Section E: Ethics (20 Marks) - Answer in the spaces provided

'Glaring Gap' Seen in DNA Privacy Pledges by 23andMe, Ancestry

Genetic-testing companies that have decoded the DNA of millions just introduced new guidelines to protect data privacy.

But those best practices failed to address a major concern: what happens to customers' data that is shared for research with pharmaceutical giants, academics and others, often for a profit.

Just how lucrative the business of genetic testing is came to light last week when British drugmaker GlaxoSmithKline Plc agreed to buy a $300 million stake in 23andMe Inc., gaining access to anonymized data with the hope of identifying new targets for drugs. That kind of data -- stripped of identifying details and aggregated -- isn't strictly subject to new rules in the guidelines unveiled this week. That means consumers will still have little way to know when and how their information is combed for research.

"This new policy is a positive step forward in the sense that it's starting a conversation," said James Hazel, a researcher at Vanderbilt University in Nashville, Tennessee, who recently surveyed the privacy policies of 90 direct-to-consumer genetic-testing companies. "The glaring

gap is that it doesn't apply to de-identified genetic data."

...

But most genetic-testing companies, like social networks before them, have also made a business out of DNA data collected from customers. They have partnerships with companies like Glaxo or Pfizer Inc., giving access to their trove of data for research.

Typically, customers must opt in to having their data shared for research by signing separate consent polices. When shared for research purposes, the information is usually anonymized and aggregated. That data is exempt from transparency rules in the new guidelines, as the anonymity is supposed to protects customers.

Without more insight into how consumer data is being anonymized, though, it's difficult to tell how secure it really is, said Marc Beebe, senior director of strategic research, public imperatives, and corporate development at the Institute of Electrical and Electronics Engineers, a trade association.

Source: Bloomberg: https://www.bloomberg.com/news/articles/2018-08-02/dna-protectionpledges-fail-to-address-main-concerns-on-data-use

(a) Identify and apply the PAPA framework for ethical issues relating to the above case (20 points).