Genetic data misuse: risk to fundamental human rights in developed economies

Genomic data present an enormous resource for improving peoples’

lives, including health (Green et al., 2011; Manolio et al., 2015), education (Kovas et al., 2015; Kovas, Malykh, & Gaysina, 2016) and justice

(Selita, 2018). The value of genomic data is also recognised by the commercial world, such as pharmaceutical, insurance, marketing, and data

processing businesses. Moreover, genetic data can become a resource for

policing and military (Mehlman and Li, 2014). This makes genomic data

amongst the most valuable data sources – the goldmines of today’s advanced economies, “exploitable raw materials, which can be put to use

for a variety of purposes beyond those for which they were originally

collected” (Nuffield Council on Bioethics, 2015), para 9).

The current value of the Genomic data market is difficult to evaluate,

but several indicators already suggest that it is high and growing. For

example, direct-to-consumer genetic testing market has almost trebled in

value in 4 years (Statista, n.d.). Another indicator is the current value of

other data. For example, in the EU the value of the data market was more

than €285 billion in 2015 and is expected to increase to €739 billion by

2020 (4% of the GDP) (EC, 2014a); and the value of the Internet of

Things (objects that connect and exchange data) alone is expected to rise

to as much as $11.1 trillion per year in 2025 (Manyika et al., 2015).

Research has begun to address the risks of misusing of genetic data

(Botkin et al., 2015; Dedrickson, 2017; Nordberg et al., 2018), such as

issues of privacy, including electronic health records (Kulynych and

Greely, 2017; Naveed et al., 2014); genetic tests in clinical setting

(Heeney, Hawkins, de Vries, Boddington, & Kaye, 2011; Kulynych &

Greely, 2017; Naveed et al., 2014); identification of individuals from

anonymised data (Gymrek et al., 2013); and data processing and sharing

(Heeney et al., 2011).

This paper assesses the existing fundamental rights’ protection from

misuses of genetic information in developed economies, focusing on the

UK, EU, and the USA. Paradoxically, it is in the developed economies

that threats to fundamental rights are particularly pertinent because genetic testing is used increasingly in medical settings, for family planning

and personal interest (e.g., ancestry testing); and because direct-to-consumer genetic sequencing is increasingly more available. The paper concludes with recommendations for legislative updates and policy changes.

Genomic information can be used to predict traits.

The human genome (sequenced DNA) is the text of life, an incredibly

long sequence of approximately 3 billion pairs of letters (nucleotides).

The sequenced DNA of an individual provides information about present

and future traits (e.g. health status, educational performance). The precision of information from sequenced DNA is likely to become far greater

than that offered by family history, such as illness or talent running

across generations. Family history is not individual-specific and cannot

account for genetic differences within families.

It is now well-established that genes play a significant role in most

traits (Plomin et al., 2016). For example, a meta-analysis of 17,804 traits

from 2,748 publications including 14,558,903 twin pairs showed that

across all traits, genes account for an average of 49 % of the differences

in traits (Polderman et al., 2015). Another meta-analysis showed that 66

% of individual differences in educational achievement and up to 80 %

of differences in intelligence among adults are explained by differences

in people’s genomes (de Zeeuw et al., 2015; Nature Editorial, 2016;

Plomin and Deary, 2015).

Research has also shown that multiple genes contribute to every trait.

The effect of each genetic variant is usually minimal, making the linking

of genes to traits a slow and expensive process. Despite this, enormous

progress has been achieved in recent years. For example, several recent

studies have found hundreds of genetic variants linked to educational

attainment (e.g., Okbay et al., 2016), aggressive behaviour (Zhang-James

et al., 2018); depression (Howard et al., 2018); intelligence (Davies et al.,

2018; Hill et al., 2018; Sniekers et al., 2017); and antisocial behaviour

(Wertz et al., 2018b). DNA variants already discovered explain significant amounts of variability in traits. For example, 10% of individual differences in exam results at age 16 could be explained by DNA in a UK

study (Selzam et al., 2017). This means that the power to diagnose or

predict illnesses and other human traits is still quite low, but is continuously increasing. For some rare disorders, genetic variants have been

found that present extremely high risk to carriers. For example, carriers

of the BRCA1 mutation have around 80 percent risk of developing breast

cancer, as opposed to the average 12-18 percent (Mavaddat et al., 2013).

Precision in genetic prediction and diagnosis is likely to grow fast. In

2003 the sequencing of the human genome took ten years of multinational efforts at a cost of 2.7 billion USD (NIH, 2016). Only 12 years later,

this cost dropped to around 4,000 USD; and a few months later, to

around 1,500 USD. At the time of writing, a new technology has been

announced that completes a standard human whole genome sequencing

data analysis in less than 40 minutes (Goyal et al., 2017); and a private

company, is currently offering it for 399 USD (Dante Labs, n.d.). Moreover, most whole genome sequencing projects already combine genetic,

medical and lifestyle data, creating what is known as geno-phenobanks –

a powerful resource for the prediction of traits.

Information obtained from DNA extends beyond specific traits to other

life outcomes. For example, genes linked to intellectual potential, are

relevant to education, occupation, mental and physical health, longevity,

and behavioural problems, including crime (Plomin and Deary, 2015;

Wertz et al., 2018b, 2018a). Such predictions can be invaluable for prevention and early interventions, but also present risks for discrimination.

The following sections overview these risks in relation to children’s

rights, employment, surveillance, insurance, and issues of agency and

free will.

Children’s rights

Children lack the capacity to decide whether to undergo DNA testing.

However, this decision has the potential to change the course of their

lives and the lives of their children. In developed countries, all newborns

undergo a heal prick blood extraction (from the early 1960s in the US

(Suter, 2014)), which is analysed for a number of known genetic mutations, with the aim to alleviate or manage serious genetic disorders. Because early diagnosis has immense benefits, newborn screening is forecasted to move towards routine whole-genome sequencing in the near

future (Collins, 2014). However, this prospect poses a wealth of unresolved issues. One issue is whether such testing is cost-effective, especially since its clinical utility is currently low, as current understanding of

biological pathways underlying many illnesses remains unclear (Friedman et al., 2017).

Another major issue relates to informed consent. Who should have the

right to consent to sequencing and what expertise/knowledge should

those consenting (e.g., parents, doctors) possess? In relation to genomic

data, the general public’s ability to evaluate the implications of consenting is limited. Informed consent requires genetic knowledge, which is

currently poor even amongst the well-educated (Chapman et al., 2018).

