DIRECT-TO-CONSUMER GENETIC TESTING: EMPOWERING EU CONSUMERS AND GIVING MEANING TO THE INFORMED CONSENT PROCESS WITHIN THE IVDR AND GDPR FRAMEWORKS. (In Vitro Diagnostic Regulation, European General Data Protection Regulation)

• Published date: 01 January 2020
• Author: Mahmoud-Davis, Sara A.
• Date: 01 January 2020

LIST OF ABBREVIATIONS

CJEU Court of Justice of the European Union
                DPO Data Protection Officer
                DoH Declaration of Helsinki
                DSM Digital Single Market
                DNA Deoxyribonucleic Acid
                DTC Direct-to-Consumer
                DTCGT Direct-to-Consumer Genetic Testting
                ENVI Environment, Public Health, Food and Safety
                ECtHR European Court of Human Rights
                EU European Union
                ESHG European Society of Human Genetics
                FDA United States' Food and Drug Adminiistration
                GDPR General Data Protection Regulation
                GSK GlaxoSmithKline
                HGP Human Genome Project
                ICO Informed Consent Officer
                IVDD In Vitro Medical Devices Directive
                IVDR In Vitro Diagnostice Medical Devices Regulation
                MDCG Medical Device Coordination Group
                SDM Shared Decision-Making
                TFEU Treaty on the Functioning of the European Union
                U.S. United States of America
                WMA World Medical Association
                

I. INTRODUCTION 6
                II. OVERVIEW OF DIRECT-TO-CONSUMER (DTC) GENETIC TESTING
                COMPANIES AND ONLINES SALES IN THE EU 8
                III. ANALYSIS OF EU LEGISLATION: THE DEBATE SURROUNDING
                GENETIC TESTING, GENETIC COUNSELING AND INFORMED
                CONSENT 13
                IV. THE IVDR'S SCOPE AND IMPACT RELATED TO
                GENETIC TESTING 19
                V. THE GDPR AND LESSONS LEARNED FROM THE IVDR: THE
                STATUS OF INFORMED CONSENT IN THE DATA PRIVACY
                REGULATION 25
                VI. WHY EU CONSUMERS OF DTC GENETIC TESTS SHOULD BE
                CONCERNED ABOUT THE GDPR'S LACK OF INFORMED CONSENT
                GUIDELINES 28
                VII. THE PRINCIPLE OF AUTONOMY: ITS SIGNIFICANCE IN
                EMPOWERING AND PROTTECTING CONSUMERS OF DTC
                GENETICS TESTS 37
                VIII. MOBILIZING INDUSTRY TO STRENGTHEN INFORMED
                CONSENT 40
                IX. Recommendations for Reforming Online Informed Consent 44
                 A. Recommendation 1--Improve Online Communication 44
                 B. Recommendation 2--Offer Pre-Test Genetic Counseling 46
                 C. Recommendation 3--Build Corporate Responsibility in a Digital
                 Age 50
                X. CONCLUSION 51
                

I. INTRODUCTION

Being European means the right to have your personal data protected by
                strong, European laws. Because Europeans do not like drones overhead
                recording their every move, or companies stockpiling their every mouse
                click. This is why Parliament, Council and Commission agreed...this
                year [to] a common European data protection regulation. This is a
                strong European law that applies to companies wherever they are based
                and whenever they arc processing your data. Because in Europe, privacy
                matters. This is a question of human dignity. (1)
                President of the European Commission Jean-Claude Juncker
                

President Juncker's speech references the General Data Protection Regulation (GDPR). (2) In April 2016, the European Union (EU or Union) enacted the GDPR with the goal of protecting EU residents with respect to the processing of their personal data. (3) The regulation went into direct effect throughout the EU on May 25, 2018, and is far-reaching, affecting anyone who processes the personal data of natural persons located within the EU, regardless of their nationality or place of residence. (4) It is a "strong European law" (5) because it applies to U.S. and other foreign companies that do business in the EU, notably capturing those businesses that conduct operations solely through e-commerce without having a brick-and-mortar place of business within the Union.

In that same State of the EU speech, Commission President Juncker underscored that people's lives and the economy depend on digital technology, and he emphasized the need to create a "Europe that empowers [its] citizens and [its] economy" in this digital age. (6) The GDPR is a primary component of the EU Data protection framework and also of the EU's Digital Single Market (DSM) initiative. The DSM works to ensure the free movement of persons, services and capital, and where individuals and businesses can "seamlessly access and engage in online activities under conditions of fair competition, and a high level of consumer and personal data protection, irrespective of their nationality or place of residence." (7) The GDPR offers EU residents the opportunity and legal mandate to gain greater control over their data, especially over the proliferation of personal data that is available online.

