Security and anonymity: why a leak of privacy-sensitive genetic data (as happened at 23andMe) is not possible at iGene

This raises the question: could something like this also happen at iGene? The short answer is: no.

In this article we explain why it is not possible for us for privacy-sensitive information to end up in the wrong hands.

In brief:

• With us you do not create a username and password, but generate an anonymous tube code
• As a result, nobody can trace whose saliva sample has been received
• Even if unauthorised people were to gain access to our tightly secured database, they can do nothing with DNA profiles, because these are not linked to personal data
• At iGene we do not ask users for additional data and we do not map family relationships

No username and password, but an anonymous tube code

This is the most important difference between iGene and other DNA testing companies. With us you do not create an account with a username and password, but receive an anonymous tube code, which you generate randomly yourself in the iGene App. You write this tube code on a sticker that you send back to iGene with the saliva sample for the DNA analysis. In the video below you can see how that works.

Because you do not send any personal data with the saliva sample, nobody can trace whose tube has been received. Not even us. Only you know the tube code, which gives access to your DNA profile in the iGene App.

What about the security of the database?

iGene’s databases are tightly secured. But then, so are the databases of 23andMe and MyHeritage, no doubt.

For no database in the world can it be completely ruled out that hackers will, despite all security protocols, one day manage to gain access.

Take the example of 23andMe. As things stand, the system there probably wasn’t even hacked directly. It looks as though the hacker gained access by logging in with account details from other (hacked) sites. After all, many people still use the same login details for multiple websites.

With us, the core of data security lies not in security protocols, but in the security architecture; the way in which the security is designed. You may also use a username and password for other, less well-secured websites. This is in contrast to our unique, anonymised tube code.

And if unauthorised people somehow do manage to gain access to our heavily secured database? Then they simply can do nothing with the DNA profiles stored on it, because these cannot possibly be linked to individuals.

The danger of extensive and shared profiles

The potential impact of the data leak at 23andMe is extra large because 23andMe not only links someone’s personal data to their DNA profile, but also collects all kinds of other information about you by means of questionnaires. From the number of languages you speak to how often you have visited a doctor in the past year.

In addition, 23andMe offers users the option of mapping family relationships by linking profiles to each other. The data of profiles that are linked to a ‘hacked’ profile are therefore also vulnerable.

At iGene we do not ask users for additional data and we do not link profiles to each other. In the episode of VPRO Tegenlicht below, documentary maker Roland Duong explains that this is precisely why he chose to have his DNA tested at iGene.

In the episode of VPRO Tegenlicht, documentary maker Roland Duong explains that it was precisely because of the privacy and anonymity that he chose to have his DNA tested at iGene.