Moreover, for consent to be informed, people must have all the information on the possible use of their data, which is usually not the case. For

example, the US Department of Health has been found to keep newborns’ blood samples collected for genetic screening (3.9 million children tested annually) (Kelly et al., 2016); and have allowed outside organisations to use these samples for research, without parents’ permission (Leagle, 2011).

Another issue is where and how the genotyping information is kept,

once DNA has been sequenced. A single genome represents approximately 725 megabytes of data, which will need to be stored (and presumably

backed up) and can be used throughout the individual’s life and beyond.

Who will be responsible for the safety and privacy of these data? Will

doctors, parents and individuals themselves hold a copy?

Another major problem is that it is impossible to foresee all the future

risks at the time when genetic data are collected (McGuire and Beskow,

2010). For example, parents may make poor decisions based on an incorrect or incomplete understanding of genetic information, such as interpreting probabilistic information as deterministic. They may enrol children in specialised schools or medical programmes, or contribute to

‘self-fulfilling prophesies’, whereby a belief that some ability or skill is

impossible to achieve may lead to avoiding certain activities, changes in

people’s attitudes and lost motivation and deferred time and effort investment.

Schools can also misapply genetic information due to poor understanding of genetic effects – genetic education having only recently been introduced, and only in health care (NHS UK, n.d.). For example, schools

may stream individuals on the basis of potential performance. This raises

ethical concerns because it is currently unclear how such streaming will

benefit or harm individuals. Some research on existing practices of

streaming children based on actual performance suggested that streaming

in education disadvantages many students (Bohan, n.d.; Johnston and

Wildy, 2016). Cases of discrimination based on a lack of understanding

of genetic information have already occurred. For example, a school in

California expelled a boy because he has a genetic predisposition to cystic fibrosis (Live Science, 2012).

Genetic information can be used to implement early interventions for

potential health or behavioural problems. Research has suggested that

interventions are most successful when they start early. For example, intervention for the prevention of persistent offending is recommended to

commence in preschool or even prenatally (Tremblay, 2006). However,

early interventions based on probabilistic information also present risks.

Employment

The battle for talent is likely to lead to employers using genetic information for headhunting, such as long-term targeted messaging and selecting

personnel based on genetic data. This may have both positive and negative consequences. The recruitment process may be simplified and made

more reliable than current recruitment processes, widely accepted for

being unreliable (Oh et al., 2013; Peck and Levashina, 2017). On theother hand, as genetic information is probabilistic, genetic employment

selection will lead to missed opportunities for both individuals and employers.

There are already concrete plans to use genetic information in employment selection and employee development. For example, recommendations have already been made to the US military to employ genomic technologies to enhance health, readiness, and performance of

military personnel and to determine genetic makeup for traits/phenotype

of special relevance to military performance, including physical and

mental performance; responses to battlefield stress; the ability to tolerate

difficult conditions (‘The $100 Genome: Implications for the Department

of Defence’ Report (The MITRE Corporation, 2010)).

State surveillance

State surveillance on the basis of ‘family trees’ – although unreliable in

relation to an individual – is already being practised in a number of countries, with genetic-based databases including 1000s of children too

(Reuters, 2013; Stallard, n.d.). In the genomic era, predictive genetic information can be used to identify individuals for surveillance. For example, antisocial behaviour is highly heritable and is linked to many negative life outcomes, including crime (Moffitt, 1993; Viding et al., 2008).

Therefore, surveillance of people with a genetic propensity for antisocial

behaviour could be deemed a justifiable crime-prevention measure, especially considering decreasing surveillance costs – digital mass surveillance now being wide-spread in developed economies. However, this

presents significant risks for people’s rights. As behaviours result from

both genetic and environmental factors, genetic information will always

remain probabilistic. In this context, how much genetic risk will constitute as sufficient to justify pre-emptive measures? Would surveillance be

allowed if the risk of an individual committing a crime is 50%, 70% or

90%, or will it be prohibited?

Insurance

Insurance relies on risk assessment, as well as money collected from

healthier people covering the costs of people with more health problems.

Access to genetic information would enable insurance corporations to

assess risk significantly more precisely, allowing for tailoring premiums

to risk. Genetic data can be combined with other types of big data, such

as phenotypic (lifestyle, habits, mobile phone, email, credit card, and

health data) and circumstance/environment data (e.g. postcode, shopping

patterns, and other indicators of childhood and adulthood socioeconomic

status). Such combined use of data will make the already powerful prediction even more precise, as it taps into complex processes of gene-environment co-action (Barsky and Gaysina, 2016).

The current trend in wealthy economies, including the UK and the US,

is decreasing social provisions, with more people turning to private insurance (Barnett and Berchick, 2017; Collinson, 2017). At the same time,

the prevalence of many health problems remains high. For example, one

in two people suffer from mental health problems at some point in life

(OECD, 2014). Depression alone has been reported to account for a large

proportion of days off work (12.5 million working days lost due to depression in the UK in 2016/17 (HSE, 2017)); and is predicted to be the

number 1 cause of time off work by 2020 (Kessler and Bromet, 2013;

Munce et al., 2007; Reddy, 2010). Illnesses are also often undiagnosed.

For example, approximately 50% of depression cases are undiagnosed in

wealthy countries (Mental Health Foundation, 2016). Information on

mental health predisposition of an individual is invaluable for insurers. In

the absence of a diagnosis, insurers can use genetic information to estimate risks of developing or having health problems and determine premiums accordingly.

The implications of such use will differ across individuals. For example, those whose genetic code shows propensities for health risks would

be affected negatively, whereas those who show a propensity for minimal

health risks - positively. Therefore, countries need to develop policies to

buffer this inequality.

Influences on decisions and behaviour

Genetic information can be used to influence individuals in many other

aspects of life, including their voting decisions; consumer choice; as well

as inspiring conflict. This can be done through targeted advertising on

different media platforms and by other means. In addition, individuals

themselves may seek genetic information about themselves and make

decisions based on this information regarding partner choice, family

planning and lifestyle (e.g. (BBC, 2015)). This is problematic in the context of inadequate knowledge and misleading information provided by

companies, such as 23andme, that provide genetic testing for multifactorial conditions (Tandy-Connor et al., 2018).

