Genomic privacy? Direct-to-consumer genetic testing companies and the processing of sensitive personal data

This paper explores the processing of sensitive personal data for genealogical purposes by studying how the privacy policies of three direct-to-consumer genetic testing companies relate to the general Data Protection Regulation (GDPR). The methodological approach is content analysis. The privacy policies are analysed in relation to the three core principles of 1) adherence to GDPR; 2) transparent processing of personal data; and 3) consent. The paper also discusses privacy in relation to third parties whose sensitive personal data is processed indirectly due to the nature of DNA as shared between family members. The main result is that the privacy policies rarely mention GDPR; when mentioned it is done in a brief way; the privacy policies studied convey insufficient transparency as regards data processing; and genetic relatives of users are not taken into consideration even though their personal data is being processed indirectly.