‘Glaring Gap’ Seen in DNA Privacy Pledges by 23andMe, Ancestry

Genetic-testing companies that have decoded the DNA of millions just introduced new guidelines to protect data privacy.

But those best practices failed to address a major concern: what happens to customers’ data that is shared for research with pharmaceutical giants, academics and others, often for a profit.

Just how lucrative the business of genetic testing is came into light last week when British drugmaker GlaxoSmithKline Plc agreed to buy a $300 million stake in 23andMe Inc., gaining access to anonymized data with the hope of identifying new targets for drugs. That kind of data -- stripped of identifying details and aggregated -- isn’t strictly subject to new rules in the guidelines unveiled this week. That means consumers will still have little way to know when and how their information is combed for research.

“This new policy is a positive step forward in the sense that it’s starting a conversation,” said James Hazel, a researcher at Vanderbilt University in Nashville, Tennessee, who recently surveyed the privacy policies of 90 direct-to-consumer genetic-testing companies. “The glaring gap is that it doesn’t apply...