Benefits of genetic testing, such as prevention of serious diseases, are

enormous and may outweigh potential risks associated with using genetic

information. In order to benefit from genomic science, people would

need to have their genomes sequenced. Genomes of millions of people

have already been sequenced as part of ongoing large-scale wholegenome sequencing projects, including 2 million people’s - by AstraZeneca (Ledford, 2016); 1 million people – by NIH; 5 million Genomes

Project in the UK (Gilchrist, n.d.); and Million Veteran Program (MVP)

(Gaziano et al., 2016) (see a detailed list in (Molnár-Gábor et al., 2017).

The number of individuals with sequenced genomes will continue to

grow. Existing large genetic data banks, with un-sequenced data, are also

growing fast. Some of these contain samples from virtually entire national populations (UNESCO, 2003). State-organised genetic services are

growing, such as the Nation-wide Genomic Medicine Service recently

rolled out in the UK. Direct to consumer genetic testing services, with

online genomic databases, are also growing fast (Mukherjee et al., 2017).

These private companies are authorised to provide genetic health risk

tests for multifactorial conditions. For example, 23andme has been given

such authorisation by the US Food and Drug Agency. Private companies

are also accumulating large amounts of genetic information. For example, AncestryDNA has collected over 7 million DNA samples (ancestry.-

co.uk), and 23andme has collected over 2 million samples (23andme.-

com).

In recent years, data protection has received significant attention. Much effort is dedicated to finding ways to protect individuals’ privacy in the

digital information era, and it is becoming clear that full protection of

digital information is not possible (see Existing laws section below). Genomic data, which provide detailed information on all traits, pose an

even greater threat to privacy than other types of data for the following

reasons.

De-identification (anonymisation) of genomic data does not protect privacy

Genetic information is unique to every individual and is detailed enough

to re-identify an individual, despite anonymisation (e.g., (Erlich and

Narayanan, 2014; Gymrek et al., 2013; Nuffield Council on Bioethics,

2015). For example, it was demonstrated that nearly 50 people (including

DNA donors and their relatives) could be re-identified, using the

anonymised data from combined dataset from 1000 Genomes project and

Y-chromosome databases which included last names (Hayden, 2013).

Another research group showed that it is possible to link sequenced data

to individuals - using a technique that relies entirely on free, publicly

accessible, Internet resources (Gymrek et al., 2013).

Identification is also made easier by other types of big data, such as

credit card data (e.g. shopping and travel trends); mobile phone data (e.g. health and activity apps); and email data. Big data, through data fusion

techniques, can lead to ‘mosaic effect’, whereby datasets that do not include personal identifiers enable a clear picture of who an individual is

and what he or she likes (Executive Office of the President, 2014).

Moreover, it is impossible to retrieve, or make private again, or monitor uses of genomic data that were once publicly released (Heeney et al.,

2011). Individuals can request that their names and other identifying information are removed from databases, but anonymised data, such as

sequenced DNA, remain as part of large-scale anonymised databases.

Data sharing has dramatically increased in recent years

Large-scale data sharing is common. For example, in the EU, in 2013,

there were around 3,500 organisations across a broad range of industries

that were Safe Harbor-certified for cross-continental data transfer

(Mcbride et al., 2013). In the UK, the National Health Service shared

medical data of 1.6 million patients with Google, as part of a data-sharing agreement (Fenton, 2016). Petabytes (1 petabyte = 1015 bytes) are

shared as part of on-going large-scale genomic data projects, such as the

multinational (17 countries) project of the International Cancer Genome

Consortium (ICGC) (Stein et al., 2015; The International Cancer

Genome Consortium et al., 2010; The UK10K Consortium et al., 2015).

Genomic and pharmacogenomic science efforts have become increasingly more global. For example, at the 2014 Global Leaders in Genomic

Medicine Summit, a Global Genomic Medicine Collaborative (G2MC)

was formed to join efforts in the implementation of genomic medicine in

clinical care (G2MC, n.d.). Genomic biobanks are established as national

and international common pool resources (Winickoff, 2007).

There is also a policy push for greater data sharing. For example, the

EU has plans to make data freely available for research within EU, with

researchers encouraged to deposit their datasets into open access repositories (EC, n.d.). The European Commission, emphasising the significant

economic value of data, has proposed a number of policy and legislative

initiatives to create a common European data space and enable secondary

use of existing data (EC, 2018). The EU has also created the European

Open Science Cloud (EOSC) so that all researchers in Europe have open

access to interdisciplinary data (EC, 2017a). Similarly, in the UK, the

Health and Social Care Act 2012 enabled the Health and Social Care Information Centre (HSCIC) to collect and share confidential information

from health records via the “care.data” service - for the benefit of research inside and outside the NHS. Within two years (by July 2014), 40

million patients had an electronic summary care record, with doctors,

nurses and community pharmacies having access to it by 2018.

Although such data sharing enables faster progress, it makes it more

difficult to prevent data breaches; or to calculate and access compensation for damages caused from breaches (see Data protection and privacy

section below).

Diverse cloud platforms are becoming increasingly more common

Cloud computing enables exceptionally fast processing. Exabytes (exabyte = quintillion = 1018 bytes) of data can, for example, be moved to

Amazon cloud in a matter of weeks (Amazon Web Services, 2016), when

only two petabytes (roughly 500,000 DVDs-worth) would take more

than 15 months to transfer using a standard university internet (Hon and

Millard, 2012; Stein et al., 2015). Cloud computing provides an excellent

platform for integration of genetic, clinical and lifestyle data; and allow

for researchers to use as much data and space (computers) as needed, and

to control them from their own computers, paying only for the computing

time (Molnár-Gábor et al., 2017). For these reasons, cloud computing is

used increasingly in genomic research projects (Langmead and Nellore,

2018). Examples include the PCAWG international project that involves

whole genomes of over 2000 patients with cancer (Campbell et al., 2017;

Stein et al., 2015); and the Cancer Genomics Cloud (CGC) of the National Cancer Institute (Lau et al., 2017).

Using cloud technologies for genomic research, however, raises concerns, as it makes it difficult for individuals to locate the origin of data

breaches. Moreover, establishing jurisdiction in such data breach disputes

is problematic.

Information extracted from genomic data has life-long and increasing value

DNA code does not change over an individual’s lifetime. Therefore, once

genetic risk for a particular trait (e.g. cancer) is established, that information remains valid throughout the life of the person. Even if the sequencing data are then destroyed, the knowledge already gained can be used to

cause harm. Moreover, due to the familial nature of the data (family

members are more similar genetically), genetic information can also be

used to discriminate relatives, including across generations. For example,

in relation to Huntington’s disease (HD), if one parent has HD, the child

of that parent has a 50% risk of inheriting HD (see (Chapman et al., In

Press) for facts on HD). The disease usually develops later in life, but the

known parental risk is highly informative for all biological relatives –

irrespective of their age. Moreover, risks to individuals stemming from

misuse of sequenced data increase in parallel with progress in the understanding of the genomic code. Similar to the gradual and patchy process

of extracting meaning from a text written in an unknown ancient language, DNA sequencing is being deciphered gradually, providing new meanings every day. Therefore, breaches of today can be used to harm individuals during their lifetime.

