Reader Comments

Post a new comment on this article

Not a Loophole: Commercial Exploitation of an IRB Error

Posted by TobinSL on 12 Jul 2010 at 06:01 GMT

Sara L. Tobin1, Sandra S-J. Lee1, Henry T. Greely2, Kelly E. Ormond1,3, Mildred K. Cho1
1Stanford University Center for Biomedical Ethics, 2Stanford University School of Law, 3Stanford University Department of Genetics


We compliment PLoS Genetics for their alert reviewers and for their wise reluctance to publish a paper using human samples and data that had not been reviewed for compliance with human subjects protections. We believe this study presents significant ethical problems, problems that might be repeated in future research involving people who fall into the complicated category of customers/research participants.

Is the company exempt from compliance with The Common Rule?

The Common Rule applies to human subjects research funded by most agencies of the federal government, carried out with the permission of the FDA, or performed by institutions, such as universities, research foundations, or commercial businesses that have given the federal government assurances that they will follow the regulation. While we are not aware of 23andMe’s legal status in this regard, the research paper does not argue that the company is categorically exempt. Regardless of the company’s status, it is appropriate for PLoS Genetics–or any journal–to require compliance with the Common Rule or its overseas equivalents.

Was the research reported in this article human subjects research?

We believe 23andMe did engage in human subjects research, despite the finding to the contrary by the commercial IRB retained after the paper was submitted. This finding was clearly in error because the 23andMe research participants interacted with the company. In addition, we believe that a strong case can be made that identifiable private information was collected for research use.

The Common Rule defines a human subject as “a living individual about whom an investigator (whether professional or student) conducting research obtains (1) Data through intervention or interaction with the individual, or (2) Identifiable private information.” The Rule continues “Interaction includes communication or interpersonal contact between investigator and subject.”

The PLoS Genetics editorial gives the following explanation for why 23andMe (and the private IRB it retained) concluded there was no interaction with the subject.

For the 23andMe study, the answer to both tests was no, ostensibly because there was never any interpersonal contact between investigator and participant (that is, data and samples are provided without participants meeting any investigator) . . .

First, the research participants are communicating sensitive information about themselves to the investigators. We know of no exemption for contact that is not face-to-face, and academic researchers are typically required to obtain IRB approval for their phone scripts, letters, surveys, e-mails, and on-line communications.

Second, the research involves identifiable private information submitted to 23andMe by their customers at the time of their purchase of SNP genotyping, as well as research questionnaires that may include medical information and can be submitted at varying times. We argue that the data in this case are linked, even though indirectly, and thus qualify as individually identifiable human subjects data. The 23andMe consent form posted on the company website (June 24, 2010) guarantees the ability to withdraw from research at any time. If the data were truly unlinked from identifying information, the samples could not be identified for withdrawal. OHRP makes an exception for contractual agreements (usually between institutions) that prevent investigators from having access to identifying information. No such contracts have been argued in this case. In addition, one or more of the investigators who is a principal and executive of the company is likely to have access to all data collected in service of providing their products unless actively prevented by OHRP-compliant legal agreements.

23andMe describes its activity as biobanking of samples and data for subsequent use in research. To the best of our knowledge, there is only one biobank that qualifies as a bona fide non-human subjects research resource, as determined by both OHRP and by their local IRB: The Vanderbilt DNA Databank, BioVU (Pulley et al., 2010). The practices of BioVU differ from those of 23andMe in several important respects, including robust de-identification procedures, use of a consent checkbox to opt out, and extensive ethics and human subjects oversight. BioVU’s planning and operational transparency stand in contrast to the process led by 23andMe.

At what point does a customer become a research participant?

The editors refer to the 23andMe consent and legal agreement as evidence that 23andMe customers clearly understood that their samples would be used for company sponsored genetic research. At what point did these consumers become research participants? Were customers aware of this transition or did they and the company understand the collection of data to be part of 23andMe service? This conflation reflects the blurring of the consumer/human subject boundary and contributes to the confusion.


23andMe did not seek an IRB assessment prior to posting a consent form, gathering sensitive information from its customers, and using that information in research. This omission was compounded when the commercial IRB, contacted after the fact and under pressure, erred in finding that the published research did not involve human subjects. There are many sources of assistance and advice for public and private entities embarking on new research programs, such as early discussions with IRBs or research ethics consultations. Although it remains possible that 23andMe’s research is categorically exempt from The Common Rule, we agree with PLoS Genetics’ decision to uphold this standard of review, which is critical to ensure the protection and welfare of human subjects who initially enter into research as consumers.

Supported by NIH Grant P50 HG003389

Pulley J, Clayton E, Bernard GR, Roden DM, Masys DR (2010). Principles of human subject protections applied in an opt-out, de-identified biobank. Clin Trans Sci 3: 42-48.

No competing interests declared.