Dataset Information

Genetic Privacy and Data Protection: A Review of Chinese Direct-to-Consumer Genetic Test Services.

ABSTRACT: Background:The existing literature has not examined how Chinese direct-to-consumer (DTC) genetic testing providers navigate the issues of informed consent, privacy, and data protection associated with testing services. This research aims to explore these questions by examining the relevant documents and messages published on websites of the Chinese DTC genetic test providers. Methods:Using Baidu.com, the most popular Chinese search engine, we compiled the websites of providers who offer genetic testing services and analyzed available documents related to informed consent, the terms of services, and the privacy policy. The analyses were guided by the following inquiries as they applied to each DTC provider: the methods available for purchasing testing products; the methods providers used to obtain informed consent; privacy issues and measures for protecting consumers' health information; the policy for third-party data sharing; consumers right to their data; and the liabilities in the event of a data breach. Results:68.7% of providers offer multiple channels for purchasing genetic testing products, and that social media has become a popular platform to promote testing services. Informed consent forms are not available on 94% of providers' websites and a privacy policy is only offered by 45.8% of DTC genetic testing providers. Thirty-nine providers stated that they used measures to protect consumers' information, of which, 29 providers have distinguished consumers' general personal information from their genetic information. In 33.7% of the cases examined, providers stated that with consumers' explicit permission, they could reuse and share the clients' information for non-commercial purposes. Twenty-three providers granted consumer rights to their health information, with the most frequently mentioned right being the consumers' right to decide how their data can be used by providers. Lastly, 21.7% of providers clearly stated their liabilities in the event of a data breach, placing more emphasis on the providers' exemption from any liability. Conclusions:Currently, the Chinese DTC genetic testing business is running in a regulatory vacuum, governed by self-regulation. The government should develop a comprehensive legal framework to regulate DTC genetic testing offerings. Regulatory improvements should be made based on periodical reviews of the supervisory strategy to meet the rapid development of the DTC genetic testing industry.

SUBMITTER: Du L

PROVIDER: S-EPMC7205185 | biostudies-literature | 2020

REPOSITORIES: biostudies-literature

ACCESS DATA

Publications

Genetic Privacy and Data Protection: A Review of Chinese Direct-to-Consumer Genetic Test Services.

Du Li L Wang Meng M

Frontiers in genetics 20200428

<h4>Background</h4>The existing literature has not examined how Chinese direct-to-consumer (DTC) genetic testing providers navigate the issues of informed consent, privacy, and data protection associated with testing services. This research aims to explore these questions by examining the relevant documents and messages published on websites of the Chinese DTC genetic test providers.<h4>Methods</h4>Using Baidu.com, the most popular Chinese search engine, we compiled the websites of providers who ...[more]

PMID: 32425986

Similar Datasets

Project description:Genomic data is increasingly collected by a wide array of organizations. As such, there is a growing demand to make summary information about such collections available more widely. However, over the past decade, a series of investigations have shown that attacks, rooted in statistical inference methods, can be applied to discern the presence of a known individual's DNA sequence in the pool of subjects. Recently, it was shown that the Beacon Project of the Global Alliance for Genomics and Health, a web service for querying about the presence (or absence) of a specific allele, was vulnerable. The Integrating Data for Analysis, Anonymization, and Sharing (iDASH) Center modeled a track in their third Privacy Protection Challenge on how to mitigate the Beacon vulnerability. We developed the winning solution for this track.This paper describes our computational method to optimize the tradeoff between the utility and the privacy of the Beacon service. We generalize the genomic data sharing problem beyond that which was introduced in the iDASH Challenge to be more representative of real world scenarios to allow for a more comprehensive evaluation. We then conduct a sensitivity analysis of our method with respect to several state-of-the-art methods using a dataset of 400,000 positions in Chromosome 10 for 500 individuals from Phase 3 of the 1000 Genomes Project. All methods are evaluated for utility, privacy and efficiency.Our method achieves better performance than all state-of-the-art methods, irrespective of how key factors (e.g., the allele frequency in the population, the size of the pool and utility weights) change from the original parameters of the problem. We further illustrate that it is possible for our method to exhibit subpar performance under special cases of allele query sequences. However, we show our method can be extended to address this issue when the query sequence is fixed and known a priori to the data custodian, so that they may plan stage their responses accordingly.This research shows that it is possible to thwart the attack on Beacon services, without substantially altering the utility of the system, using computational methods. The method we initially developed is limited by the design of the scenario and evaluation protocol for the iDASH Challenge; however, it can be improved by allowing the data custodian to act in a staged manner.

