Is one allowed to get someone's genetic information and use it without explicit permission?

Question

Inspired by the movie Gattaca, and how sites like Ancestory.com actively help find criminals who haven't submitted their DNA simply by using relatives who have willingly submitted their DNA.

Say that Bob the biochemist obtains (without explicit permission) a DNA sample from David (either a piece of hair that fell off, or some stray skin cells, or a used cup that David threw away, etc.). Is Bob allowed to use David's DNA? Some examples of how David's DNA could be used:

1. Finding out that David is the true father of Bob's child
2. Finding out that David has increased risk of many diseases, and telling David's girlfriend/employer/health insurance company about this
3. Finding out that David's DNA is a match for DNA at a crime scene, and reporting that to the police.

On one hand, it seems like a tremendous breech of privacy. But on the other hand, it seems as "natural" as announcing someone's apparent age to the world. Both are "surface level" things that anyone can have access to so long as David isn't shut up inside a bunker. I'm not sure what the official answer is.

I'm obviously not a biologist or lawyer, so please consider answering the "spirit" of the question, instead of the "letter" of the question, in case I haven't gotten the reality of things exactly straight.

Answer 1

In the United States, the Genetic Information Nondiscrimination Act (GINA) restricts employers and health insurers and employers from denying coverage, providing coverage under a higher premium or refusing to hire based on genetic information which indicates a genetic predisposition to developing a disease in the future. In the most recent amendment, Employers are permitted to collect genetic information of employees and dependant spouses for wellness programs provided that it is clear that the program is voluntary, the employee is not denied health care for non-participation, and adverse employee actions are not used to punish non-participation or coerce participation in such a program.

Further, Health Insurance and providers may not sell a customer's genetic information without the consent of the customer, and may not request such consent as part of enrollment.

In terms of evidence collection, Police must have a warrant to seek a genetic sample from a suspect unless consent of the suspect. Any genetic evidence collected without consent or a warrant subject to the same rules of evidence collection as any other evidence (i.e. must be plain view and collected from a space where no reasonable expectation of privacy is expected. If a cop offers you a soda or coffee while you're in interrogation, they can swab the cup for a sample when you throw it away.).

A recent development in DNA evidence is that cops have sent samples to personal genomics companies such as Family Tree DNA to help identify unknown samples of suspects collected from crime scenes. Such companies offer customers the service of creating a family tree based on genetic samples submitted by the customer. While the suspect might not be in the database, a close familial link may be uncovered that could help identify a sibling, cousin, or other genetic familial relationship of the suspects and narrow the suspect lists. In one of the earliest examples, two nearly 20 year old rape cases were solved in 2019 when the suspects DNA was a 100% match to a sample submitted by the suspect's identical twin brother. While the brother was originally a suspect, additional detective work was needed to identify which of the twins was the perpetrator. That, narrowing down the suspect field to two people was a huge development in the cold case.