A major Covid-19 testing company is under investigation after revelations it plans to sell swabs carrying customer DNA to third parties.
Cignpost Diagnostics, a government-approved testing provider, has delivered up to three million tests at a cost of between £35 ($64) and £120 ($220) each since it was founded in June last year, The Sunday Times reported.
Cignpost, which trades as Express Test, said it intended to analyse the samples to “learn more about human health”, develop drugs and products or to sell information to third parties, according to company documents.
UK data protection laws require explicit informed consent for such sensitive information to be used.
Express Test offers pre-departure and arrival testing for international travellers and has 71 walk-in locations across the UK, including at its two main airports, Heathrow and Gatwick.
According to the report, customers were not clearly informed that their medical data would be used for purposes beyond Covid-19 testing.
Instead they were asked to tick a box to agree to a 4876-word privacy policy, which links to a separate document outlining the “research program”, The Sunday Times reported.
Cignpost says it combines this with “self-reported health and trait data” and “information we obtain from other sources, such as publicly available demographic information”, adding it may share DNA samples or other personal information with “collaborators”, including universities and private companies, and that it “may receive compensation”.
It was not clear how many samples had been stored or whether they had already been used for research, but Cignpost’s policy states that data is retained indefinitely. It also does not list a minimum age, suggesting children’s data is also included.
The company reportedly removed references to the research program from its privacy policy last week after the newspaper passed the information onto the Information Commissioner’s Office (ICO) and the Human Tissue Authority.
The ICO is now investigating.
“There is no personal data more sensitive than our DNA,” ICO deputy commissioner Steve Wood told The Sunday Times.
“People should be told about what’s happening to it in a clear, open and honest way so they can make informed decisions about whether they want to give it up. We’ll look carefully at the information gathered by The Sunday Times.”
In a statement, a spokeswoman for Cignpost Diagnostics said the company “only uses customers’ DNA for Covid-19 testing”.
“All PCR Covid-19 tests are based on DNA analysis. We only use DNA for the purposes of conducting the PCR test in line with Public Health England guidelines,” she said.
“All DNA samples and data are destroyed once the Covid-19 test process is complete and data has been shared with clients and PHE.
“Our terms and conditions do not allow the use of customer DNA samples or data for any purpose other than Covid-19 testing. Any change in use of customer data would require new explicit consent.
“We apologise to our clients for any concern or confusion caused by today’s media coverage.”