Is Your DNA Data Safe in Blackstone’s Hands?

The Wall Street giant’s big bet on Ancestry.com drives home the financial realities facing the consumer genomic revolution.

We’re beginning to get a picture of the people who might have a goldmine in their genome.

The paradox of treating your own DNA as a commodity is that you’d actually be lucky if you’ve got a rare, poorly understood genetic disease, as those troublesome stretches of DNA may be the most valuable for medical research, explains Dennis Grishin, the cofounder of Nebula Genomics, a California company offering whole genome sequencing. You’d be luckier still if you have genetic patterns that would usually cause you to become ill with a disease like this, and yet appear completely healthy. That’s one variety of in-demand DNA: genomes belonging to people that Grishin calls “natural knockouts,” meaning genetic variations in the disease-associated genes in their genomes somehow save them from falling ill.

“There are people who have ‘broken genes’ and actually should be severely sick. But they are not sick for some reason, and we don’t really understand why,” Grishin says. “So there is some kind of compensatory mechanism going on that prevents people from getting sick.”

Sequencing the genomic data of these natural knockouts might help medical researchers understand diseases better, discover how we can avoid becoming ill, and define new drug targets. But it is far from the only way that genes could create enormous value, with scientific breakthroughs year-on-year exposing new functions of our genome and data scientists finding new ways to turn our essential code into valuable insights.

If you’ve never before considered how valuable an asset your DNA might be, you are far behind. Some of the biggest direct-to-consumer DNA sequencing companies are busy monetizing their large-scale genomics databases, with hopes to shape the burgeoning DNA economy and reap its rewards. And if you spit in a cup for one of these companies, your DNA might already be under the corporate control of some of the richest firms on Wall Street.

With their purchase of Ancestry.com late last year, the private equity firm Blackstone now owns the DNA data of 18 million people. And Blackstone is currently ramping up efforts to monetize the data amassed among the companies it owns. But experts say Wall Street firms’ interest in genomics poses new and unforeseen threats, and risks sowing distrust among DNA donors. Without trust, could we miss out on the genome’s real value?

A bull market for DNA

Since the global financial crisis of 2008, private equity firms—which buy up and reshape diverse private companies—have quietly overtaken traditional investment banks like Goldman Sachs as the “dominant players in the financial world,” according to the Financial Times. It’s been a rough tenure so far. While private equity mega-deal hits have made billions for investors, often the companies acquired pay the price, as with high-profile flops including mismanaged music group EMI and bankrupt retailer Toys R Us. The industry has become “the poster child for financial firms that suck value out of the economy,” said U.S. Senator Elizabeth Warren, while introducing an act to Congress aimed at reining in private equity “vampires.

In December the biggest, most dominant private equity company of them all, the Blackstone Group, Inc., which boasts half a trillion dollars in assets under management, made a dramatic entry into the genomics space when it bought a controlling stake in Ancestry.com as part of the deal that valued the genealogy and gene testing company at $4.7 billion. And with that one stroke of the pen, the firm acquired the largest trove of DNA data assembled by any consumer gene tester. If your own DNA sequence is included in this collection, it exists on servers somewhere along with the genomes of 18 million people from at least 30 countries.

Announcing the deal, David Kestnbaum, a senior managing director at Blackstone said he foresees Ancestry growing by “investing behind further data, functionality, and product development.” At the same time, many privacy-concerned watchers had the same question: How does Blackstone aim to monetize Ancestry’s massive database, which includes users’ most sensitive genomic data and family histories?

Those lingering worries were ignited in the final days of 2020 by revelations buried in U.S. Securities and Exchange Commission (SEC) filings, and unearthed by Bloomberg, that showed Blackstone will begin to “package and sell data” from the companies it acquires as a fresh revenue stream. 

For any entrepreneur or investor in the genomics space who knows the industry needs investment to realize its dramatic potential, the question is vexed. Are deals that bring sensitive data under the control of private equity mega-funds a much-needed path to realizing the industry’s goals? Or do they threaten to derail the rapid progress that consumer gene science is making?

