It was a data breach of potentially epic proportions. When Cathay Pacific announced in October that its internal systems had been compromised, nearly 10 million passengers on the Hong Kong-based carrier faced the possibility that their personal data, including everything from passport details to credit card numbers, had been compromised.
However, aside from the concern, the truth is that things could have been much, much worse. Since the advent of DNA testing, which is readily available online, it is now possible for hackers to access the innermost secrets of your own life, past and future.
The threat was highlighted in June by a data breach at a major Israeli genealogy testing company, MyHeritage, which may have exposed the personal records of 92 million users. The company, which stores information about its users’ family trees and DNA, insists the breach consisted only of email addresses and old passwords, but the attack nevertheless opened the world’s eyes to an emerging threat.
In the growing Asian DNA testing space, the two biggest players – both Hong Kong-based companies – are aware of the security challenges. “We take protecting our customers’ data and privacy very seriously, and that includes managing a number of steps and protocols to ensure it remains secure,” says Peter Wong, chief technical officer of Prenetics Limited.
Prenetics is partly owned by Alibaba, the owner of the South China Morning Post, and unlike MyHeritage, its control is focused on health-related issues, the DNA testing sector that is proving increasingly popular in Asia.
Kevin MacDonald, founder and CEO of Advanced Genomic Solutions (AGS), which has an advanced testing lab in Central as well as a subsidiary in the United States, says the trend in Asian demand is moving toward health-based DNA testing.
In the melting pots of North America and Europe, consumers often prefer direct-to-consumer genetic testing (DTCGT) – tests that are widely available online and are often marketed as offering clues to a person’s ancestry. But in Asia, where there is less asymptomatic ancestry, MacDonald says consumers are more likely to turn to DNA tests that can be used to predict predispositions to certain cancers or dementia.
"We empower our customers with their genetic data to make healthier lifestyle choices, so that's our core business.".
But as demand for the services grows – industry experts predict that DNA testing will be a US$50 billion industry by 2026, much of it driven by Asian demand – so does the risk that sooner or later, there will be a high-profile hacking attack.
“In five years, we will see the number of DNA tests increase by 10 and a lot of that will be on the back of B2B [Business to Business] testing, where Asia is miles ahead of the US,” says MacDonald.
Both Prenetics and AGS are working with companies, including insurance groups and gym chains, who will offer employees and customers tests that will help identify potential health risks.
For these companies, DNA testing seems like a sound business policy to encourage healthy – and therefore more productive – employees.
However, critics say that as more companies adopt DNA testing, the potential for controlling the flow of personal data becomes increasingly complex.
Ultimately, a lot of trust is necessary, as MacDonald acknowledges. “The future and success of the entire industry depends on maintaining consumer trust, it’s really that simple,” he says.
That trust has already been eroded as several companies have admitted to sharing data with third parties. Last month, the president of FamilyTreeDNA, one of the largest at-home genetic testing companies in the US, was forced to publicly apologize after it was revealed that it secretly shared data with groups like the FBI to help solve violent crimes. A US website has published methods for deleting your data from the genetic testing site 23andMe.
Perhaps it should, given that last year pharmaceutical giant GlaxoSmithKline acquired 23andMe for $300 million with the express intention of using customers' DNA data for research.
The threat is global. Data has become the most desirable thing in the 21st century, with some of the world's largest companies, such as Facebook and Google, willing to use any method to obtain it.
Prenetics notes that despite receiving $40 million in funding from Alibaba and additional funding from Ping An, China’s largest insurance company, it does not share user data without their consent. “Our customers decide and control how the information is used and with whom it is shared,” says Wong.
“This limits access to customer data by all third parties, including our investors and business partners.”
MacDonald is even more emphatic. “We do not sell or share customer data, without exception,” he says.
With few barriers to regulating DNA testing in Asia – in any form – trust is paramount. In Japan, where government regulations are traditionally burdensome and DTCGTs are the most prevalent in Asia, there are other issues. A team working with Japan’s Science and Technology Agency found that the country’s DNA testing climate was “guidance but no regulation” and that diagnosing disorders should be accompanied by professional medical advice.
Due to the lack of regulation across Asia, customers need to understand the implications of a DNA test. If your data is stolen, you become the product and of course it is impossible to get it back.
