On the one hand, human genetic data has great promise for use in research. The human genome, and small portions thereof, show great potential in helping us answer questions related to human health, including developing treatments for genetic conditions.
On the other hand, the ethics of using genetic data keeps researchers, IRBs, ethicists, and others awake at night while trying to develop appropriate guidelines for the use and sharing of these data. As of now, the average nonscientist could not readily reidentify an individual from genetic data available in publicly available datasets. But — what if the person with access to such a dataset has access to specialized technology allowing reidentification, or allowing that dataset to be combined with other publicly available information to reidentify individuals? And can we expect such technology to become more readily available in the future (short answer: yes.).
At the IRB, we frequently encounter studies that create or use genetic data. We do our best to ensure that relevant regulatory requirements and guidances are met for the use of these data and that subjects are informed to the extent possible of what will happen to their data. However, privately created databases, such as those created by services that do genetic testing of individuals for genealogy purposes, may not subject to the same kind of ethical oversight that research datasets are. In fact, law enforcement has used these databases to help solve crimes. Now two states have taken steps to restrict law enforcement’s ability to access this kind of data.
This availability of personal genetic data creates a delicate balancing act for the IRB and human subject research ethicists. On the one hand, we want to ensure data confidentiality is protected to the extent possible, and feasible. On the other hand, we know that many of our research subjects, or their family members, may have contributed to these publicly available databases, and that they may welcome to the opportunity to participate in research related to genetic conditions. The IRB’s requirement that protocols carefully and thoroughly describe the creation, use, and possible sharing of genetic data is one part of how we ensure we meet our regulatory requirements and protect human subjects to the extent possible, and feasible.