Hello everyone. In this video, I’ll be presenting the paper “I’m hoping they’re an ethical
company that won’t do anything that I’ll regret”: Users’ Perceptions of At-home
DNA Testing Companies. This research was completed as part of my undergraduate thesis at Carleton
University, under the supervision of Dr. Sonia Chiasson. Reham Mohamed and Anna Theus have
also coauthored this work.
There has been a recent increase in the popularity of at-home DNA tests: the amount of people
that purchased these DNA tests in 2018 was the same as all previous years combined.
Private DNA testing services are cheap, convenient,
and directly reach the consumer. Many of these companies provide the consumer
with either ancestry information, health information, or both.
Users may take these DNA tests for a variety of reasons, including their potential health
benefits, to aid in genealogy research, to make connections with biological relatives,
or simply out of curiosity.
However, doing an at-home DNA test comes with many privacy risks.
DNA, by nature, is inherently identifiable: any related consequences would be irreversible.
Nothing is truly anonymous either; researchers have been able to re-identify anonymous samples,
using public databases. Privacy policies of direct-to-consumer testing
companies do not adequately detail how the data is handled, and often share their databases
with third parties. These risks to privacy are also networked.
They affect not only the consumer, but anyone, alive or deceased, who shares their DNA.
Finally, users may inadvertently share this data online, potentially exposing it to unsolicited
third parties, like an employer.
Previous research has looked at the reasons why users completed at-home DNA tests, but
there is a lack of qualitative research on user perceptions.
Given the privacy risks, it is necessary to understand users’ mental models of how the
process works, how they perceive their data, what they desire, and whether they have any
regrets. To address this gap in the literature, we
conducted a qualitative study with participants in Canada who have completed at-home DNA testing.
Potential participants were asked to complete a screener questionnaire to assess their eligibility.
If eligible, participants scheduled and completed a 60-minute study session either in-person
or online. During the session, participants completed
a short questionnaire, followed by an interview.
27 participants took part in our study, and were
compensated 15 Canadian dollars for their time.
The studies provided us with 15 hours of audio which we transcribed.
We then conducted thematic
analysis on the data, with 2 researchers involved
throughout the coding process.
Now that we’ve discussed our study protocol, we move towards our results.
We found that users perceived many benefits to this service.
Many believed their data could be used for the greater good
by aiding law enforcement in their investigations,
or for the general advancement of science.
Most also acknowledged these tests’ abilities to potentially reunite or connect biological
family. Users who had completed multiple tests
had usually done so for a personal goal, like making connections, building ancestry trees
for genealogy research, or to further increase an understanding of their personal ancestral
history.
Users also identified several risks associated with their data.
Most commonly, users acknowledged that their DNA could implicate a criminal who shared
their DNA. Some were concerned about being wrongfully implicated in this process.
Many also felt that the data might be used mostly for profit.
Users were also concerned about law-enforcement, or the government, potentially accessing their
data for surveillance. More generally though, users worried about their
data being misused by third parties or for something unethical, like discrimination.
We observed users to have different levels of trust for different entities.
Feelings towards private DNA testing companies themselves were mixed.
Many users implied that an implicit sort of trust was necessary, saying: “I think there
has to be a level of trust when you are using a service such as this”.
Others expressed cynicism about company policies, as one participant articulates: “you don’t
know who’s looking at your data... you don’t know who they are… you’ve never seen them”.
In addition, users expressed varying levels of trust towards different countries, and
certain third parties. Many participants expressed a feeling of security
based on their physical location. Additionally, participants viewed academic
and other non-profit institutions positively, while being mistrustful of law enforcement
and the government.
It was also seen that participants were more comfortable with certain forms of sharing
than others. Almost all participants shared their results
with family and friends. Very few had otherwise posted on Social Networking Sites, although
those actively involved in genealogy work were more
likely to do so.
As reflected in the previous slides, participants were usually comfortable sharing for purposes
that they felt would benefit humanity. However, they were less inclined to share
their data with law enforcement and the government, even while sometimes acknowledging the potential
benefits. A participant explains: “I wouldn’t want my DNA to be in it, but... I would want
yours to be in it... like, other persons'. I feel like it could help in their investigation...
but... I would feel like I’m being watched all the time”.
