federal regulations apply to research conducted by DTC genetic testing companies. It also enables these DTC genetic testing companies to more easily perform secondary research utilizing customers’ biospecimens and data while doing little to regulate or guide these companies in conducting ethical research or protecting participant autonomy.
In many ways, the final Rule permits companies to continue to market themselves as proponents of the “democratization of research,” despite doing little to shift research from a single-direction endeavor to a collaborative process shared by participants and researchers (for more on the implications of the revised Common Rule on research arising from DTC genetic testing, see my forthcoming article, “Research Revolution or the Status Quo?: The New Common Rule and Research Arising from Direct-to-Consumer Genetic Testing” in the Houston Law Review).
In the wake of 23andMe and GSK’s announcement, a number of companies that offer DTC genetic testing services revealed that they had agreed on a set of voluntary guidelines intended to protect customer privacy by sharing only genetic data from those who have given their “separate express consent.” These guidelines are intended to address not just questions of future research involving third parties, but also the use of these databases for forensic purposes.
Notably, these guidelines will not apply to research involving anonymized data or biospecimens, nor would they impose any more stringent requirements in the case of 23andMe and GSK’s partnership. Of course, the guidelines are non-binding, and so it remains to be seen whether this effort at self-regulation renders more robust oversight unnecessary.
As a rule, DTC genetic testing companies should disclose more information about their research practices in their informed consent forms in order to properly respect individuals’ autonomous decision-making and ensure the public trust in the research enterprise.