Recent FTC Blog Post Has Broad Implications for Organizations Engaged in Genetic Testing

April 10, 2019

By: Linda A. Malek, Jason E. Johnson, and Khaled Mowad

Law360

View Full Article

On March 21, 2019, the FTC published a post on its business blog addressing companies involved in the sale of genetic testing kits.  While not constituting formal guidance, the blog post provides valuable insight as to the FTC’s current thinking with respect to how companies involved in direct to consumer (DTC) genetic testing can avoid engaging in unfair or deceptive trade practices.

This advice follows an FTC publication in February of 2018 addressed to consumers, also regarding DTC genetic tests.  The fact that the FTC has again published guidance in this area is some indication that the agency is closely monitoring this sector of the health and wellness industry as it continues to grow at a rapid pace. 

At the outset, the FTC acknowledged the fact that many DTC genetic testing companies are not aware that the FTC’s enforcement authority under Section 5(a) of the FTC Act gives rise to distinct regulatory compliance obligations for DTC genetic testing companies to consider, in addition to compliance with numerous state genetic privacy laws, FDA regulation, and HIPAA, as applicable.  Section 5(a) of the FTC Act (codified at 15 U.S.C. § 45) declares unlawful “Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce. . .”

Based on that broad authority, the FTC may take action when a business fails to implement or maintain sound privacy and security practices, which can lead to data breaches and misuse of consumer information.

Additionally, although not specifically mentioned in this blog post, the FTC’s prior focus on transparency relating to the effectiveness of disclosures that affect consumers should be taken into account here as well.  Specifically, the FTC held a public workshop in November 2016, which included, among other things, an examination into the adequacy of clinical trial study consent forms in providing disclosure to study participants.

The insights generated in that workshop and published in an FTC report are relevant in the context of this recent blog post as genetic test data is increasingly used in clinical trials and the FTC’s thinking in the DTC genetic testing arena may be instructive in the research study context.  In this most recent blog posting, the FTC called attention to the following distinct areas:

1. Privacy policies and specific consent

How a company offering DTC genetic testing engages with consumers is the overriding concern of the FTC’s recent advice.  Accordingly, the FTC advises that a company’s polices on genetic information be set forth conspicuously and accessibly.  Key information buried in dense legalese can form the basis of FTC enforcement action. Instead, a company should create a standalone policy addressing the use of genetic information or ensure that a larger policy sets apart such information conspicuously in another section.

The FTC’s advice here is unique in that it provides some specific suggestions about how to ensure key information is sufficiently conspicuous, namely, by use of graphics, varying colors or other visual “cues.”  This advice ties into the FTC’s blog post dated December 12, 2017 encouraging consumers to carefully scrutinize a company’s website for details about how personal data is handled, including genetic information.

The FTC advises that DTC genetic companies utilize “set-up wizards” that walk consumers through a step-by-step process allowing them to choose between various privacy options in a user friendly and visually accessible fashion.  Consumers should be given the option to opt-in to more expansive sharing settings of their sensitive data which “will reduce the likelihood that consumers will feel blind-sided by uses or disclosures of their sensitive information they didn’t expect.”

The FTC guidance summarized here is in line with growing consensus around what constitutes best practices for obtaining consent for genetic testing.  On the state level, genetic testing companies must consider the varying requirements imposed by the nearly 35 states that have passed genetic testing laws.  The laws of the most stringent of these states, including New York, Oregon, and Minnesota, are generally interpreted to require an affirmative opt-in consent for uses and disclosures that are in addition to the initial genetic testing; this might include retention of genetic information, unspecified secondary uses, research, and disclosure to third parties.

Similarly, the EU’s General Data Protection Regulation, requires express consent for the collection and use of genetic data, which must be obtained via an opt-in mechanism.   Key industry groups, such as the Future of Privacy Forum, a nonprofit privacy think tank, have also expressed the view that “separate express consent” is needed for onward transfer of genetic information.