It has been more than a year since the GDPR came into force. This article discusses the GDPR in the context of online Direct-to-Consumer (DTC) genetic tests sold to consumers within the EU. Typically, DTC genetic tests, including test results and interpretations, are sold directly to the consumer without the involvement of a healthcare provider. (8) This common definition of DTC genetic tests is used throughout the article.

The GDPR specifically addresses genetic data, but only within the limited context of data processing and the protection of sensitive information. Yet, as the discussion illustrates, the online DTC genetic testing industry faces the challenge of protecting consumers on two fronts--informed consent and data privacy. These two issues are inextricably linked for consumers purchasing online genetic tests.

Given the growing trend towards DTC genetic testing and the scientific research derived from consumers' participation, there is an increasing need for more robust online informed consent that adequately protects and empowers the consumer.

This analysis begins with the recent EU Regulation on In Vitro Diagnostic Medical Devices (IVDR). The evolution of the IVDR demonstrates the EU's authority and willingness, if any, to impose informed consent requirements on genetic testing. This article discusses how, if at all, the IVDR and GDPR empower and protect EU consumers who directly purchase the online services of DTC genetic testing companies. Additionally, the analysis focuses on the dual challenge of empowering and protecting consumers of DTC genetic tests and makes recommendations to improve the online informed consent process.

II. OVERVIEW OF DIRECT-TO-CONSUMER (DTC) GENETIC TESTING COMPANIES AND ONLINES SALES IN THE EU

In June 2019, Top10.com listed the five following deoxyribonucleic acid (DNA) testing companies as the best of 2019: MyHeritage, LivingDNA, AncestryDNA, 23andMe and Vitagene. (9) PCWorld also ranked the best DNA kits by category, citing 23andMe as the best DNA kit overall for its comprehensive coverage of ancestry and genetic health information. (10) AncestryDNA ranked in second place mainly due to it having the largest DNA database with tests from more than 10 million people and regular updates made to its ethnicity estimates. (11) MyHeritage ranked as the most affordable testing service, but it has only 1.5 million people in its database and a greater percentage of them located in Europe. Family Tree DNA, the oldest U.S.-based DNA testing company, ranked as the best for privacy protections. However, the company faced a significant privacy scandal in early 2019. Despite an earlier proclamation from Family Tree DNA founder and president Bennett Greenspan stating, "We don't believe [user data] should be sold, traded, or bartered," (12) the company acknowledged in February 2019 that it had failed to disclose its sharing of genetic information with the Federal Bureau of Investigation to help solve violent crimes. (13) Still, unlike most of the DTC genetic testing companies, such as 23andMe and AncestryDNA, Family Tree DNA does not ask consumers to consent to agreements that may result in companies and researchers acquiring their data.

23andMe has been at the center of several debates about the ethics of for-profit DTC genetic tests. For example, between 2007 and 2012, the company enticed consumers and research participants by offering genetic tests at low prices (e.g., starting at $299 and now lowered to $99) and even free saliva collection kits in return for saliva samples. The company also launched the "23andWe" project in 2008, asking consumers to collaborate with the company in prioritizing its disease research efforts. Participants voted on a list of diseases, and the company developed numerous surveys for participants to share their personal health, lifestyle and other information with the company. (14) In fact, the 23andMeBlog described the project's goal as to "help bring the dream of personalized medicine a few steps closer to reality." (15) At the same time, it pleaded, "all we need you to do is take some surveys." (16) By 2012, the information derived from the 23andWe project led to a "patent for a method of determining predisposition to Parkinson['s] disease." (17) Many consumers and research participants felt betrayed when they learned that 23andMe had secured a patent based on their genetic and personal data.

As New York University Professor Charles Seife said in 2013, the "[p]ersonal genome service... is a mechanism meant to be a front end for a massive information-gathering operation against an unwitting public." (18) While there is truth in his statement, the company 23andMe has not hidden its agenda. Patrick Chung, a 23andMe board member, acknowledged, in a 2013 interview:

The long game here is not to make money selling kits, although the kits
                are essential to get the base level data... Once you have the data
                [23andMe] docs actually become the Google of personalized health care
                (19)
                

A recent study predicts that the DTC genetic testing market will exceed 2.5 billion U.S. dollars by the year 2025. (20) The same study assesses the main factor to drive industry growth will be the increasing demand for "service personalization in developed regions" such as North America and Europe. (21) As of March 2020, 23andMe's Europe website ships both ancestry and health tests to only five EU countries--Denmark, Finland, Ireland, Sweden, and the Netherlands. However, the company's international website ships ancestry tests to the remaining twenty-two EU countries. Even though the company currently does not sell health tests to all EU countries, citing shipping restrictions "due to the applicable regulations," (22) it still asks consumers who order only ancestry tests from the international website to participate in research. (23) The company encourages consumers to participate in research...