A major Covid-19 testing company is under investigation after revelations it plans to sell swabs carrying customer DNA to third parties.
A large Covid-19 testing company in the UK is being investigated by the country’s privacy watchdog over plans to sell swabs containing customers’ DNA for medical research.
Cignpost Diagnostics, a government-approved testing provider, has delivered up to three million tests at a cost of between £35 ($64) and £120 ($220) each since it was founded in June last year, The Sunday Times reported.
Cignpost, which trades as Express Test, said it intended to analyse the samples to “learn more about human health”, develop drugs and products or to sell information to third parties, according to company documents.
UK data protection laws require explicit informed consent for such sensitive information to be used.
Express Test offers pre-departure and arrival testing for international travellers and has 71 walk-in locations across the UK, including at its two main airports, Heathrow and Gatwick.
According to the report, customers were not clearly informed that their medical data would be used for purposes beyond Covid-19 testing.
Instead they were asked to tick a box to agree to a 4876-word privacy policy, which links to a separate document outlining the “research program”, The Sunday Times reported.
The research program fact sheet states Cignpost retains data including “biological samples … and the DNA obtained from such samples”, as well as “genetic information derived from processing your DNA sample … using various technologies such as genotyping and whole or partial genome sequencing”.
Cignpost says it combines this with “self-reported health and trait data” and “information we obtain from other sources, such as publicly available demographic information”, adding it may share DNA samples or other personal information with “collaborators”, including universities and private companies, and that it “may receive compensation”.
It was not clear how many samples had been stored or whether they had already been used for research, but Cignpost’s policy states that data is retained indefinitely. It also does not list a minimum age, suggesting children’s data is also included.
Cignpost told the Sunday Times it is “in full compliance with all laws related to data privacy” and had invested “significantly in robust systems and processes to ensure we protect our customers”
The company reportedly removed references to the research program from its privacy policy last week after the newspaper passed the information onto the Information Commissioner’s Office (ICO) and the Human Tissue Authority.
The ICO is now investigating.
“There is no personal data more sensitive than our DNA,” ICO deputy commissioner Steve Wood told The Sunday Times.
“People should be told about what’s happening to it in a clear, open and honest way so they can make informed decisions about whether they want to give it up. We’ll look carefully at the information gathered by The Sunday Times.”
.
For all the latest Technology News Click Here
