A major Covid-19 testing company is under investigation after revelations it plans to sell swabs carrying customer DNA to third parties.
A large Covid-19 testing company in the UK is being investigated by the country’s privacy watchdog over plans to sell swabs containing customers’ DNA for medical research.
Cignpost Diagnostics, a government-approved testing provider, has delivered up to three million tests at a cost of between £35 ($64) and £120 ($220) each since it was founded in June last year, The Sunday Times reported.
Cignpost, which trades as Express Test, said it intended to analyse the samples to “learn more about human health”, develop drugs and products or to sell information to third parties, according to company documents.
UK data protection laws require explicit informed consent for such sensitive information to be used.
Express Test offers pre-departure and arrival testing for international travellers and has 71 walk-in locations across the UK, including at its two main airports, Heathrow and Gatwick.
According to the report, customers were not clearly informed that their medical data would be used for purposes beyond Covid-19 testing.
The research program fact sheet states Cignpost retains data including “biological samples … and the DNA obtained from such samples”, as well as “genetic information derived from processing your DNA sample … using various technologies such as genotyping and whole or partial genome sequencing”.
Cignpost says it combines this with “self-reported health and trait data” and “information we obtain from other sources, such as publicly available demographic information”, adding it may share DNA samples or other personal information with “collaborators”, including universities and private companies, and that it “may receive compensation”.
It was not clear how many samples had been stored or whether they had already been used for research, but Cignpost’s policy states that data is retained indefinitely. It also does not list a minimum age, suggesting children’s data is also included.
The ICO is now investigating.
“There is no personal data more sensitive than our DNA,” ICO deputy commissioner Steve Wood told The Sunday Times.
“People should be told about what’s happening to it in a clear, open and honest way so they can make informed decisions about whether they want to give it up. We’ll look carefully at the information gathered by The Sunday Times.”
In a statement, a spokeswoman for Cignpost Diagnostics said the company “only uses customers’ DNA for Covid-19 testing”.
“All PCR Covid-19 tests are based on DNA analysis. We only use DNA for the purposes of conducting the PCR test in line with Public Health England guidelines,” she said.
“All DNA samples and data are destroyed once the Covid-19 test process is complete and data has been shared with clients and PHE.
“Our terms and conditions do not allow the use of customer DNA samples or data for any purpose other than Covid-19 testing. Any change in use of customer data would require new explicit consent.
“We apologise to our clients for any concern or confusion caused by today’s media coverage.”