Ryan J. Foley of Associated Press reports:
Bakir Hajdarevic didn’t have to study for the most important test in a class last fall. He just had to spit — a lot.
The 19-year-old freshman at the University of Iowa took an honors seminar on personal genetics in which students had the option of sending saliva samples so a testing company could use DNA to unlock some of their most personal health and family secrets. The results would tell them how likely they were to get some forms of cancer, whether they were carriers for genetic diseases, where their ancestors came from, and a trove of other information.
At least one professor did not just jump on any bandwagon to offer a course.
University of Iowa professor Jeff Murray has been teaching human genetics for 25 years and developed last fall’s class after reading about similar ones elsewhere. He talked through the pros and cons of testing with students, and spent two class periods examining 23andMe’s consent form. Murray encouraged students to consult with their parents, though their consent was not required — students were all 18 or older. Only a few opted out after they or their parents raised concerns.
Read more on Press-Citizen.com.
Hopefully, any papers students might write for these college courses based on their testing results: (1) are not uploaded to TurnItIn, and (2) do not become part of any information a university might disclose to law enforcement as part of a background check on a gun permit application. But is this information even available to the college? If you’re a privacy advocate, you’d hope not, but what prevents that possibility? We’ll get back to that in a moment.
Even if the college does not receive or obtain students’ information, are they really prepared to deal with revelations that may be devastating to students or their families? I’m pretty sure colleges can come up with waivers that eliminate any obligation or duty on their part for students who consent to undergoing testing as part of a course, but as our knowledge of genetics continues to evolve and progress, how will a college respond if a student comes to them and says something like, “I found out I’m genetically loaded for psychopathology.” Will colleges use that information to try to discourage or get rid of students? The Genetic Information Nondiscrimination Act (GINA) of 2008 prohibits discrimination in employment and insurance. As far as I know, it says nothing about what colleges and universities can do with student information.
Testing can be of benefit to some people – as one of the examples in Foley’s story indicates. But it also carries with it certain risks.
Foley’s report also includes an interesting statement:
23andMe has offered universities discounts on the testing for the classes, along with course materials, and has partnered with dozens of universities and high schools.
“Partnered?” Does that make them a business associate or put them under some contractual obligation to adhere to FERPA? I appreciate that the professor mentioned in the story spent two class periods discussing their consent form, as their privacy policy makes clear there’s a lot to consider. To their credit, 23andMe has a fairly plain-language, although lengthy, privacy statement. The section on “Information Sharing” does not specifically mention colleges or schools as “partners” with whom they may share information, but their list is not exhaustive, and a section of permitted disclosures says:
Commercial partnerships. 23andMe may enter into commercial arrangements to enable partners to provide our Service to their customers and/or to provide you access to their products and services. We will not provide any individual-level Personal Information to these commercial partners without your explicit consent. 23andMe may include your Genetic and/or Self-Reported Information in Aggregated Genetic and Self-Reported Information disclosed to these commercial partners even if you have not given consent for your data to be used in 23andWe Research.
Well, what does that last bit mean? Hopefully, the professors and students know whether it means that 23andMe can give self-reported information to the schools, but I would prefer to see a separate subsection specifically addressing what happens to to those who enroll through a college partnership or course.
23andMe is not the only company out there, of course, and I do not mean to imply in any way that they raise more privacy concerns than similar firms. But this story raises a lot of questions about student privacy, and it would be nice to see some education lawyers analyze how FERPA might apply to schools that “partner” with these firms to offer testing as part of academic courses.