In light of the numerous types of uses genetic information and samples and the corresponding consents needed in order to remain compliant with overlapping and potentially applicable state, federal, and international law and regulation, the FTC is encouraging an approach that enables consumers to best understand and control their choices in a manner supported by growing consensus.

2. Access to customer profiles and settings

The FTC also advises that genetic testing companies clearly disclose who has access to customer profiles in situations where a testing company allows customers to create profiles potentially containing personal information accessible by other users.  Some genetic testing companies, such as those that are lifestyle oriented, may find that customers are interested in engaging with one another on the testing company’s platform.

When personal information contained in consumer profiles is accessible by other users who are not customers, but are instead researchers or marketers, for example, the DTC genetic testing company may be violating the rights of consumers unless proper disclosure or consent has been made or obtained.

3. Third party disclosures; deletion of genetic information

The FTC reiterates that organizations performing genetic testing companies (both those involved in DTC genetic testing and otherwise) must adequately and fully describe their practices for sharing consumer information.

The FTC discussed the fact that some consumers may not realize that when they purchase a genetic test from a genetic testing company and provide a biosample, that company now has a physical sample (e.g. saliva) as well as the related genetic information derived from testing the sample.  A company’s privacy policy should address both genetic information and biosamples in tandem.  This distinction is particularly salient in light of the fact that many state laws also fail to address this distinction, leaving commentators to interpret terms such as “genetic sample” to mean both genetic information and biosamples.

4. Accurate representations regarding efficacy

Genetic testing companies must be careful to refrain from overstating or misrepresenting what a genetic testing kit can do.  Making false or misleading claims regarding a genetic testing kit marketed to the public can result in an enforcement action by the FTC under the FTC Act’s prohibition against the dissemination of false advertisements.

Case law and FTC policy interpreting the FTC Act have elucidated the principle that claims about a product must be backed by “competent and reliable scientific evidence.”[1]  Scientific claims in particular must be backed by “tests, analyses, research or evidence based on the expertise of professionals in the relevant area, that have been conducted and evaluated in an objective manner by persons qualified to do so, using procedures generally accepted in the profession to yield accurate and reliable results”[2].

In its advice, the FTC specifically reiterated these standards.  Claims that a genetic testing kit provides benefits related to health, safety, or performance require competent and reliable scientific evidence.  For example, a claim that a test is “clinically proven” must be backed by actual clinical trial data.  Genetic testing companies that look to “personalize” healthcare by recommending, for example, specific regimens of supplements tailored to the individual based on the results of a genetic test, must be particularly careful when making a claim that a recommended regimen can protect against serious disease.

In this arena, the FTC defers to the CDC and FDA, which have said that they do not know of any valid scientific studies showing that genetic tests can be used to effectively recommend nutritional choices or to genetically customize dietary supplements or cosmetics.

Similarly, some genetic testing companies may provide tests which can be used to indicate the effectiveness of certain drugs or therapies for particular conditions based on a person’s genetic makeup.  While current medical research may substantiate differences in drug effectiveness based on genetic factors, the FTC again defers to federal experts who have said that while these tests provide information helpful to a medical professional, they are not a substitute for a physician’s judgment and clinical experience.

In light of these recent FTC blog posts, entities involved in performing genetic testing should review their privacy policies, marketing materials, consent forms and procedures for obtaining consumer consent to take into account what appears to be increased interest in the genetic testing arena on the part of the FTC.  In particular, recommendations from the FTC regarding visual cues are a new suggestion from the agency, and although detailed, are not specific in terms of implementation guidance, potentially giving the FTC broad latitude from an enforcement perspective.

 

[1] See, e.g., Bureau of Consumer Protection, Fed. Trade Comm’n, Dietary Supplements: An Advertising Guide for Industry 9 (1998), https://www.ftc.gov/system/files/documents/plain-language/bus09-dietary-supplements-advertising-guide-industry.pdf.; Novartis Corp., 127 F.T.C. 580, 725 (1999).

[2] 16 CFR § 260.2