Lawyer's warning over family tree DNA tests as Blackstone buys Ancestry for $4.7b

Home DNA tests have become a wildly popular way to help trace your family tree - but not everyone has stopped to think about the privacy implications. Image / 123rf

On the face of things, low-cost DNA testing kits make a great gift. You pay your US$99 ($151) to be sent a swab, your saliva is tested, then you get a breakdown of your ethnicity (Hah! I thought there was some Viking in there!) and a rough guide to the steps your ancestors took on their way to New Zealand.

But a lawyer who has previously warned people off such kits is doubling down on his advice on the back of Ancestry.com's pending sale to private equity giant Blackstone for US$4.7 billion. An exact timeline for the deal has not been made public.

The Utah-based Ancestry.com went online in 1996. It was founded by Mormons but has since gone through several changes of ownership. If the latest deal goes ahead, the US-based Blackstone will own 75 per cent and an existing shareholder, Singapore's sovereign wealth fund GIC, 25 per cent.

Ancestry.com (accessed by people in our part of the world via Ancestry.com.au) started as a genealogy service but branched out into DNA tests via its AncestryDNA service - the idea being you can plug your DNA test results into Ancestry's online family trees, the better to quickly find long-lost relatives.

AncestryDNA recently added an option to screen for hereditary conditions, in a bid to gain a point-of-difference with its main rival, the California-based 23andMe.

Ancestry's DNA tests have been popular. The company says it has processed around 18 million.

But Lowndes Jordan partner Rick Shera has previously said he won't be joining them.

And with overnight news of the Blackstone deal he tells the Herald he's now even more concerned.

"Having Ancestry bought by a private firm that will be looking to increase its annual revenue rate and then exit in a few years does little to inspire confidence that a long-term, privacy-protecting stance will be the focus," he says.

"And with DNA, protection must last at least a lifetime or more given that the data reveals private information through generations. This is particularly concerning in the US, where privacy and data protections are piecemeal at best."

Shera notes that your DNA is not like your credit card number. That is, you can't change it if it gets lost. And he notes that online data does have a habit of being lost, or hacked, or sent to the wrong address via human error, even when it's being safeguarded by big-name multinationals - as a string of high-profile ransomware attacks and data hijacks over the past six months has proved.

In his own case, Shera says he would only volunteer a DNA sample if it would address, for example, a pressing medical issue. He would not hand it over for a recreational service like Ancestry.

"With DNA, protection must last at least a lifetime or more given that the data reveals private information through generations," says Lowndes Jordan partner Rick Shera. Photo / Supplied

The Auckland intellectual property specialist's advice is to read the privacy policy of any DNA testing company before requesting one of those US$99 kits and sending off a sample - and keep an eagle eye out for any changes.

Most do provide safeguards - although there can often be complications.

23andMe spokesman Andy Kill told the Herald his company's terms and conditions allow a user to request their saliva sample be destroyed and/or their DNA data deleted - unless they have previously consented for it to be supplied to a third party for research (a check box that's easy to tick, given there's a feelgood factor - you could be helping to contribute to medical breakthroughs).

The 23andme site promotes these protections for people who live in European countries governed by the EU's tough General Data Protection Regulation (GDPR) rules, but Kill says, "All customers, regardless of location, have the option to download their data and close their account at any time." All associated personal information is deleted and any stored samples are discarded, unless you have already consented for your data to be shared with a third party.

Similarly, Ancestry.com has provision for your sample and data to be deleted - but deleting your DNA will undermine your experience on its family tree service, it warns. And the company also warns that if you've previously taken the option to share your results with another user (an easy way to jump-start both of your ancestor-search efforts) then the barn door is shut on the delete option. Sharing data with third parties is opt-in - unless a law enforcement agency and a warrant is involved (and remember you don't have to necessarily rob a bank; a custody dispute where the courts are involved could potentially see an order).

Lastly, if you're still mulling a family tree DNA test, wait until after December 1 - that's when New Zealand's new Privacy Act comes into force, which gives the Privacy Commissioner more powers for dealing with offshore companies that do business with New Zealanders.

Blackstone did not immediately return a request for comment.

Family-tree DNA testing tips

• Check the company's privacy policy

• Check if there is the option to have your saliva sample and/or DNA data deleted from the tester's database at a later date

• Check if the testing company requires your consent before sharing or selling your DNA data

• Wait until Dec 1, when new privacy protections for NZers doing business with overseas companies come into force.