By: Samy Danesh

Most people know someone who received a genetic testing kit for the holidays. In exchange for a vile of saliva, and sometimes a fee, companies sequence genomes and provide consumers with ancestral and genetic disease related information. But who owns the data, and how does that affect consumer privacy?

Companies such Ancestry and 23andMe claim full ownership of that data. Their long-term financial strategy is not the collection of fees for service. Rather, they are in the business of big data. Most recently, 23andMe gave exclusive rights to pharmacy giant GlaxoSmithKline to mine its over 5 million customer’s genetic information in exchange for a $300 million-dollar investment.

This business model is similar to other data driven companies such as Google and Facebook, where the service provider owns the information users share, and works to monetize it for profit. To use these services, individuals agree to a non-negotiable terms of service in which they give consent to broad uses of their data. These adhesion contracts result in a data-subject/data-owner relationship between the corporation and its users. Therefore, concepts like secondary-consent, choice, notice, access and control have become central to protecting the privacy of consumer’s personal information. However, emerging business models in direct-to-consumer gene-sequencing are challenging the current status-quo.

Nebula Genomics, a US based startup, is proposing to sequence users’ genes and provide them with the ancestral and medical insight similar to other gene-sequencing companies. Unlike other companies however, Nebula allows users to keep ownership of their resulting data.

Nebula utilizes eliminate the intermediary and connect data buyers directly with data owners. Once an individual has their genome sequenced, they are then given full ownership of their genetic information with the ability to share that data with interested parties. In effect, this eliminates the data-subject/data-owner relationship because the data-subject is now also the data-owner.

This business model flips the approach to privacy regulation on its head. With Nebula’s model, data-subjects can retain control over the use of their data, which results in near absolute consent in the uses of that data. Rather than agreeing to lengthy privacy statements, Nebula’s clients are empowered to write their own.

Data self-ownership opens the doors to whole new ways of sharing information. EncrypGen, Luna DNA, and other companies are creating platforms to connect data owners and interested companies, acting as a gene-data marketplace. One can imagine large “data markets” that function similar to today’s securities markets. Here, data can be pooled together in large indexes for purchase by researchers, advertising companies and other interested parties.

Additionally, a “data market” presents an opportunity for the government to create efficient and effective centralized regulation systems. Similar to the SEC’s regulation of the securities market, the government could establish consumer protections by protecting privacy, increasing transparency in data use, and providing for other policy needs.

By giving data subjects the power of data owners, this business innovation will spur a shift in the principles of data security and privacy. Perhaps, this model will sprout new social media and search engine companies to disrupt today’s largest tech sectors by providing a real option to consumers from a data privacy angle. But with the size and might of today’s tech giants, that may be wishful thinking.