Genetic Privacy and Incidental Findings

Why genetic data is different

Genetic data is personal, shared with relatives and permanent. NHGRI notes that, with the exception of identical twins, each person's DNA sequence is unique, so a DNA sample can never be truly anonymized. [1] This page summarizes what research and official sources say. It is information only, not legal or medical advice. Laws change, and each statement below names its country or region and source, all read 2026-10-22. For a broader legal overview, see genetic privacy law overview.

Re-identification: how "de-identified" data can be traced

In a 2013 study, researchers showed that surnames can be recovered from personal genomes by profiling short tandem repeats on the Y chromosome and querying public genealogy databases. Combined with age and state, this helped identify participants in public sequencing projects. [2] In a 2018 analysis of 1.28 million consumer-genomics records, the authors projected that about 60% of searches for people of European descent would produce a third-cousin or closer match, which theoretically allows identification with demographic information. [3] The result is that when you share your DNA, you may also expose relatives who never agreed. NHGRI notes that NIH controls access to sensitive genomic databases for this reason. [1]

US: what GINA covers

The Genetic Information Nondiscrimination Act (GINA) of 2008 protects against discrimination based on genetic information in health insurance (Title I) and employment (Title II). [4] Health insurers may not use genetic information to determine eligibility for insurance or to make coverage, underwriting or premium-setting decisions. [4] Under Title II, it is illegal to discriminate against employees or applicants because of genetic information. [5] Employers are also restricted from requesting, requiring or purchasing genetic information. [5] The EEOC lists narrow exceptions, including inadvertent acquisition and voluntary wellness programs that meet specific requirements. [5]

What GINA does not cover: its health insurance protections do not cover long-term care, life or disability insurance, though some states have laws that add protection. [4] NHGRI says concerns remain about use of genomic information against applicants for those lines. [1] California's 2011 CalGINA extended protections to areas such as emergency medical services, housing, mortgage lending and education. [4] In addition to GINA, HIPAA protects patient privacy by restricting the sharing of patients' medical information. [1] Whether a particular test company is covered by HIPAA was not assessed here.

EU and UK

In the EU, Article 9 of the General Data Protection Regulation prohibits processing of genetic data unless a listed exception applies, such as explicit consent for specified purposes, and lets Member States add conditions. [6] In the UK, the Information Commissioner's Office says the UK GDPR gives genetic data extra protection as a special category of personal data. [7] Other countries have other rules that were not read for this page.

Incidental and secondary findings

An incidental finding is a result unrelated to the reason a test was ordered but of medical value for patient care. [8] The American College of Medical Genetics and Genomics recommended that laboratories doing clinical exome or genome sequencing look for and report certain variants in a listed set of genes, and said that pretest conversations should alert patients to the possibility. [8] The same group acknowledged insufficient data on penetrance and clinical utility to fully support these recommendations. [8] Penetrance means how often a variant causes disease in carriers.

Consumer raw data can also include variants in those genes, and an early clinical lab review found a false-positive rate of 40% among such variants that came to it for confirmation. [9] See genetic test false positives and clinical confirmation. In clinical sequencing, ask before testing whether secondary findings will be returned and whether you can opt out. This general question is not a recommendation to refuse or accept testing.

Questions to ask before sharing DNA

• Who owns the data, and what happens if the company is sold or closes?
• Is data shared with researchers, partners or law enforcement, and can you decline?
• Can you delete your data and sample, and how?
• How do relatives get affected if you opt into matching?

Whether a given company's answers meet legal standards was not assessed here. See also health data privacy in emerging technologies and direct-to-consumer genetic tests.