AncestryDNA angers privacy campaigners

Privacy campaigners have criticised genealogy company Ancestry.com for continuing to keep customers' DNA data.

The move comes despite the firm axing a controversial "perpetuity clause" from its terms and conditions.

In May, Ancestry told BBC Radio 4's You and Yours programme these terms were being changed after users complained.

It has now emerged that while Ancestry did change the wording of its small print, in practice users' DNA records are still not deleted unless requested.

The UK's data protection watchdog, the office of the Information Commissioner, told the BBC that while the law doesn't set out a specific time period for routinely deleting individuals' DNA profiles, companies should not keep personal data for longer than necessary.

Ancestry.com denies exploiting users' DNA

Based in Utah, AncestryDNA tells customers about their genetic ethnicity through saliva samples and claims to have more than four million DNA profiles in its database.

The company's terms and conditions formerly granted it a "perpetual, royalty-free, worldwide, sub-licensable, transferable licence" to users' DNA data, for purposes including "personalised products and services".

Following criticism of its plans to keep DNA samples forever, the company removed the offending word, "perpetual".

"Customers own their DNA and data and control what we do with it," a representative told You and Yours.

"AncestryDNA does not claim ownership rights in the DNA that is submitted for testing," they added.

However, a fresh analysis of the terms and conditions has revealed that the company's default policy is still to keep users' data unless otherwise instructed.

More than four million customers worldwide have used AncestryDNA, which requires users to send a saliva sample for testing

British customer Richard Peace is taking no chances.

He enjoyed using the service but is now worried about the security of his data in the years ahead and has asked Ancestry to delete his DNA records.

"If they've only taken out the word, 'perpetuity,' but are still carrying on in practice, that's a little bit disingenuous I feel," he told the BBC.

'Only superficial'

Privacy protection lobby group Big Brother Watch agrees.

"There is no need for Ancestry DNA to hold on to this information any longer than is necessary after they have given back the results," said a representative.

"Your DNA is one of the most sensitive and personal pieces of data about you."

New York data protection lawyer Joel Winston, who spotted the original "perpetuity clause", was surprised.

"Ancestry changed their terms of service. But it seems the changes were only superficial," he said.

Ancestry warns "there may be additional risks to participation that are currently unforeseeable"

"This should remind consumers that they need to be wary of any terms and privacy policies that they agree to, due to complications and future risks."

• How DNA-testing kits are becoming big business

• Ancestry.com denies exploiting users' DNA

Risks

For those who read the small print, those risks are set out by Ancestry in its Informed Consent document.

The company explains that it shares users' DNA data with non-profit, business or government "collaborators", some of whom pay for the information.

"There is a potential risk that third parties could identify you from research that is made publicly available," the company warns, adding there is also "a potential risk that the samples could be lost or taken while in transit or storage".

It explains that while person-specific features are removed from users' records, DNA "can be used as an identifier in combination with other information".

It adds: "There may be additional risks to participation that are currently unforeseeable."

Responsibility

Emily Taylor, editor of the Journal of Cyber Policy, argues the Ancestry row has developed because the law puts the burden of responsibility on the consumer.

"I don't necessarily think it's the right way to do things. I think data should actually time expire," she told You and Yours.

"But with the law as it is, and as it's going to be for the foreseeable future, it's up to users to decide whether or not they want their data deleted."

A spokesman for the company told the BBC: "Ancestry has an ongoing relationship with each of its members and strives to deliver value over the course of the relationship."

You and Yours is on BBC Radio 4 weekdays 12:15-13:00. Listen online or download the programme podcast.