Large-scale data breaches are common

Over a billion data breaches have been reported to take place annually

(Gemalto, 2016; Kessler and Bromet, 2013; Munce et al., 2007;

Ponemon Institute, 2017; Reddy, 2010), including hacks to highly secure

organisations, such the US Department of Defence (Shanker and Bumiller, 2011). Cyber attacks, which together with hacks make around

47% of breaches (Ponemon Institute, 2017), have increased by as much

as 81% in one year; and hacking incidents are reported to have exposed

over 200 million identities in one year (Wood et al., 2012). For example,

in 2017, the world experienced the WannaCry attack, which affected over

150 countries (Fung, 2017). In the UK, the Information Commission and

police have uncovered evidence of “a pervasive and widespread ‘industry’ devoted to the illegal buying and selling of confidential personal information” (ICO, 2006), p3.

Data breaches in health care are common. For example, in around four

years, 1,419 large-scale health data breaches (each affecting at least 500

people) have been reported to the US Department of Health and Human

Services (Ornstein, 2015). In the UK, a recent NHS data breach involved

around 500,000 medically sensitive documents (results of blood tests,

biopsies and cancer and other screening) (Merrick, 2017). In addition,

unsanctioned use of data can be viewed as data breaches, even when data

are used for research purposes such as that of newborns’ blood samples

by the US Department of Health.

Lack of compliance in security measures exacerbates the problem of

data breaches. For example, only a small proportion of health care

providers reported complying with the HIPAA security rule (Having and

Davis, 2005; Rinker, 2013). In the EU, a study revealed that the national

data protection authorities in 11 (of 27) member states were unable to

carry out their tasks due to lack of financial and human resources (Kuner,

2011).

The current situation can be likened to a river spilling over its banks –

with streams of precious information on individuals, including highly

sensitive genetic information, flowing thorough poorly designed unattended channels. The current laws, which impose only fines, are insufficient to deter big corporations from reckless and deliberate breaches (e.g.

(US Department of Justice, 2017, 2012), which make a significant proportion of data breaches (Ponemon Institute, 2017).

We can now modify the genome of living humans using gene editing

methods, including CRISPR (clusters of regularly interspaced short

palindromic repeats (Dolgin, 2017). These methods have potential, to

cure certain disorders and cancers, including those that have no current

treatment options (Nordberg et al., 2018). With a one-time procedure,

gene editing can turn a disease-causing mutation into a healthy version of

the gene. The new CRISPR editing systems no longer require cutting

through the DNA (cutting anything out or putting anything in), but instead rewrite individual genetic bases/letters (A, T, C, G) (Crossley,

2018; Dolgin, 2017). In vitro gene editing trials in humans have been

carried out since 2009 (Le Page, 2017; NIH, 2016), including on reproductive cells (Liang et al., 2015). First in vivo gene editing (inside the

human body) to successfully treat a disease has been reported in 2017 in

the US (Ma et al., 2017). Gene editing has the potential to alleviate suffering of millions of people worldwide affected by over 10,000 identified

monogenic inherited disorders (Ma et al., 2017).

It is unlikely that CRISPR method will be applied to most complex

polygenic traits, such as intelligence (Liang et al., 2015). The factors that

preclude such use include: the complexity of multiple gene systems

(polygenicity and epistasis) interacting with multiple environments;

pleiotropic effects (one gene influencing many traits); and antagonistic

pleiotropy (one gene influencing different traits in different directions –

positively, neutrally and negatively) (Cheng et al., 2015). However,

CRISPR has surpassed all science fiction predictions, and therefore new

understanding may bring new methods of gene editing.

Progress in gene editing also makes it a powerful tool which can be

misused, unless properly regulated. Unregulated editing of the human

germline (cells that are relevant for reproduction) might create unwanted

or harmful inheritable genetic changes, affecting the whole population’s

genetic pool. In the globalised world, one population’s change will

spread to other populations. Although unwanted intergenerational

changes are reversible in principle, multi-jurisdiction enforcement is unlikely to be possible. Currently, different jurisdictions regulate germline

editing differently, with some prohibiting it, some having ambiguous

regulation and some allowing it (Araki and Ishii, 2014; Nordberg et al.,

2018).

Moreover, if gene editing is ever applied to polygenic traits, this can

also lead to injustices. For example, gene enhancement/biohacking is

likely to be widely used, including for intelligence, sports performance

and defence. Non-genetic bio-enhancement is already widely used. For

example, it is reported that the US Department of Defence (DOD) designed and implemented force-wide, mandatory Anthrax Vaccine Immunization Program (AVIP), despite potential side effects and ineffective ness against weaponised anthrax on the battlefield (US House of Representatives, 2000). A head of the US Intelligence has compared the power

of gene editing with that of a weapon of mass destruction and has warned

of risks of its use in creating harmful biological agents or products (Nature Editorial, 2016).

Despite obvious concerns, the rules on allowing gene editing on humans are relaxing. In 2015, when British scientists first sought permission to edit human embryos in vitro – in vivo editing was out of the question (Sample, 2015). Just three years later, in vivo gene editing is becoming a reality. Unless we have a one-government world (advocated by

many, including Albert Einstein (Lu, 2016)), it will be increasingly difficult to protect human rights from gene editing misuse.

Unlike most fundamental rights, such as the right to life and freedom

from torture, any decision-making on genetic information requires a substantial degree of technical expertise. This includes knowledge about the

pleiotropic nature of genes; polyfactorial nature of traits; and factors affecting epigenetic regulation (Plomin et al., 2016). Genetic knowledge,

being the literacy of the 21 century, is important for all people (Chapman

et al., 2018) and is crucial to lawyers and judges.

