Genomics is a relatively recent branch of scientific study. It focuses on the interplay of genes with each other and their environments and how these can impact our traits and characteristics. Genomics offers an opportunity to radically advance our understanding, diagnosis, support and treatment of a variety of illnesses and conditions.
The UK government has identified genomic information and uses such as polygenic risk scoring 1 as one of the critical areas that can contribute to the UK becoming a technological superpower. Specifically, the government are focused on a drive to deliver a genomic-focused healthcare system. 2 Building on over 70 years of developing research, the increased pace of genomic analysis offers opportunities and risks not just for healthcare, but other diverse sectors such as education and insurance.
Government interest is mirrored by private sector interest. While there is significant overlap between genetics and genomics, we feel that the public should be aware of the importance of genomic data and its potential impact on privacy and data protection, both positive and negative. This will be key to developing public trust in the appropriate use of genomic information, initially for healthcare. It will also make people aware of the potential risks and harms of using direct-to-consumer genomic testing and public sharing of genomic data.
The analysis in this report aims to support our ability to protect people, provide clarity for businesses and enable privacy-positive innovation. It is aimed at:
- organisations and people considering the policy intersections of privacy and genomic data; and
- organisations seeking to deploy new or innovative forms of processing based on genomic data.
This report explores plausible scenarios, developed through stakeholder engagement and research, and use cases for emerging genomic technologies and solutions to increase understanding of possible future uses of genomic information. These cases illustrate potential deployments across sectors including health, education, insurance and law enforcement. While they do not offer examples of ethical use or best practice regarding privacy, the scenarios raise key issues about gathering and using genomic data. We examine these to better understand critical challenges around emerging genomic uses, techniques and privacy.
We intend to address these issues through continuing proactive work with stakeholders and the public, as well as further cross-regulatory work. We are asking for views from interested organisations at the end of this report and in the longer term we are also aiming to create guidance.
Why genomics?
Using genomic information can offer significant benefits and opportunities for people and organisations. They can offer, among other things:
- upstream treatment for medical conditions as varied as cancer and Covid 19; and
- targeted and predictive insights into potential health issues and even behavioural traits such as educational or sporting attainment.
Alongside these opportunities for innovation, we also recognise the scope for future potential harm and the risks to data rights and privacy.
As well as the drive to develop UK research and treatment capabilities, this rapid development of genomics technologies is driven by a series of opportunities:
- The development of sequencing technologies and genotyping arrays allowing for cheap and rapid measurement of genetic variation across a genome. 3
- Increased accessibility of AI and algorithmic processing of complex data sets that allows for quicker analysis.
- Increased interest in preventive healthcare as a means of delivering rapid and effective treatment.
- A lack of specific regulation in non-health related sectors including direct-to-consumer services.
- A critical mass of genomic information for researchers to investigate.
- A significant increase in both national and global funding.
One of these drivers, the use of AI, indicates an overlap with an area that is already important to us. While we consider novel and heightened risks around this area within this report, you can find specific AI reports and guidance on our website.
While innovations can offer opportunities and challenge the status quo, they can also present new issues and risks that undermine their promised progress. Unexpected sharing of purportedly medical genomic information with insurance companies by organisations such as UK Biobank has raised public concerns about security, transparency and fairness. 4 It is important that we consider both the potential benefits and harms of these evolving approaches, so we can respond in a timely and proactive manner.
Processing genomic data poses a significant and specific risk to people’s information rights in several ways:
- Its intrinsic nature. You cannot change your DNA or how it links to your phenotypes (a person’s observable traits). This means that if this genomic data was lost, stolen or inappropriately used, you could not simply replace or vary it. 5
- Its links to multiple people. Genomic data will relate to relatives of a person, posing risks and challenges as to how and when this information can be shared and processed.
- Its potential for leading to someone making inaccurate or inappropriate inferences, or both, about people. For example, making an incorrect inference about a person’s heritage, characteristics or health. When genomic information is processed in conjunction with AI-based processing and automated decision making, it may be further impacted by an underlying and inappropriate systemic bias.
There are already several significant analyses of emerging uses of genomic technologies and genomic data. These include reports by the Government Office of Science and the Ada Lovelace Institute. These reports provide excellent overview on scientific context, potential future uses of genomic information and key aspects such as algorithmic processing of this information. What this report provides is a specific focus on the issues and opportunities arising around privacy and data protection.
In addition to briefly examining the legal and regulatory context in Annex C, we also consider emerging market indicators about genomic technologies, such as funding and patents. Understanding the broader market is important in assessing which sectors are likely to see markets develop first and what issues may emerge.
At a national level, there is clear evidence that the UK private sector is investing in genomic technology, with as many as 142 companies focusing on this sector. 6 On a global scale, investment in genomic analysis and the creation of related patents continues to increase significantly. You can find further details about this in Annex B. This growth reflects the potential to develop and deploy genomic-centric approaches in regions where data protection regimes differ significantly from the UK GDPR. In certain cases, use of these approaches may not adhere to the expectations we have for fairness and transparency in the way they use personal information. In turn, this may pose significant challenges if these uses become common in the UK or are used by those with data rights under the UK GDPR. Nonetheless, if companies based overseas do offer their services to people who are based in the UK, through a website for example, they will still fall within the geographical scope of the UK GDPR under Article 3(2)(a).
Following the COVID-19 pandemic, there has been an increased drive to gather and share genomic data via global biobanks. 7 Ostensibly sharing information for medical research purposes, this is not always the case. The growing size and complexity of the information sets mean that potential commercial uses of information are becoming possible. 8 A significant section of these commercial interests are represented by direct-to-consumer services, commonly offering ancestry or genealogical analyses or, increasingly, SNP (single-nucleotide polymorphism) based analysis of common traits about lifestyle and wellbeing. 9
1 A glossary of key terminology can be found in Annex A.
2 Genome UK: 2022 to 2025 implementation plan for England
3 The road to genome-wide association studies
4 Private UK health data donated for medical research shared with insurance companies
5 This also links to broader issues regarding freedom of expression and a right to privacy, as an individual cannot reasonably be expected to conceal their face or gait as they might with a password or pin number. See R (Bridges) v CC South Wales for further details.
6 See Annex B for a further economic exploration of this area.
7 Global Biobank Meta-analysis Initiative