The Government agrees that it is important to have a strong data protection framework governing genomic data in the UK. The Information Commissioner’s Office (ICO) is the regulator for the UK’s data protection law and it must be adhered to by DTC genomic testing companies. The law is based on high-level principles which are designed to be technology neutral. This means that new technologies, or existing technologies used in new and different ways, will still be subject to these principles. The principles can be applied successfully across any sector, including the DTC genomic testing sector. Therefore, data protection law in the UK can be applied in a proportionate manner to ensure that personal data generated by DTC genomic testing is in a lawful and fair manner, is kept securely, and is protected in line with the principles. There are a number of different guidance documents about the Data Protection and the UK General Data Protection Regulation on the ICO website here. For DTC genomic testing, the data being created is genetic data about the individual which is considered ‘special category data’. Special category data gets extra protections applied to it. This includes a requirement for ‘explicit consent’ from the individual for their personal data to be used. Although ‘explicit consent’ is a term used in data protection law, it has not been specifically defined. However, any explicit consent given by the individual for their personal data should be in line with the definition given to ‘consent’ as a minimum. In practice, the extra requirements for consent to be ‘explicit’ when processing special category data, such as genomic data, are likely to be: • That explicit consent must be confirmed in a clear statement (whether oral or written), rather than by any other type of affirmative action; • That it must specify the nature of the special category data that will be used; and • That it should be separate from any other consents you are seeking – i.e. consent received for other types of personal data cannot be considered to apply to the special category data. A separate ‘explicit’ consent will need to be given by the individual for their special category data to be stored and used. For more detailed information on what constitutes a valid consent the ICO has published guidance here. In terms of DTC genomic testing, consideration needs to be given to the transparency information that must be provided. Individuals have the right to be informed about the collection and use of their personal data. Furthermore, the personal data must be used in a way that is fair to the individual and their situation. With regards to the potential consequences and inferences that can be made to and about others (such as relatives), when an individual gives explicit consent to their own personal genetic data being used/ created through a DTC genomic testing firm, there is currently no specific requirement to inform individuals involved about these potential consequences. MHRA’s public consultation includes a question on whether the UK should introduce requirements for companies to inform consumers of the nature, significance, and implication of genomic tests. The results of this will help to inform future policy regarding this issue. In respect of the complexity and uncertainty around the future uses of genomic data, it should be noted that UK law requires that the purposes of processing personal data must be clear from the start. This requirement aims to ensure that the reasons for obtaining personal data, and any intended processing of that data are clear from the point of collection and remain in line with the reasonable expectations of the individuals concerned and goes some way to protecting potential scope creep around the use of collected genomic data. If an organisation intends to transfer an individual’s personal data, specifically in this instance their genomic samples, outside of the UK, UK law would restrict that, unless the rights of the individuals in respect of their personal data are protected in another way, or one of a limited number of exceptions applies. The Government will keep this recommendation under review and explore with the ICO whether further guidance in this area is necessary.