Unless complexities of the origins of human traits are accounted for,

decisions are likely to be wrong. For example, for any decision involving

human behaviour, it is essential to understand that genetic effects can be

stronger or weaker in different circumstances. A genetic risk for developing a particular trait (e.g. aggression), may be suppressed in certain environments, but enhanced in other environments, including those outside

peoples’ control, such as inequality, with potential cross-generational

impact (Selita and Kovas, 2018). It is also essential to know that genes

contribute to both stability and change of a particular behaviour (Kovas

et al., 2007). Genetic knowledge it is also essential to enable progress

with updating legislation and policy, to protect people and implement

findings. For example, lack of expertise and training programs in genetics is reported to be one of the main barriers to global implementation of

genomic medicine worldwide (Manolio et al., 2015). Currently, lawyers

have no training in genetics, and their knowledge comes mainly from the

media, which often misreports genetic findings (Selita et al., 2015).

Most current laws have been drafted at the time when genetic knowledge

was much less advanced, and genetic information was far less informative than it is today. Most current legislation, therefore, is not designed to

prevent genetic discrimination in the genomic era. This section assesses

legal protection of individuals related to data protection/privacy and

health insurance discrimination – the two areas with most developed

laws in the EU and US jurisdictions. The section also evaluates whether

there are sufficient safeguards to minimise breaches; and whether the law

provides accessible remedies for losses suffered as a result of breaches or

misuses of information.

This section focuses on protection in the EU, where laws in this area are

most developed. The right to protection of data is recognised as a fundamental right. For example, the General Data Protection Regulation

2016 (GDPR) of the European Union, states in the preamble that “The

protection of natural persons in relation to the processing of personal

data is a fundamental right”. Article 8(1) of the Charter of Fundamental

Rights of the European Union (the ‘Charter’) and Article 16(1) of the

Treaty on the Functioning of the European Union (TFEU) provide that

“everyone has the right to the protection of personal data concerning him

or her.” The right to privacy is also long recognised as a fundamental

right, including in the Universal Declaration of Human Rights 1948 (Article 12), the European Convention of Human Rights 1953 (Article 8)

and the European Charter of Fundamental Rights 2000 (Article 7). In

relation to genomic data, the two rights are interdependent. The right to

privacy cannot exist unless genomic data are protected, and therefore the

two rights can be referred to interchangeably.

The recently enacted GDPR, which regulates the processing of personal data, increases penalties and administrative fines for breaches to up to

20 million Euros or 4% of the total annual turnover in the preceding financial year, whichever is higher (Articles 83 and 84). It also includes

remedies for non-material damages (Article 82). Individuals can file their

complaints through a national data protection authority (Art 71(1)

GDPR); and have a right to seek compensation from a data controller or

processor for breaches of the Regulation (Art 82 and 79, GDPR). For

example, in the UK, until the transitionary time post-Brexit has ended

(currently set for 31 December 2019), complaints are to be brought to the Information Commissioner’s Office (ICO) (s 214, DPA 2018). The ICO

is to respond within three months of the complaint, either with a decision

or with information on the progress. The ICO has investigative powers

and may apply to a judge for a warrant to enter and search the premises

(s 154, DPA 2018); and may also issue a penalty notice (ss 155-159, DPA

2018) – a civil matter which may be enforced through the civil courts

(para 9, Schedule 16, DPA 2018). Three key shortfalls in the relevant

law, including the GDPR, are outlined below.

The law on data protection and privacy is a servant of two masters

The GDPR and other data protection and privacy legislations, are passed

with the aim to: (1) make data accessible (e.g. for research) and (2) make

data inaccessible (protect data and privacy) - favouring the first. This can

be seen from considerations by a number of Government bodies, prior to

the passing of the law, on the trade-offs between benefits of data accessibility and individuals’ privacy – which have tilted towards data accessibility legislative framework (EC, 2017b, 2014b; Executive Office of the

President, 2014; HM Government, 2013; US National Intelligence Council, 2012). The GDPR has as one of the three main objectives to prohibit

restriction of the free movement of personal data within the Union (Article 1). It also lists a significant number of exceptions, when processing of

personal data is to prevail over privacy (Article 9). These include circumstances when processing is “necessary for achieving purposes in the

public interest, scientific or historical research purposes” – a test which

can be easily satisfied in relation to use of genetic data because they are a

vital resource for medical and other research.

The Regulation also allows for data sharing with a third country or

organisation which does not provide the required adequate safeguard in

circumstances when “the requirements in this Regulation relating to

transfers subject to appropriate safeguards, including binding corporate

rules, and derogations for specific situations are fulfilled” (Recital 107 of

the GDPR). The language used allows for significant discretion.

Moreover, Regulations are secondary legislations, while EU Treaties

are primary legislation (European Union, web). The GDPR, therefore,

needs to be interpreted and applied in conjunction with the Treaties,

which favour freedom of research. For example, the Treaty on European

Union and the Treaty on the Functioning of the European Union states

that the Union “shall promote scientific and technological advance” (Article 3). Similarly, Article 13 of the Charter of Fundamental Rights of the

European Union states that “The arts and scientific research shall be free

of constraint”. Considering there is, in general, a negative correlation

between making data accessible and privacy, the legal protection of personal data and privacy is hindered.Another weakness of the GDPR is that, with regard to the processing

of genetic, biometric and health data, it allows Member States to “maintain or introduce further conditions, including limitations” (Article 9) to

the GDPR. For example, in the UK, the Data Protection Act 2018 gives

the power to the Secretary of State to make provisions, including transitional, transitory, amending and repealing (see Provision 213); and the

protection of privacy is limited by a number of legislations. The Health

Service (Control of Patient Information) Regulations 2002, require that

in England and Wales, data be disclosed without patient consent for purposes, such as: to diagnose risks to public health; recognise trends in

such risks; control and prevent the spread of risks; and monitor and manage the delivery, efficacy and safety of immunisation programmes (Article 3(a). Under the 2002 Regulations, as well as under section 251 of

NHS Act 2006, the common law duties (e.g. confidentiality) may also be

set aside. In addition, the law requires diagnostic laboratories to provide

positive diagnostic test results on specified diseases to Public Health

England - see (Taylor, 2015). The Health and Social Care (Safety and

Quality) Act 2015 has introduced a duty for health and social care

providers to share confidential patient information, where they consider

the disclosure to be in their patient’s best interest (Article 3). Moreover,

under the Police and Criminal Evidence Act 1984, a judge may order that

the police have access to medical records for the purpose of a criminal

investigation. Overall, the power given to States to alter the law creates

uncertainty and may interfere with both purposes of the Regulation because it can limit data sharing across jurisdictions and protection of individuals (Molnár-Gábor et al., 2017; Nature Editorial, 2018).