If you buy it, they will come

Founded in 1985 by former Lehman Brothers bankers Peter Peterson and Stephen Schwarzman, Blackstone is today seen by many as an unequivocal leader in the private equity space—not just for the colossal deals it makes but for the trends it sets. The company’s acquisition strategies become profitable pathways that smaller firms follow, like snapping up single-family homes after the subprime crash of 2008 to quickly become the world’s biggest landlord. While its core business is still buying private companies using investor money and debt, Blackstone has found ever more diverse revenue streams, including buying commercial real estate and infrastructure, lending private credit, and managing hedge funds. As it has amassed $584 billion in investor assets, a figure exceeding the GDP of 90 percent of the countries in the world, Blackstone has come under increasing scrutiny both for its business practices and for CEO Schwarzman’s close ties to former U.S. President Donald J. Trump, remaining steadfast in recent weeks as perhaps his last-remaining supporter among the Wall Street elite.

But it’s an open question whether Ancestry’s buyout by Blackstone will markedly change how Ancestry donor DNA is monetized, after previous partnerships like the company’s deal with Google life-extension initiative Calico came up empty. Nor is it clear how the Blackstone purchase portends how other private equity giants might seek to monetize genomic databases in the likely event big firms swoop in to snatch up other gene science startups. 

In a world with no controls on data flows, the collective data banks amassed by a private equity giant like Blackstone would be a wonderland for analysts, explains Michael Roberts, professor of finance at the University of Pennsylvania Wharton business school. “They own health care companies. They own insurance companies. They own retail companies. So they can identify spending behavior, health care expenses, actual health outcomes for individuals,” he says.

“They have all this information on our behavior and, on the one hand, that’s a little scary,” Roberts said in an interview via Zoom. “Let’s be clear: Companies already have that, but it’s segmented.” Connecting the dots is where private equity giants are likely to unlock value that geneticists miss, an avenue underexplored by the Calico deal, which ended without fanfare in 2018, and Ancestry’s peculiar partnership with Spotify for DNA-designed music playlists. In December, Roberts’ colleagues at Wharton published a paper arguing that DNA data could soon back much more effective marketing attempts for things like health care products treating baldness, by targeting people who are genetically predisposed. Together, such data provides an “all-encompassing picture of consumer behavior,” he added. “And that’s incredibly valuable.”

In response to questions about the deal, Ancestry says its commitment to user privacy is unchanged and that the company “does not sell or share customer DNA data with insurers, employers, or third-party marketers.” Ancestry has also refused to share data with law enforcement agencies unless compelled to by a warrant.

A study found $95 would be enough to tempt most Americans to sign away their DNA data.

In an email, a Blackstone spokesperson says its own employees and directors will not be able to access Ancestry’s data and the company will not be sharing DNA or family tree data with other companies owned or operated by Blackstone. The spokesperson said work to license insights is currently “exploratory,” and added “nothing has been sold on behalf of our portfolio companies or Blackstone.” A Blackstone source with knowledge of the firm’s data monetization efforts said Ancestry will not be included in the initial sale of insights detailed in the SEC filings.

Blackstone did not directly respond to more detailed questions for this story, but a spokesperson said in an email the company is “deeply committed to ensuring that Ancestry has world-class consumer privacy.”) Responding in an email to this story after its publication, a Blackstone spokesperson said, “Ancestry data will never be part of the effort detailed in the SEC filings. Not just the initial sale.” (Their emphasis).

Yet, long term, we are entering new territory. With future bids for data-rich health companies likely, there is plenty of room for tinkering by firms—whether Blackstone or its followers—that have specialized in restructuring portfolio companies, creating innovative financial products, and skillfully toe-stepping regulatory restrictions to yield returns for investors. Crucially the deal leaves open the possibility of Ancestry itself splicing together its own data insights with external marketing data. “It’s a whole new set of issues that one has to consider when there are no sort of formal walls containing the data,” Roberts says. 

