The Current State and Future of DNA Information

Rewritten: October 7, 2024

DNA information is the ultimate form of personal data, with future uses expected to include estimating disease risk and influencing employment or insurance decisions. seeDNA thoroughly enforces anonymization and rigorous security measures to safely manage clients' DNA information.

Is DNA information personal data? Why it matters and needs protection

DNA (deoxyribonucleic acid) exists in every cell that makes up our bodies. This genetic information has a base sequence unique to each individual, and except for identical twins, no one else in the world shares the same DNA sequence. For this reason, DNA information is called the "ultimate personal information," and in recent years the importance of protecting it has drawn increasing attention [ref:1].

Our company, seeDNA (seeDNA Genetic Medical Research Institute), handles a large number of samples in the course of conducting DNA testing, and this results in a vast amount of DNA information being generated. However, all of this information is managed and operated in a fully anonymized state, and we have built a system that puts our clients' privacy first.

Why is DNA information called the "ultimate personal information"?

Mass media and science outlets frequently report that DNA is the ultimate form of personal information and that security measures for it are essential. Yet how many people actually understand clearly why that is?

In fact, while many people readily recognize fingerprints, phone numbers, and email addresses as personal information, awareness that DNA information is likewise personal data still seems far less developed. A major reason for this is that everyday uses of DNA information remain limited so far.

Even so, there are several ways in which DNA information differs decisively from other kinds of personal information. Below, we summarize its key characteristics.

• It never changes over a lifetime: Phone numbers and email addresses can be changed, but DNA information never changes throughout a person's life. Once leaked, the damage cannot be undone.
• It affects blood relatives too: Because DNA information includes data about parentage and blood relationships, it raises privacy concerns not only for the individual but for family members and relatives as well [ref:2].
• It can predict health and disease risk: Certain genetic variants may make it possible to estimate the risk of developing cancer, diabetes, heart disease, and other conditions, which raises concerns about potential discrimination or disadvantage.
• It can identify an individual: As demonstrated by its use in criminal investigations, a DNA profile has enough discriminating power to uniquely identify a single person.

Future risks and possibilities of DNA information

In the near future, as DNA information makes it possible to estimate disease risk with greater precision, this could work either for or against individuals in situations such as employment and insurance enrollment. For example, there are concerns that people with certain genetic predispositions could be denied life insurance coverage or treated unfairly in job interviews.

In the United States, the Genetic Information Nondiscrimination Act (GINA) was enacted in 2008, legally prohibiting discrimination based on genetic information in employment and health insurance [ref:3]. In Japan as well, under the Act on the Protection of Personal Information, DNA information is treated as "sensitive personal information requiring special care," and obtaining it in principle requires the individual's consent.

Furthermore, in recent years the bankruptcy of a major genetic testing company has raised concerns about what will happen to the DNA data of millions of people [ref:4]. Cases like this highlight how important it is to check in advance the security systems and data management policies of any company you entrust with your DNA information.

The future of DNA data banks and ID-card-like uses

If something like a DNA data bank becomes widespread, and personal information—including financial data—can be linked to it, DNA information may come to function like an ID card. If DNA authentication is put into practical use as a form of biometric authentication, it could bring revolutionary change to fields such as identity verification and payment authentication.

At the same time, however, such systems require extremely strict security measures. As mentioned above, DNA information is "unchangeable," so if a database were ever hacked, the resulting damage would be far more serious than the leak of a password or credit card number.

How seeDNA protects DNA information

At seeDNA, we deeply understand the significance of DNA information as the ultimate form of personal data, and we enforce rigorous security measures to protect the personal information of every client who requests testing from us.

1. Anonymization of samples: Each received sample is assigned a unique management number and is managed separately from any information that could identify the individual.
2. Access restrictions: Access to DNA information is strictly limited to the small number of staff directly involved in testing.
3. Secure storage and disposal of data: After testing is complete, DNA data and samples are retained for a set period and then completely disposed of using appropriate methods.
4. Published security policy: Our privacy protection policy is published on our official website, ensuring a highly transparent operation [ref:5].

Many people considering DNA testing worry about things like "could my DNA information be misused?" or "could it be leaked to a third party?" To ease these concerns, we have put in place a security system that meets the highest industry standards. Please feel free to request testing with peace of mind.

Global trends in DNA information protection

Discussions around the protection of DNA information are becoming more active worldwide. In Europe, under the General Data Protection Regulation (GDPR), genetic data is classified as a "special category of personal data" requiring the strictest level of protection. International debate also continues over the use of familial DNA searching in criminal investigations, due to concerns about privacy infringement [ref:2].

In Japan too, the 2023 revision of the guidelines under the Act on the Protection of Personal Information sets out more concrete rules regarding the handling of genomic data, requiring research institutions and companies to further strengthen their management systems. As a business conducting DNA testing, we must continuously monitor these evolving legal frameworks and respond appropriately.

seeDNA, as a professional DNA testing organization, is committed to maintaining the highest standards not only in technical capability but also in information management and ethics.

Frequently Asked Questions

Q1. Why is DNA information called the "ultimate personal information"?

A. DNA information is unique to each individual, never changes over a lifetime, and includes extremely sensitive information such as health risks and blood relationships. Unlike a phone number or email address, it cannot be changed, and once it leaks, the damage cannot be undone—which is why it is called the "ultimate personal information."

Q2. How does seeDNA protect DNA information?

A. We manage all samples in anonymized form, completely separated from any information that could identify the individual. Access to DNA information is strictly limited to a small number of staff, and after testing is complete, the data and samples are safely disposed of following a set retention period.

Q3. What risks arise if DNA information is leaked?

A. A leak of DNA information can affect the privacy not only of the individual but also of blood relatives. There are also concerns that, in the future, disease risk information could be used in a discriminatory way in employment or insurance enrollment.

Q4. Is DNA information legally protected in Japan?

A. Yes. Under Japan's Act on the Protection of Personal Information, DNA information is classified as "sensitive personal information requiring special care," and obtaining it in principle requires the individual's consent. Penalties are also in place for improper handling.

Q5. Is information obtained through DNA testing ever provided to third parties?

A. We never provide information obtained through DNA testing to third parties without the client's consent. We thoroughly manage information appropriately based on a strict security policy.

[References]