On November 7, 2024, the Information Commissioner's Office (ICO) announced that it had published a report examining the privacy and data protection issues of genomics. The ICO explained that the report shows that genomics could one day impact everyday life, highlighting the need for a Privacy by Design approach that supports innovation while safeguarding privacy.

What does the report cover?

The report considers the regulatory and privacy issues raised by the wider development of genomics and discusses various scenarios to illustrate potential data protection concerns, including:

• data security: some genomic data is highly personal and nearly impossible to anonymize, raising risks of misuse or re-identification if mishandled or improperly shared;
• discrimination or bias: using genomic data in areas like insurance or law enforcement could lead to systemic discrimination, particularly if combined with models that may reinforce existing biases;
• transparency and consent: the sharing of data between organizations in sectors like healthcare can make it difficult for individuals to understand how their genomic data is used and for what purpose;
• family sharing: genomic information inherently relates to family members, meaning data shared about one person could inadvertently reveal sensitive information about another; and
• purpose of use: the potential expansion of genomic data use beyond its original purpose leads to concerns around data minimization and purpose limitation.

Further, the report highlights the challenges of understanding when genomic data may be considered personal information. According to the report, genomic information relating to the deceased, or once thought unimportant or even unidentifiable in terms of personal information, may have an increasing significance according to research.  

To address the aforementioned areas of concern, the report notes that the ICO will:

• engage with key stakeholders across industry, regulation, academia, and civil society. This will include inviting organizations to work with the ICO's Regulatory Sandbox to engineer data protection into uses of genomic information;
• monitor and highlight developments in the area of genomics through the ICO's Tech Horizons reports, which will set out future programs of work on the issues as they arise. The ICO will pay particular attention to the sharing of third-party genomic information and direct-to-consumer genomic services linked to polygenic risk scoring; and
• engage with the public to better understand their knowledge and concerns about the use of genomics and privacy.

You can read the press release here and the report here.