An illustration of a stock market plot graph made from mouths and swabsticks.

The current market price of DNA

In March, a study found $95 would be enough to tempt most Americans to sign away their DNA data. And following Blackstone’s move, some have quickly jumped to put a price on a person’s DNA based on Ancestry’s stock price, with CBS News declaring the going rate is now set at $261 per person.

But such oversimplified, back-of-the-napkin calculations—far below most attempts to assess the real value of your genome—are rarely worth the paper they’re scrawled on. Ancestry is more than its databank, explains Emily Drabant Conley, CEO of Federation.Bio, who once oversaw 23andMe’s corporate partnerships, including its landmark 2018 deal to allow British pharma giant GlaxoSmithKline to use its DNA data. Ancestry’s $4.7 billion valuation, for instance, owes a lot to the company’s strong subscription model, where more than three million customers pay up to $400 a year to dig into their family history. At the time of sale, Ancestry could count $1 billion in yearly revenue, according to Blackstone.

DNA experts Grishin and Conley, along with others, explain that a genome is not so easily slapped with a price tag. Based on our current level of knowledge, person-by-person, the value of genomes to a medical researcher might vary enormously at the level of the individual. But the real value of a DNA database, for both medical discovery and marketing, lies more in its scale.

“When it comes to genetics, you need extraordinarily large data sets. When I joined 23andMe in 2010, I was excited that we had 40,000 people, but pharma wouldn’t talk to us. Pharma was like ‘40,000 people? That’s just not enough data’ because the genome itself is so vast and complicated and there’s so many differences between people,” Conley says. “It turns out the low end of the bar for where the data gets interesting for drug discovery is 10 million.”

The $300 million deal between 23andMe and GlaxoSmithKline remains an industry benchmark, which successfully negotiated privacy concerns by de-identifying data, contacting DNA donors with the option to opt out, and employing an Independent Review Board to scrutinize ethics. The partnership signaled to Wall Street that consumer testing platforms were ready to monetize data without public outcry. It is now bearing fruit with a drug targeting cancerous brain tumors, the first human trials for which began in July.

This week, it emerged that 23andMe is subject to its own Wall Street swoop, this time as part of a so-called “reverse merger” deal with a special purpose acquisition company founded by billionaire Richard Branson to expand the American reach of the Virgin’s brand, which also fronts health care, travel, communication, insurance, and banking companies around the world. Special purpose acquisition entities, also called “blank check companies,” are a fairly new kind of investment vehicle designed to be, “empty corporate shells that raise money from investors and then aim to merge with a private business, essentially taking that company public through the back door,” according to Bloomberg. It’s unclear what impact 23andMe’s potential impending merger with a special purpose acquisition company might have, if any, on its privacy policies and data practices.

Apart from 23andMe, Ancestry is the only direct-to-consumer DNA testing organization that could offer such scale, since the two giants make up the bulk of the U.S. consumer testing market. Blackstone has touted its scale as a competitive advantage again and again—in making mega deals like its $20 billion purchase of the Thomson Reuters data unit. And in genomics, the enormous buying power of a private equity giant like Blackstone could allow it to assemble even larger DNA databases, creating further value for researchers. “If you have data at scale, you can do things from a modeling perspective that you just can’t do on small data sets,” Roberts says.

While private equity could help release such value for commercial uses of DNA data, there are major risks. The picture that becomes clear in conversations with geneticists, financiers, and academics is that not only does Wall Street aim to capture the value of our genome, but they could also rob the genomics industry of the chance to cultivate an even more meaningful form of genomic data that combines it with medical history and lifestyle data to drive untold future discoveries.

Is this the deal that launched a thousand ships?

All parties agree that one thing can make the value of DNA databases plummet: If donors have the right to wipe their data from the record. This is where the value of genomic data to a private equity firm clashes with the rights of the private individual.