Project description:BackgroundThe online offer of commercial genetic tests, also called direct-to-consumer genetic tests (DTC-GTs), enables citizens to gain insight into their health and disease risk based on their genetic profiles. DTC-GT offers often consist of a combination of services or aspects, including advertisements, information, DNA analysis, and medical or lifestyle advice. The risks and benefits of DTC-GT services have been debated and studied extensively, but instruments that assess DTC-GT services and aid policy are lacking. This leads to uncertainty among policy makers, law enforcers, and regulators on how to ensure and balance both public safety and autonomy and about the responsibilities these 3 parties have toward the public.ObjectiveThis study aimed to develop a framework that outlines aspects of DTC-GTs that lead to policy issues and to help provide policy guidance regarding DTC-GT services.MethodsWe performed 3 steps: (1) an integrative literature review to identify risks and benefits of DTC-GT services for consumers and society in Embase and Medline (January 2014-June 2022), (2) structuring benefits and risks in different steps of the consumer journey, and (3) development of a checklist for policy guidance.ResultsPotential risks and benefits of DTC-GT services were mapped from 134 papers and structured into 6 phases. In summary, these phases were called the consumer journey: (1) exposure, (2) pretest information, (3) DNA analysis, (4) data management, (5) posttest information, and (6) individual and societal impact. The checklist for evaluation of DTC-GT services consisted of 8 themes, covering 38 items that may raise policy issues in DTC-GT services. The themes included the following aspects: general service content, validity and quality assurance, potential data and privacy risks, scientific evidence and robustness, and quality of the provided information.ConclusionsBoth the consumer journey and the checklist break the DTC-GT offer down into key aspects that may impact and compromise individual and public health, safety, and autonomy. This framework helps policy makers, regulators, and law enforcers develop methods to interpret, assess, and act in the DTC-GT service market.

Project description:BackgroundThe collection, storage, and analysis of large data sets are relevant in many sectors. Especially in the medical field, the processing of patient data promises great progress in personalized health care. However, it is strictly regulated, such as by the General Data Protection Regulation (GDPR). These regulations mandate strict data security and data protection and, thus, create major challenges for collecting and using large data sets. Technologies such as federated learning (FL), especially paired with differential privacy (DP) and secure multiparty computation (SMPC), aim to solve these challenges.ObjectiveThis scoping review aimed to summarize the current discussion on the legal questions and concerns related to FL systems in medical research. We were particularly interested in whether and to what extent FL applications and training processes are compliant with the GDPR data protection law and whether the use of the aforementioned privacy-enhancing technologies (DP and SMPC) affects this legal compliance. We placed special emphasis on the consequences for medical research and development.MethodsWe performed a scoping review according to the PRISMA-ScR (Preferred Reporting Items for Systematic Reviews and Meta-Analyses extension for Scoping Reviews). We reviewed articles on Beck-Online, SSRN, ScienceDirect, arXiv, and Google Scholar published in German or English between 2016 and 2022. We examined 4 questions: whether local and global models are "personal data" as per the GDPR; what the "roles" as defined by the GDPR of various parties in FL are; who controls the data at various stages of the training process; and how, if at all, the use of privacy-enhancing technologies affects these findings.ResultsWe identified and summarized the findings of 56 relevant publications on FL. Local and likely also global models constitute personal data according to the GDPR. FL strengthens data protection but is still vulnerable to a number of attacks and the possibility of data leakage. These concerns can be successfully addressed through the privacy-enhancing technologies SMPC and DP.ConclusionsCombining FL with SMPC and DP is necessary to fulfill the legal data protection requirements (GDPR) in medical research dealing with personal data. Even though some technical and legal challenges remain, for example, the possibility of successful attacks on the system, combining FL with SMPC and DP creates enough security to satisfy the legal requirements of the GDPR. This combination thereby provides an attractive technical solution for health institutions willing to collaborate without exposing their data to risk. From a legal perspective, the combination provides enough built-in security measures to satisfy data protection requirements, and from a technical perspective, the combination provides secure systems with comparable performance with centralized machine learning applications.

Dataset Information

Genetic Privacy and Data Protection: A Review of Chinese Direct-to-Consumer Genetic Test Services.

Publications

Genetic Privacy and Data Protection: A Review of Chinese Direct-to-Consumer Genetic Test Services.

Similar Datasets

OmicsDI is part of the ELIXIR infrastructure

Tweets