Think twice before you give away your DNA and pay for the privilege.
All you're missing is the metadata of 'name, date of birth, social security number' and so on. But that's just a system we've placed on top of 'who you are', which is your genes.
Your fingerprint, your retina scan, your full lifes history, nothing in that list will identify you as good as your DNA does.
So once you have someones DNA you can reconnect it with the rest of the information at any point in the future by simply checking to see where that DNA turns up again, including fractions of it in your descendants.
You can't really anonymize it.
So if you and your identical twin brother or sister are both going to apply to 23andme for an analysis you should get back the same results, and if your identical twin brother or sister commits a murder and hightails it to zanzibar you are in a lot of trouble if their dna is found at the crimescene and you happened to be in the neighbourhood.
The number of identical twins is low enough that for the larger part of this discussion you can leave them out of the equation, they're the exception that confirms the rule, the differences in DNA are very subtle, and afaik will not be readily detected in a normal analysis.
Random link of Google: http://www.nytimes.com/2008/03/11/health/11real.html
Of course they are not, but for 99.6% of humanity the rule that your DNA is (very) unique holds true, and for identical twins even if their DNA is even more similar it is not 100% the same.
Clones (which do not exist (yet, or at least, human clones)) are the other exception.
In case it wasn't, the answer is 'yes', but I'd be somewhat surprised to learn that the recipient went through the trouble of retrieving my DNA from it, stores it in a database and sells the contents of that database, along with any personal information that I have voluntarily shared with them.
Why don't you mail me your proposal ;) ?
Tomorrow they could be sold to the highest bidder, who might not feel they were bound to the terms of service of their predecessor. It could be an insurance company, for instance. And based on your name, your genetic data and a whole bunch of other factors they might decide to deny you or one of your descendants coverage.
That's just one scenario, I'm sure there are plenty of others with various degrees of chance of becoming reality.
A 'survival clause' that would guarantee destruction of your data in case the company goes out of business would be a minimum here.
But instead, 23andme says in their privacy policy:
"We may use Genetic and Phenotypic Information to conduct 23andMe-authorized scientific research and development. Any Phenotypic Information you provide is done on a voluntary basis. We may provide third party organizations access to this information for scientific research, but without your name or any other Account Information."
And that's the kicker, so your full genome gets sold to some 3rd party (you don't even get to know who) and all they do is strip off the 'meta data' regarding your person.
And AOL and NETFLIX have already shown that anonymization of data is a myth.
Your DNA is your identity. It just hasn't been tied to the meta data of your name, address and social security number, but again, with a bunch of confirmed identities of relatives that is a job that is probably doable.
I'm not good enough at math to give you the percentage of a certain population in order to be able to infer the rest, maybe someone else here can do that.
But given a population size 'n' if you get a random distribution of individuals and you know their genes and you know have a graph of relationships (say through facebook or some other means of tracing links between people) you should be able to make a formula that tells you what kind of 'coverage' you can expect based on how large a sample.
First of all, today, this is not full genome information, just your genotype. Second, if we want good molecular medicine, information like this is essential (some might argue the only way) to get good sampling and do the appropriate research.
Addendum since I can't reply to the comment. They don't quite have the technology on hand today to do full genome analysis today. I am not sure there is enough material to do whole genome sequencing with current technology (I could be wrong).
That's what they give you. But you give them your full genome.
You seem to be pretty knowledgeable here, how much information is still present in those SNP maps (in terms of bits per person)? Would an SNP map still uniquely identify an individual ?
This is also the basis for DNA forensics/paternity tests. If you sample enough SNP locations you should theoretically have a unique signature (this is where you get the courtroom statistic of 1 in 3 million)
[Disclosure: I participated in public health genomics research in grad school.]
Business Transitions
In the event that 23andMe goes through a business transition such as a merger, acquisition by another company, or sale of all or a portion of its assets, your personal information and non-personal information will likely be among the assets transferred. You will be notified in advance via email and prominent notice on our website of any such change in ownership or control of your personal information. We will require an acquiring company or merger agreement to uphold the material terms of this privacy statement, including honoring requests for account deletion.
And what about all those companies that have received copies of your genetic data from 23andme in the meantime, and their survival clauses?
I don't think it is possible to do this in a watertight way.
Also, while your name may be on the credit card used to pay for the test, and even on the test package with the saliva, since this is being done via the mail there is no way to prove it's really your DNA.
Were an insurance company to deny you based on this you could claim that you just put your name on it for convenience sake, but it really was for a friend who was concerned about using their real name because of possible abuse of DNA information.
Also, there are health benefits to sharing your genetic information and comparing it with others since the extent of genetic variation within the general population is not currently well understood becuase of limited data. Over time it is also likely that knowledge of your genetic information will become directly more relevant to your health, though, this is not currently the case. I agree that some form anonymizing procedure should be in place.
"You should be careful about sharing your genetic information with others. Currently, very few businesses or insurance companies request genetic information, but this could change in the future. While the Genetic Information Nondiscrimination Act was signed into law in the United States in 2008, the protection it will provide against discrimination by employers and health insurance companies for employment and coverage issues has not been clearly established."
So it's a law but there has not been any test of this. Let's hope the law holds up.
Read their privacy policy first, then decide if you think that 23andme does not explicitly hold open the door to do 'evil'.
edit: afterthought, in fact, any company associated with Google in that way would probably be the last party to give even more private information to, they have enough, if not too much, already.
The EU now requires fingerprints to be given with your passport application, and the Netherlands, the country where I live has added a little goodie, they're going to keep one nice big fat file with all the prints in them, in case your future self commits some crime (of course, ostensibly that's not what it is for, it is to prevent the (scary sounds) terrorists from getting passports).
Stuff like this tends to end bad, and the easiest way to avoid bad endings is to be very careful at the beginning.
I can imagine all kinds of ways in which data like this could be misused, every year there are huge breaches of the public trust with sensitive data, be it credit cards, social security numbers, 'anonymized' releases, rogue employees and so on.
It's only a matter of time before some big time problem will arise out of a DNA database and I think to caution people to not send out their data without due consideration of the possible consequences is irresponsible. What surprises me most is how the hacker community seems to be fairly gung ho about this, and rushes to take advantage of this 'bargain'.
I'm considering not renewing my passport simply because I don't want to be a 'potential suspect' in every future crime on european soil. Of course, that will make me even more of a suspect for every past crime but that's just too bad.
Sending my DNA off to some commercial third party for 'analysis' and resale (at least they're nice about that bit, they mention it in their policy) is one of the last things I would do.
Right alongside the 'genetic bullet' and the 'genocide by gene' folders.
Even if 23andme.com are responsible and take every precaution with your data, they'd still be subject to subpoenas and I sure as hell don't trust the federal government to respect data privacy when not convenient.
Thanks for taking the fun out of this Jacques... :\