The DNA in your garbage: up for grabs

Drop a hair? Anyone can legally sequence your genetic material—and privacy experts want to close that gap.

What can they do with that information?

Instinctively, it feels like the answer should be "nothing"—that the DNA is yours, and anyone who uses it without your permission has crossed a line. Those molecules contain data about your heritage, your appearance, your predisposition to disease—all kinds of secrets you had no intention to release to the world when you threw your cup away.

But the legal reality is something quite different: Your DNA has just entered a gray area.

"In general the idea is anything you intentionally relinquish to the public, to scavengers, in the garbage, is free for anyone," said Elizabeth Joh, professor of law at the University of California Davis. This is true for your hard drive, your diary, your credit card statements—and it’s true for your DNA, regardless of whether you realize you’re casting it aside.

Legal scholars call this material "abandoned DNA," and Joh is one of a handful of thinkers saying it’s time the law reckoned with what rights we have to this trove of extremely personal information. Detritus containing DNA was effectively useless to most people two decades ago. But today it is becoming faster and cheaper to sequence fragments of DNA—revealing the unique genetic material that begins to make us who we are—and the law has yet to catch up. State laws are a patchwork of regulations, and most jurisdictions, including Massachusetts, are mum about the privacy status of the DNA we leave behind us every day.

Legal scholars argue that the free-for-all status of abandoned DNA poses an immediate threat to our privacy, not just because of problems that might arise down the line, but because of abuses that are already possible. The problem is hard to solve because abandoned DNA doesn’t fit neatly into any of our existing legal categories: We have a strong expectation of privacy about our medical records, and state and federal laws increasingly protect genetic information; by contrast, simple property left behind belongs to anyone who picks it up. The DNA we leave behind is neither and both: It is garbage that also contains vital information. And right now, as far as the law is concerned, it is essentially fair game.

***

TO THE EXTENT that the legal system is grappling with abandoned DNA, it’s chiefly in the criminal realm. Police are making more active use of DNA all the time, collecting and storing the information it contains, and a vigorous debate is underway about the privacy rights we have over our DNA in the context of an investigation. Later this spring the Supreme Court will decide, in the case Maryland v. King, whether the police can force a suspect to give a DNA sample when he or she has merely been arrested—but not yet convicted—for a crime.

"Abandoned DNA" comes into play when the police don’t have a DNA sample, and can’t force a suspect to give one up. In Washington in 2003, police posed as a fictitious law firm and sent a letter with a return envelope to a murder suspect named John Nicholas Athan, inviting him to participate in a fake class-action lawsuit. He replied, and police lifted DNA from Athan’s saliva on the seal of the envelope and used it to convict him of the killing. The Washington State Supreme Court reviewed the technique and ruled it permissible, explaining that as soon as a letter goes in the mail, "The envelope, and any saliva contained on it, becomes the property of the recipient."

What might at first seem like clever police work strikes Joh as a very slippery slope. In treating DNA the same way we treat the envelope it came on, she suggests, we miss some important differences. First, DNA is uniquely hard to hang onto: It’s in stray hairs and on chewing gum, and we constantly give it away without choosing to. "What can a person do to so stop shedding DNA?" she asks. Second, there is a meaningful difference between physical objects that contain DNA and the information encoded on them. The former is just spit on the sidewalk; the latter reveals facts about us that we may not even want to know ourselves, and we’d like to think that the law can also make that distinction.

That might sound very subjective—that the difference between a molecule of gum and a molecule of DNA is how we feel about it—but privacy law does sometimes hinge on just that. In a landmark 1967 decision, the Supreme Court expanded Fourth Amendment rights, which prohibit illegal searches and seizures, to include what Justice John Harlan called the "reasonable expectation of privacy"—which, to genetic-privacy advocates, clearly applies to DNA.

"Your DNA is like your house, it’s as private as you can get," said Sheldon Krimsky, professor of urban and environmental policy at Tufts University and author of the book "Genetic Justice." "It has information about you, your family, your siblings. I think individuals, if given an understanding of what’s in their DNA, would have an expressed expectation of privacy."

One proposal for how far privacy law should protect our DNA came recently from David Gusella, a third-year law student at Boston College. In an article in the Boston College Law Review in March, he pointed out that when police pick up abandoned DNA, there should be a clear limit to the information they can draw from it. They should be allowed to sequence it for traits related to appearance (because, he argued, we can’t reasonably expect our appearance to remain private when we step out in public) but not anything beyond that. Other scholars argue, however, that it’s more effective to set limits on when the police can even collect DNA—because once they have it, it’s unrealistic to imagine they will use some parts and not others.

While people are talking about law enforcement uses of abandoned DNA, there has been almost no debate about another potential risk: private individuals taking each other’s genetic material. Joh is one of the few scholars working on the issue. She argued in the Boston University Law Review in 2011 that sequencing someone else’s genome without consent should be classified as felony theft—a charge whose seriousness would help establish social and legal norms recognizing DNA as an exceptional kind of property.

Genetic material does enjoy some protections, in theory: Eleven states have genetic information laws that are written broadly enough to conceivably punish someone for sequencing another person’s genetic information without consent. (In 2011, Massachusetts legislators considered a sweeping Genetic Bill of Rights that would have protected abandoned DNA, but the legislation never became law.) But the penalties are minimal, and no cases have been brought under the laws.

Still, even if DNA theft by private citizens might sound like science fiction, it has happened. In 2002, film producer Stephen Bing was implicated in a paternity suit after private investigators hired by billionaire Kirk Kerkorian used DNA from Bing’s discarded dental floss to prove that he (and not Kerkorian) was the father of a young child. Similarly, in 2002 British police thwarted a scheme to use an attractive woman to take a strand of hair from Prince Harry—with the intention of using it to prove that he was not in fact Prince Charles’s son. In 2006, the United Kingdom became the first country to pass a law that made it illegal for private citizens to sequence another person’s DNA without permission.

***

OTHER POTENTIAL ABUSES of abandoned DNA are currently possible but still untried. George Annas, a bioethicist Boston University, wrote in the New England Journal of Medicine about how abandoned DNA could be exploited by political campaigns to reveal embarrassing facts about their rivals. (Imagine the headlines that would have resulted if, in 1984, Democratic operatives had been able to show that Ronald Reagan carried the ApoE gene, which conveys a high risk for Alzheimer’s.)

Joh thinks that a first step in encouraging courts and legislatures to grant greater protection against unauthorized DNA analysis is to stop calling the genetic material "abandoned" in the first place. "People think, well, if it’s abandoned, why should I worry about it?" Joh proposes the more provocative label of "DNA theft."

This semantic struggle points to an underlying challenge: We’re still just beginning to understand what DNA means to us. Is it just a molecule, or is it us? Until we have a better sense of what our DNA really tells us, what it can and can’t reveal about a person, it’s going to be hard to pin down exactly how it should be treated legally.

Given this still emerging picture, experts agree that privacy rights around abandoned DNA are unlikely to change anytime soon. Krimsky, for one, thinks it will probably take a scandal. "There hasn’t been a good enough case where there’s enough damage done," he said. "I guarantee if there was a political candidate who had his DNA taken by a citizen and his political life is ruined, you’d see some action taken."

Kevin Hartnett is a writer who lives in Ann­Arbor, Mich. He can be reached at kshartnett18@gmail.com.