The law does not account for the special characteristics of genetic data

To protect individuals’ privacy in the genomic era, the law needs to account for six key characteristics of genetic data. First, individuals are

unlikely to know that their data have been breached. As discussed above,

genomic data are often stored and shared globally in clouds or other digital platforms, and laws regulating cloud computing have gaps and weaknesses (Robinson, N. et al., 2011). Second, once an individual knows of

the breach, it is difficult for them to assess whether they have suffered

damage as a result. Damages resulting from the breach depend on the

individual’s genetic makeup. For example, for a person whose genomic

code shows a high propensity for illness or aggression may suffer discrimination, including in insurance and pre-emptive surveillance. On the

other hand, a person with a genetic propensity for good health or high

intelligence may actually benefit from the breach. Third, a breach of an

individual’s data has the potential to harm biological family members (Chapman et al., In Press). The law does not clarify the legal rights of

family members. In additions, it does not clarify obligations of data processors and family members towards other family members. For example, should a person or medical centre release genetic risk information to

family members?

Fourth, now that genetic data are collected in a range of contexts (e.g.

medical, direct to consumer testing, contribution to research, and law

enforcement bio-banks), it is impossible for people to determine the origin of the breach of their genomic data. Fifth, it is difficult to assess the

extent to which damages originate from genomic data alone or from the

linked and cross-analysed additional big data (e.g., medical, lifestyle,

etc.). Sixth, damages stemming from genomic data breaches are almost

impossible to quantify because they can manifest in different contexts,

including in insurance, education, employment and state surveillance;

and they can accumulate over the life course of a person, and affect relatives, including future generations.

Data protection and privacy laws are difficult to enforce

To date, there has been minimal enforcement of data protection and privacy laws in the EU, UK and the US (e.g. (EC, 2003; ICO, 2018; Leagle,

2011). Very few of the numerous discovered violations result in penalties

(Ornstein, 2015). Moreover, the existing laws do not provide for imprisonment for criminal data breaches (e.g. GDPR; UK DPA 2018). Case law

regarding international data flow and data protection has been described

as inadequate in the EU and the US (Kulynych and Greely, 2017;

Svantesson, 2010), with few successful enforcements (Hon, 2017). The

imposed penalties are usually relatively small, even post GDPR. For example, a UK medical centre was fined £35,000 for leaving highly sensitive data of patients in an empty unsecured building for 18 months; and a

government enforcement institution was fined £80,000 for sending a bulk

email that identified victims of child abuse (ICO, 2018).

Protection of genetic privacy and protection from genetic discrimination also require enforcement of individuals’ right to access their personal data processed by data controllers – so that people can know when

their data are being misused. This is a well-established right, but it is difficult to enforce. For example, from our independent assessment, different institutions, including UK Law Enforcement Agency/police, and Inns

of Court (that admit barristers), deny individuals’ requests to access data

held on them through imposing conditions which are impossible to satisfy. These conditions include requiring individuals to provide: details of

specific information the individual wished to access; details of data to be

rectified; and addresses (with evidence) for ten years. Applied to the genetic data, it would be particularly difficult for individuals to specify exactly what data about them is kept by data-controllers.

Enforcement is similarly minimal in relation to transfers of data (e.g.

(Hon, 2017)). Currently, for transfers outside the EU, the transferor must

ensure that the transferee and its jurisdiction provide an ‘adequate level

of protection’ of data. The minimal enforcement against the ‘many unauthorised and possibly illegal transfers’ is recognised by European Commissioner (EC) itself (EC, 2003). Similarly, in the US, already over 15

years ago the then US Secretary of Health and Human Services, Donna

Shalala, warned that “Every day, our private health information is being

shared with fewer safeguards than our video store records.” (Andrews,

2001) p. 140. Recognition of the minimal protection, however, takes a

long time before it leads to action. For example, it took until 2015 for the

European Court of Justice to find invalid EC’s decision that the US ensured an adequate level of protection for EU citizens’ data (EUR-Lex,

2015). The updated EU-US data transfer guidelines, the EU–US Privacy

Shield (EC, 2016), have also been criticised by data protection experts

(see (Molnár-Gábor et al., 2017)).

The minimal enforcement may also be supported by the confusing and

sometimes surprising interpretation of the law. For example, in the UK,

in relation to the ownership of health data, the UK Department of Health

states that “it is not the information contained on the records that has an

owner, but the paper or files the information is on”, and, as a result, “Legal ownership of health records resides with the organisation that owns

the paper or database on which the record is stored.” (see Government

response DE00000700509 at (UK Department of Health, 2012). This is

inconsistent with the well-established law regulating medical data. The

European Court of Human Rights states that “Personal information relating to a patient undoubtedly belongs to his or her private life.” (see for

example (ECHR, 2008), para 35); and that “the protection of personal

data, not least medical data, is of fundamental importance to a person’s

enjoyment of his or her right to respect for private and family life”; that

respecting the confidentiality of health data “is a vital principle in the

legal systems of all the Contracting Parties to the Convention”; that

without such protection, “those in need of medical assistance may be

deterred from revealing such information …, thereby endangering their

own health and, in the case of transmissible diseases, that of the community.”; and that the “domestic law must therefore afford appropriate safeguards…” (ECHR, 1997) para 95).

The interpretation of the law has not improved post-GDPR. For example, in a key post-GDPR case, the judges of the UK Court of Appeal

showed a strong disagreement in a matter of data protection law that is

well-established in Treaties, GDPR and domestic laws (BAILII, 2018).

The issue before the Court was that of a patient’s access to personal data processed by public authorities. In the US, the situation is similar. For

example, the Department of Health (and two state courts) interpreted the

Genetic Privacy Act of Minnesota to allow them to use, store, and disseminate hundreds of thousands of blood samples of newborns without

parents’ consent and violating the Act – interpretation which the Supreme

Court found troubling (Leagle, 2011).

Enforcement is further affected by costs of litigation – identified as a

key barrier in general data protection issues in the EU (EU Agency for

Fundamental Rights, 2014). The costs in genomic-related litigation are

likely to be high, because of the technical nature of genetic information

and because it requires the input of multiple experts to assess, prove and

quantify damages. This will also deter people from bringing claims on

the fear of facing legal costs of the breaching organisation. In a recent

UK case, for example, the individual whose distressing health data had

been breached due to the medical centre’s negligence (who sought removal of this information from records), was ordered to pay the legal

costs of the data breaching organisation (Ramesh and Dinsdale, 2013). In

relation to genomic data, the controllers are often major corporations,

with the resources and motivation to fight legal actions, generally in order to prevent disadvantageous precedent (European Union, 2013).