We also asked participants about their perceptions of data storage, data access, data deletion, and control.
A general theme of uncertainty is prevalent throughout this section.
For this presentation, we will focus mainly on user perceptions of control and deletion.
Users broadly believed that they either did, or didn't, have control over their data.
Those who felt that they didn’t believed that the company that the most control
and possibly some third parties as well. In contrast, those who thought that they were
in control of their data usually did so because they believed they could delete their DNA data
in its entirety. All participants, however, expressed a desire for transparency and control over their data,
although the desired level of control differed amongst participants.
Some users felt complete deletion of their information to be impossible, and, as such,
futile. At most, some believed that deleting their data would only remove the link between
their data and the account, or remove personally identifiable information linked with them,
like their email address. A portion of users liked seeing their results
being updated, and so would only delete their account if they found something highly unethical
to be occurring, or if highly unsatisfied with the results.
It was also expressed by a participant that they would be more trusting of companies that
completely deleted their data; that would be reassuring for them.
A few participants took precautions to maintain their privacy to the best of their ability.
The most common precaution was to do detailed research on different companies, and
make an informed choice. Some participants used fake information to
remain anonymous. This would also potentially protect them from
the negative repercussions of a data breach. In addition, some users deliberately set
their accounts to private.
A last resort mentioned by participants,
should something go awry, would be to delete their accounts. Triggers for this could include
a data breach, bad press, or knowledge of their data being used unethically.
Interestingly, these privacy conscious choices are often pushed aside if they are in the
way of achieving a goal. The potential benefits of testing with a company
that users distrust ultimately seem to outweigh any privacy concerns.
We found 4 prevailing attitudes towards risk and privacy.
Some users have had to decide between what they perceived to be life-altering health
information and their privacy. Many also believed they no longer had a right
to this privacy after agreeing to provide their DNA for testing, despite potentially not knowing
what they agreed to. Most participants did not read through the terms and conditions,
nor did they read updates to their privacy policy.
Several users also did not consider their DNA data
to be sensitive information and so had no
idea how their data could be used to affect them negatively. This feeling was usually compounded
if they perceived themselves to be less of a target, which many did - either because of their
good health, or lack of criminal status.
Participants who perceived to have high control over their data, or who had
done multiple tests, were generally more dismissive of other people’s concerns. Those unwilling
to do a test may be considered paranoid, and these participants may feel annoyance
when seeing private user profiles online.
With respect to regrets, some participants wished that they had better understood the
terms and conditions involved with completing an at-home DNA test.
Others wish that they had done better research on what to expect from their specific kit.
For example, the kinds
of results to expect, included features, and the accuracy of these results.
However, privacy was not a main concern. Very few expressed regret at the idea of somebody
having access to their data without their consent.
Almost all participants stated that they still would have taken the DNA test for the sake
of their ultimate goal or to satisfy their curiosity.
In our study, we found there to be three privacy-related mental models.
Users were either uncertain about the process, felt powerless over the processing of their
data, or were completely unconcerned.
The consequences associated with at-home DNA testing were also generally underestimated.
For example, direct-to-consumer DNA websites can be exploited to identify and impersonate
users’ relatives, including those who have not taken a test. Privacy laws to protect
genetic information also vary by country, and may be inadequate.
In addition, users' perception of security is influenced by their knowledge of the consequences,
and so, they would not be concerned if they were unaware of anything negative occurring
in the first place.
The most common desire expressed by users
was for companies to be completely transparent and use user-friendly language in their policies.
Users should also have the option to choose their preferred level of control.
Our results highlight the need for research into stronger, more stable policy, and for
better transparency and data control practices for individuals. In addition, research must
be done to address how to protect genetic relatives of consumers from related disclosure.
It would also be relevant to further explore users’ understanding of the legal protections
surrounding DNA data, particularly internationally.
Thank you for listening. Please feel free to contact me with any questions.