Private equity wants to own your DNA

The nation's largest private equity firm is interested in buying your DNA data. The going rate: $261 per person. That appears to be what Blackstone, the $63 billion private equity giant, is willing to pay for genetic data controlled by one of the major companies gathering it from millions of customers.

Earlier this week, Blackstone announced it was paying $4.7 billion to acquire Ancestry.com, a pioneer in pop genetics that was launched in the 1990s to help people find out more about their family heritage. 

Ancestry's customers get an at-home DNA kit that they send back to the company. Ancestry then adds that DNA information to its database and sends its users a report about their likely family history. The company will also match you to other family members in its system, including distant cousins you may or may not want to hear from. And for up to $400 a year, you can continue to search Ancestry's database to add to your knowledge of your family tree.

Ancestry has some information, mostly collected from public databases, on hundreds of millions of individuals. But its most valuable information is that of the people who have taken its DNA tests, which totals 18 million. And at Blackstone's $4.7 billion purchase price that translates to just over $250 each. 

Traditionally, Ancestry has specialized in family tree information, leaving the personal and predictive health piece of DNA testing to competitor 23andMe and others. But it recently has pivoted into health offerings as well. And the Blackstone merger is likely to supercharge that shift.

"Looking ahead, in collaboration with Blackstone, we will continue to leverage our unique content, powerhouse consumer brand and technology platform to expand our global Family History business while bringing to life our long-term vision of personalized preventive health," Ancestry CEO Margo Georgiadis said in the press release announcing the sale. 

The Blackstone executives quoted in the press release said they were interested in "product development" and "accelerating Ancestry's growth" in making the acquisition.

And that's what has some privacy experts nervous about the deal. Alan Butler, interim executive director and general counsel of the Electronic Privacy Information Center, said U.S. rules around how personal health data can be used are outdated, mostly relating to traditional health providers like hospitals but not a commercial service like Ancestry. 

"The big concern when there is a big deal like this is that investors might be interested in that data for other reasons, and not in the ways that consumers intended when they gave over that information," said Butler.

Who controls your DNA data?

Blackstone emphasized through a spokesperson: "We are deeply committed to ensuring that Ancestry has world-class consumer privacy and cyber security protections, and we intend to support the company's continued, significant investments in those areas." 

The spokesperson said Blackstone will "not have access to user DNA and family tree data" or be able to share that data with its other companies in its investment portfolio.

A spokesperson for Ancestry added: "Protecting our customers' privacy and being good stewards of their data is Ancestry's highest priority and the relationship between Ancestry and its users remains the same under our new ownership. That includes Ancestry's terms and conditions and privacy statement and our commitments to protect our customers' personal data."

The spokesperson said that Ancestry customers "always maintain ownership and control over their own data" and that Ancestry doesn't share that data or sell it to others." The company said it doesn't have any plans to change that policy under new ownership.

As with all personal data, there's growing concern recently about privacy issues, especially health data. 

Last year it was revealed that Google, in what the tech giant called "Project Nightingale," had partnered with Ascension, one of the nation's largest health systems, to collect data on millions of Americans in an early effort to design an artificial intelligence-powered health care service. 

More recently, various hacks and data breaches have raised security issues related to having genetic data stored — and searchable — in massive databases. 

Digital genetics firm GEDmatch, which allows users to search its database for matches, revealed in July that a hack had given law enforcement officials access to its entire database. The company had promised users the ability to opt out of sharing their data with law enforcement. At the time, GEDmatch told tech website Tech Crunch that customers' data had only been available to law enforcement for a couple of hours, and that the company had quickly informed users and put new controls in place.

Under new ownership

Erin Murphy, a professor and privacy expert at New York University School of Law, described Ancestry's record of protecting its user data from law enforcement as "good." She said that in the past the company has not shared customers' data and has fought to keep it private. 

Earlier this year, CNET reported that Ancestry had received — but denied — a request by law enforcement officials last year for access to its genetic database. The request for the information was apparently dropped.

But policies could change with new ownership, NYU Law's Murphy said. "Private equity firms have businesses across industries with a duty to their investors to maximize profits, and the whole idea for collecting a large amount of personal data is to leverage it across different business lines," Murphy said. 

What's more, privacy concerns around DNA data can be much greater than other types of personal data. "It has an enduring quality that an address or whether I like Pokeman doesn't have," Murphy explained. "You can change your credit card information or even your name. You cannot change your DNA."