The lack of protection to privacy and personal data in the current (genomic) era, may lead to a chain reaction of threats to related human

rights, including the child’s rights and the right to non-discrimination

(freedom from discrimination). Although these risks are becoming more

and more recognised (Andrews et al., 2015; Kovas and Selita, 2014;

Nuffield Council on Bioethics, 2015; Relman, 2010), the relevant legislation might take a long time to be updated (e.g. in around 10 years on average in the UK and the US). In the meantime, immediate action is needed to provide all stakeholders with transparent information as to the degree of protection provided by the law. Currently, misleading promises

are given to people, such as the statement by Genomics England addressed to parents of children with cancer (or suspected cancer): “No-one

can access the data without asking us first…” (Department of Health,

UK, n.d.).

Specific laws protecting against genetic discrimination, with a focus on

insurance and employment, have already been passed in some countries.

These include the Genetic Information Non-discrimination Act 2008

(GINA) in the US; and the Genetic Non-Discrimination Act 2017 in

Canada. Some international instruments, such as the European Convention on Human Rights and Biomedicine 1997 (Biomedicine Convention) and the Charter of Fundamental Rights of the EU (the Charter), also aim

to prevent discrimination on ‘genetic heritage’ (Biomedicine Convention,

Article 11) and ‘genetic features’ (the Charter, Article 21). However, the

party countries may denounce the Biomedicine Convention at any time

(Article 37), and the Charter applies only within the EU. Moreover, the

existing laws cover some genetically influenced characteristics but do

not deal with the wealth of information that can be extracted from whole

genome sequencing data. This section assesses the existing protection

against genetic discrimination in health insurance, focusing on the US, as

a jurisdiction with one of the earliest and most advanced specific legislations in this area. The section also includes a comparative overview of

the protection in the UK.

In the US, protection of individuals from genetic discrimination in

health insurance is covered by a number of legislations, including the

Employee Retirement Income Security Act 1974 (ERISA); Health Insurance Portability and Accountability Act 1996 (HIPAA); the Affordable

Care Act 2009 (ACA); and the Genetic Information Non-discrimination

Act 2008 (GINA). A large proportion (55.7%) of privately insured US

population (67.5%) are insured through the employment-based group

coverage; 37.3 per cent - through government coverage, and the remaining 8.8 % - are uninsured (Barnett and Berchick, 2017).

Group health plans are regulated by HIPAA, which prohibits discrimination on the basis of any health information or considering pre-existing

conditions for individual employees moving from one job to another

(Edemekong and Haydel, 2018). However, HIPAA allows a group health

plan to charge all members of a group higher premiums on the basis of

an individual’s genetic information (Congressional Research Service,

2008). This pushes employers to learn about any genetic propensities and

conditions of employees and prospective employees. GINA does not allow employers to seek this information from employees, but permits employers to request employees' genetic information for the purposes of

voluntary wellness programs – creating a loophole in the law. This directly contradicts the public opinion: before GINA was passed, a poll of

4834 Americans showed that most people were against employers (92%)

and health insurers (80%) having access to an individual's genetic information (Baruch and Hudson, 2008). Voluntary wellness programs entail

collecting employees' biometric data (e.g. weight, blood pressure, cholesterol levels) and are typically run by third-party companies (US NIH,

2017). Although employees can refuse to give genetic information, the

scheme provides benefits for participation (discounts on health insurance) and penalties (insurance cost increase) for non-participation. The

conflicting provisions in HIPAA and GINA, lead to people surrendering

some of their rights, in order to access benefits and avoid penalties. Unlike HIPAA and GINA, the ACA, which provides similar protection

to groups and individuals, does not allow for coverage to be refused and

also prohibits adjustment of premiums on medical conditions and genetic

information (included as health information) (Article 1201). The notion

of ‘actuarial fairness’ – premiums based on the estimated likelihood of

needing medical care – is also prohibited. However, ACA allows 50%

premium enhancement for tobacco use, as well as for geographic area of

residence and age (CMS, 2013; Department of Health and Human Services, 2013a) – creating another loophole. For example, geographic locations can be correlated with genetic information, such as higher rates of

mutations in BRCA1 and BRCA2 genes, associated with cancer in some

populations (Furrow et al., 2013) ch. 16. Behaviours, such as smoking,

are also correlated with genetic information (Davies and Soundy, 2009;

Loukola et al., 2014). Moreover, insurers are known to use all loopholes

to increase profits. For example, in one case insurers deprived the insured of pay for treatment of breast-ovarian carcinoma syndrome on the

excuse that it is not an illness, but a genetically based condition (Court

Listener, 1994)).

Despite limitations, ACA provides greater protection than the other

Acts. However, the ACA has recently suffered some damage from Tax

Cuts and Jobs Act of 2017. As a result, from 2019 there will no longer be

a penalty for not having health insurance (Edemekong & Haydel, 2018) -

the penalty clause that ensures sharing of the costs (with the healthy people also taking health insurance). ACA has faced other threats, including

recently proposed amendments that would jeopardise legal protection for

millions of people (Alonso-Zaldivar, 2018; California Healthline, 2018;

KHN, 2018). Although these have failed so far, (e.g. Kaplan & Sullivan,

2017), the future of ACA remains unclear.

In relation to private insurance outside employment, GINA, which updates ERISA, HIPAA and the Internal Revenue Code, prohibits most

health plans from using or disclosing genetic information for underwriting purposes (Department of Health and Human Services, 2013b).

GINA, does not, however, prohibit such use for insurance covering life,

long-term care, or disability. Moreover, GINA is designed to protect only

asymptomatic individuals. This means that if a person develops a condition, the insurance company can refuse to renew the policy at the annual

renewal date, and the law allows this in virtually every state (Rothstein,

2009). It is clear from these and other co-existing Acts that the law offers

only limited protection of individuals in the US see (“History of EBSA

and ERISA” 2016) (and (Furrow et al., 2013) for more information on

insurance law in the US).

The situation is similar in the UK, where the Association of British

Insurers (ABI) and the Government have entered into an agreement,

Concordat and Moratorium on Genetics and Insurance (‘Concordat’) to:

a) abide by a policy framework for co-operation that provides that insurers’ use of genetic information is transparent, fair and subject to regular

reviews; and b) remain committed to the voluntary Moratorium on insurers’ use of predictive genetic test results until 1 November 2019 (HM

Government, 2014), p.1). The Concordat does not prohibit the use of genetic information in health insurance. On the contrary, it emphasises that

ABI and the Government agree that “unless otherwise agreed, insurance

companies should have access to all relevant information to enable them

to assess the price risk fairly in the interest of all their customers”. Moreover, the Concordat has as one of the main aims protecting insurers’ right

of equal access to information about risks.

