Law enforcement matching now opt-in only

Informed consent is the essential underpinning of ethical DNA testing and results-sharing. All persons who test have the right to make their own individual choices about testing and about the uses to which their DNA results will be put — including its use by law enforcement to fish for suspects in criminal investigations.

And, late last night, the third-party DNA tools site GEDmatch gave its users that right back.

In a stunning reversal of course, GEDmatch updated its terms of use late last night to change its entire system for allowing law enforcement to access its database to match crime scene test kits to kits uploaded by genealogical users: only those persons who affirmatively opt in to that use will be matched to police-uploaded kits. (Update note: BUT see also see also The choice that really isn’t.)

The change came after a firestorm over the decision of the site owners, disclosed in recent court papers, to allow an exception to their published terms of use in a Utah case without informing site users or obtaining informed consent to such an exception. The terms had limited law enforcement access to matching information to cases of murder or sexual assault only, and the case did not fall into those categories. The failure to follow the site’s own limits led The Legal Genealogist just this week to withdraw any prior recommendation to use GEDmatch for genealogy.

The new terms of use will allow broader law enforcement use of the website — in cases of “murder, nonnegligent manslaughter, aggravated rape, robbery, or aggravated assault” — but also created new privacy settings under which kits will not be exposed to law enforcement use until and unless each kit owner opts in to such access.

Prior to the change in the terms, users could select from three levels of privacy: a private kit could not be used for any comparison to any other kit; a research kit could be used for comparisons to other kits but would not show up on match lists (and therefore should not show up on match lists for criminal investigation kits); and a public kit would be displayed on match lists for any other kit, public or research.

Public kit owners were not given any option to continue to use the site freely and openly for genealogical research without simultaneously allowing the use of their match information for criminal investigations. Everyone who wanted to use the site fully for genealogy was, in effect, opted-in to law enforcement access whether he or she wanted to opt in or not.

That changed last night.

Under the terms of the change, GEDmatch now has four levels of privacy from which to choose — Private, Research, Public + opt-in and Public + opt-out.

‘Private’ DNA data is not available for comparisons with other people. It may be usable in some utilities that do not depend on comparisons with other DNA.

‘Public + opt-in’ DNA data is available for comparison to any Raw Data in the GEDmatch database using the various tools provided for that purpose.

‘Public + opt-out’ DNA data is available for comparison to any Raw Data in the GEDmatch database, except DNA kits identified as being uploaded for Law Enforcement purposes.

Comparison results, including your kit number, name (or alias), and email will be displayed for ‘Public’ kits that share DNA with the kit being used to make the comparison, except that kits identified as being uploaded for Law Enforcement purposes will only be matched with kits that have ‘opted-in’.

‘Research’ DNA data is available for one-to-one comparison to other Public or Research DNA. It is not shown in other people’s ‘one-to-many’ results lists. The Raw Data that you uploaded is not made available.

What this means, we are told, is that all public kits will be in Public + opt-out status until and unless the kit owner changes the kit to Public + opt-in status. A banner placed on GEDmatch’s landing page last night now reads: “EFFECTIVE IMMEDIATELY, ALL DNA KITS HAVE BEEN SET TO BE OPTED-OUT OF MATCHING BY LAW ENFORCEMENT. WITHIN THE NEXT FEW DAYS, WE WILL PROVIDE A MEANS FOR THE PERSON WHO UPLOADED A KIT TO OPT-IN FOR THAT KIT, IF THEY DESIRE TO DO SO.”

The new system fully conforms to all legal definitions of informed consent — particularly in light of the candid admission in the terms that GEDmatch can’t promise there won’t be new non-genealogical uses of the site someone figures out in the future that nobody is even thinking of today — and to the provisions of the European Union’s General Data Protection Regulation (GDPR) as well.

And it’s a good, right, ethical decision. Doing as much as any website can to protect the trust of genealogists that their DNA data will be used only for the purposes to which they personally consent leaves the entire field on firmer ethical ground.

There is nothing whatsoever wrong with any individual’s decision to choose to allow law enforcement to use his or her data to solve crimes. Anyone who wants to will be able to make a DNA kit at GEDmatch Public + opt-in.

But there is also nothing whatsoever wrong with any individual’s choice not to allow such use. And those folks will be able to leave their kits as is, in the Public + opt-out status. This of course will also protect the data of those who aren’t aware of the issue, or no longer access GEDmatch, or have passed on without having the chance to make a choice about the use of their data.

What is wrong is having anyone who isn’t a judge and isn’t operating within the confines of the law and the Fourth Amendment taking on the role of making those choices for others.

Let me repeat something here: informed consent is the essential underpinning of ethical DNA testing and results-sharing.

As set out in the new DNA standards and ethical rules adopted by the Board for Certification of Genealogists, ethical genealogists do not make decisions for others, but instead make full disclosure of the risks and benefits and then “request and comply with the signed consent, freely given by the person providing the DNA sample or that person’s guardian or legal representative.” And it is now a written standard that “Genealogists share living test-takers’ data only with written consent to share that data.”

This isn’t a new concept. The Genetic Genealogy Standards, widely accepted by the genealogical community after they were formulated in 2015, provide much the same limitation, that “Genealogists only test with companies that respect and protect the privacy of testers.”

So this whole issue really isn’t about wanting to solve crimes or not.

This is all about choice.

Real choice.

Choice based on informed consent, on an active, opt-in basis.

The only truly ethical way to go.

Cite/link to this post: Judy G. Russell, “GEDmatch reverses course,” The Legal Genealogist (https://www.legalgenealogist.com/blog : posted 19 May 2019).

SOURCES