DNA testing has myriad potential benefits. It can tell you what your cancer risks may be or help you find your relatives. However, this sensitive medical information might not always be adequately protected after you test.

Within medical settings, DNA testing is a growing factor in many specialties. Caroline Aragón is a genetic counselor at the University of Minnesota. She told me over email that, while DNA testing is most prevalently used in general and pediatric genetics, hereditary cancer and reproductive clinics, its use is expanding into many other areas as well while testing technologies and interpretation of results improve.

Individuals that use DNA tests are often concerned their genetic information won’t be kept private or could be used against them in some way.

This is a rational fear that can often accompany new technologies that collect and store personal information. Companies like 23 and Me, who provide what is called “direct-to-consumer” genetic testing, have tried to be proactive at assuaging these fears. Their privacy policy states that your DNA information will only be used for purposes that you consent to and will only be shared where you want it to be.

However, consistent privacy and communication policies are not necessarily in place everywhere your DNA information could end up.

A woman in California sued San Francisco Police because her DNA, which had been collected in a rape kit in 2016, was used to arrest her for several burglary offenses in 2021, CNN reported.

She argued that because her DNA was collected when she was the victim of a crime, the use of this information to arrest her for an unrelated crime was an example of unlawful search and seizure and therefore violated her civil rights.

As if rape victims need any more reasons to be hesitant about seeking medical care or reporting the crime.

The San Francisco Police has a policy of adding DNA collected from crime victims into a permanent database that can be searched when trying to identify suspects of crimes later on, CNN reported.

From fingerprints to DNA

Before DNA testing, fingerprints were the “gold standard” for differentiating between individuals that may or may not have been at a crime scene, and fingerprints are still used widely today.

“Fingerprints and DNA data are similar in that they can consist of a pattern unique to you,” Aragón said.

However, she cautioned that the risk of using DNA instead of prints may be higher. “The possibility for errors or wrongfully identifying a DNA match may be greater than when using fingerprints, due to the high level of similarity in the genetic code between individuals, particularly when closely related,” she said.

Aragón also sees the potential for privacy issues with using DNA in criminal investigations. “Because DNA information reveals much more about an individual than a single fingerprint, the possibility for infringing upon privacy rights in these settings seems much greater,” she said.

The case from San Francisco is not the only example of the criminal justice system overstepping ethical boundaries by using dubiously sourced DNA information to catch criminals.

Also in California, blood samples taken from newborn babies as part of newborn screening practices have been used by law enforcement to identify relatives as suspects in crimes, WIRED reported. In one case, a baby’s DNA was used to identify its father as a suspect of a crime.

In these cases, the babies are not even in the criminal justice system when their DNA information is acquired by law enforcement.

Newborn screening can help identify if a child has a serious medical issue following birth and ensure they get timely care. However, the case represents a “whole new leap forward” in the misuse of DNA by law enforcement, Technology Fellow at the American Civil Liberties Union Crystal Grant told WIRED.

“It means that essentially every baby born in the U.S. could be included in police surveillance,” she said.

In the age of patient-centered medical decision-making, how is it possible that we continue to see stories of patients—including victims of rape—having their private medical information shared with the government without their full understanding and consent?

It appears the government has decided that the personal privacy of patients or victims is ranked below that of solving even relatively minor criminal infractions.

If your state has a DNA registry like California’s, is HIPAA out the window?

Aragón noted there is a possibility of reaching a legal compromise in which the rights of the people could be respected while allowing for the use of DNA information in “last resort” circumstances.

She said this type of evidence could be used “if appropriate procedures and respect for privacy rights are followed.”

She cautioned that laws surrounding the use of DNA information should consider “to what extent DNA information may actually be helpful in leading to solving a case.”

Aragón emphasized that in any case involving the use of such private information as DNA, informed consent and proper restrictions are critical to protecting the rights of the individual.

The Declaration of Independence asserts that in order to preserve the unalienable rights of people, governments are instituted by the people “deriving their just powers from the consent of the governed.”

“Consent of the governed” is the operative phrase here. When state institutions lift DNA information from patients without permission, they are not only disregarding this principle of consent but also violating patients’ civil rights.

A crime victim has obviously had their rights violated. Violating the rights of someone else to make up for this is not justifiable. Two wrongs do not make a right.

It appears the current legal landscape surrounding DNA information is not informed by the principle of consent of the governed.

Would you like Allison to follow up on this topic or explore something specific? Contact her at [email protected] with questions, comments or story ideas.