Under the Concordat, insurers can ask for genetic test results that confirm diagnoses of ill health. Moreover, the Moratorium only covers tests

used to predict future illness. The clause protecting individuals from discrimination on genetic information has no legal power because it is

merely a recommendation. It states that ‘Insurers should not treat customers who have an adverse predictive genetic test result less favourably

than others without justification’. The words ‘should’ and ‘without justification’ show that there is no obligation and that a justification would

suffice to exonerate liability. Moreover, there are exceptions, including

monogenic diseases, late-onset, and of high genetic risk of developing

the disorder. The limited protection offered by the Concordat is further

reduced by suggesting that applicants may disclose a positive result from

a predictive genetic test if they wish the result to be considered in the

underwriting decision (p 4). This creates a situation where, if people do

not disclose, it may be assumed that they are withholding genetic risk

information. Recent legislation on health insurance, the Consumer Insurance (Disclosure and Representations) Act 2012 (CIDRA), does not deal

with genetic discrimination.

In practice, if one wishes to obtain health insurance in the UK, it is not

clear whether one can keep private genetic information without jeopardising the right to recovering health costs. For example, the multinational

insurance corporation AVIVA plc states that they do not cover treatment

of any pre-existing condition, or any related conditions if the person applying for health insurance has “symptoms of, diagnostic tests for, medication for, treatment for, or advice about, that condition in the five years

before you joined the policy” (AVIVA Plc, 2018). It is unclear whether

all genetic risks will be considered in these circumstances as ‘pre-existing conditions”. Moreover, the law does not clarify the meaning of genetic terms, such as ‘genetic condition’, ‘genetic trait’ and ‘genetic disease’.

Furthermore, if one has their genome sequenced, it is likely that they

would seek advice about the results (e.g. a mutation related to health

risk). There is also an additional risk of being accused of having knowledge of a pre-existing condition on the basis of having genome sequenced, even though the person may not have been given or understood

the related health implications. In the ‘Full Medical Underwriting’ section, in addition to asking about health, AVIVA states that, “if we need to,

we may ask your permission to get more details from your doctor”. If

one denies access, one may be considered to conceal risk information.

These uncertainties are likely to affect millions of people because,

whilst currently in the UK there is free health care, the system is gradually changing, increasingly charging for more services (Donnelly, 2018;

Smith and Dexter, n.d.). Doctors and nurses have described some of the

current charges as a “deliberate cruelty” of the Government (Bulman,

2017). Hospitals are also advertising quick access at any time to paying

patients, which is likely to affect other patients’ access, including making

referrals less accessible.

Overall, in both the US and the UK, protection is limited even in the

areas with most developed laws. To date, legislators internationally have

not passed even basic specific legislation (with few exceptions such in

the US and Canada). The primary justification proposed for not updating

legal protection is the lack of need for such updates. For example, relevant authorities in the UK (the House of Lords Science and Technology

Committee) have concluded that there is no sufficient evidence of there

being legal implications (Department of Health and Social Care, 2009).

The very few existing genomic specific legislations are incomplete, and

laws protecting people are scattered. In the US, for example, more than

1,000 laws and resolutions were enacted between 2015 and 2018 in relation to health insurance and access to it (The Health Innovations Database, n.d.). This makes it difficult for lawyers and almost impossible for

members of the public to know what rights to seek and how. There is,

therefore, a clear need for urgent action by governments.

Genetic knowledge is the most powerful tool humanity has to improve

the quality of life, but it can also be used to violate human rights. To protect fundamental human rights in the genomic era governments can

quickly implement a number of cost-effective measures, including:

Organize interdisciplinary teams to draft specific legislations

Interdisciplinary teams, including specialists in genetics, law and digital

processing, must be formed to work on updating laws. There are already

a number of interdisciplinary groups that work on these issues, such as

the Working Group on Legal, Ethical and Societal Implication of Genetics (LESIG) (TAGC, n.d.) at The Accessible Genetics Consortium

(TAGC, n.d.) and The Ethical, Legal and Social Implications (ELSI) Research Program (NIH, US, n.d.). However, due to the scale of implications, Governments should coordinate this work - to enable fast legislative updates.

Consolidate and extend the existing protection

The new legislation should aim to bring together the current scattered

protection, to make protection accessible to people. This can be done by

passing specific legislation which regulates the use of genetic information across all relevant areas and incorporating the current protection.

Introduce effective penalties

The law needs to set strict penalties in order to minimise data hacks and

fraudulent and negligent data breaches. This can be done by imposing

appropriate fines and prison sentences for such breaches. Imposing imprisonment, instead of only fines, will reduce the significant revenue

from fines (e.g. in 2014 alone, the US Department of Justice recovered

$2.3 billion for prosecutions of health care fraud (Gosfield, 2015)).

However, this measure will provide better protection of people’s rights

and will reduce the impact of injustices on individuals.

Train relevant stakeholders on basic genetic findings

Introduce genomic education for lawyers and judges as part of their professional development programmes. Modules on genetics should also be

taught as part of the law degrees. Introducing such education would have

a positive effect on improving decision-making (e.g. criminal behaviour,

lie detecting) and overall justice.

Beyond these relatively simple steps, other measures will require more

significant societal changes. For example, some areas, such as health

care insurance, cannot be properly regulated by simply updating legislation. It is not possible to arrange for a fair, fully private, health insurance

system, because insurance companies rely on risk assessment and need

payments from the healthy to cover expenses. Therefore, to provide a fair

system for all, governments will need to either provide health care insurance to all people, without considering any medical and genetics data; or

make insurance mandatory, and cover the costs in part through public

funds for those who cannot afford it – as is the case in Netherlands and

Switzerland (Furrow et al., 2013).Genomic research has brought humans closer to understanding human

behaviour. The prediction precision for disorders, diseases, and other

traits is increasing fast – enabling a powerful tool for both improving

quality of life and harming individuals. This powerful tool cannot be

regulated by stopping progress in genetic research - restricting it in one

jurisdiction would not prevent other (possibly more permissive) jurisdictions from pursuing this research (Bosley et al., 2015)). Therefore, societies need to do everything in their power to regulate the use of this powerful tool. Action is needed now before it becomes practically impossible

to protect people’s rights.