Consumers should have the right of retraction, explains Richie Etwaru, CEO of Hu-manity.co, which works with businesses to transform their data privacy practices to establish trust with consumers and partners. But most don’t, placing focus back on the Faustian pact of handing over DNA data to direct-to-consumer testers in exchange for a chart showing your ethnic makeup and some indicators of health (Ancestry, in fact, closed its health insights division this month). “All of this discussion comes down to one thing and one thing only,” Etwaru says, “the ‘I Accept’ button.”

Consumers are endlessly asked to sign off on legal agreements in today’s digital interactions. We are deluged by cookie notifications, subjected to lengthy fine-print contracts for even the most mundane services, and so often asked to agree to user agreements that they cease to be meaningful—even as they sometimes afford great legal leverage to private companies. This has transformed the user contract from a tool for building trust into an open opportunity to disenfranchise consumers, Etwaru says. “That is the bug in humanity. That is the flaw in the system.”

People who sent in swabs to Ancestry before its deal with Blackstone may have few legal protections to fall back on either, explains Pam Dixon, the executive director of the World Privacy Forum. The most obvious protection, the sweeping Health Insurance Portability and Accountability Act (HIPAA), does not apply to Blackstone because Blackstone is not a “covered entity” under HIPAA and neither is Ancestry, according to its privacy agreement. Nor does the Genetic Information Non-Discrimination Act (GINA), which applies to situations of employment, offer any privacy protections. The one single law on the books that would seem to apply, Dixon says, is Section 5 of the Federal Trade Commission (FTC) Act, which only stipulates that Blackstone would not be able to make “material, retroactive changes” to the privacy policy Ancestry users signed.

“DNA data, by its very nature, cannot be anonymized. It is always going to maintain some semblance of identifiability.”

“But Ancestry has always had a very loose and extremely promiscuous privacy policy,” she adds, citing a 2017 climbdown by the company after lawyers discovered clauses in the terms of service that gave Ancestry “perpetual, royalty-free, worldwide, sublicensable, transferable license” to donors’ DNA data, for purposes that included “personalized products and services.” While Ancestry’s current contract provides donors a chance to explicitly withdraw their data, so long as donors’ DNA remains on file, the company has the right to share it—including identifying information, commercial information, and internet usage—with research partners, and states that it has done so in the last 12 months. One section of the agreement deals with data ownership in the event Ancestry is acquired. Dated September 23, 2020—between Blackstone announcing its plan to buy and the deal completing—it makes explicit that, “If Ancestry or its businesses are acquired… we will share your Personal Information with the acquiring or receiving entity.”

Ancestry’s own agreement has provided few protections. The real question, Dixon says, is how Blackstone will use the data, with Ancestry being awarded an intriguing new patent this week for a technology that they claim allows them to predict physical traits from DNA and historical data. “In every case where private equity buys a company with a database, someone somewhere is holding all of that original data,” Dixon says. “Once an entity has control of the full, robust data, what can or will they do with it? How will they share it? Will they share it in full, fully identifiable form? Will they share it in de-identified form?”

Dixon says she is most annoyed by claims that data can be simply and safely “anonymized” to protect donors before selling it to third parties. Data can be protected by pooling it to prevent researchers from looking at any individual sequence, but this would prevent specific genetic variations from being associated with other things, like signs of diseases in a person’s family or medical history—totally nullifying the ability to reap genetic insights on individuals—the exact information of value to most researchers. “When research is taking place, you really want the full strands to work with, so that you can actually make findings,” Dixon says. “And I think that’s reasonable.”

Lesser attempts at de-identifying, just by stripping away the individual’s name and address, for instance, is not sufficient to protect identities. Last year, for instance, a team at Yale University showed that it’s possible to obtain DNA from a discarded coffee cup and match sequences from that DNA to an anonymized genomics database, allowing them to tease out sensitive health information about the drinker—a privacy breach known as a “linkage attack.” “DNA data, by its very nature, cannot be anonymized,” Dixon says. “It is always going to maintain some semblance of identifiability.”

Even amid growing concerns about privacy, the sweeping power of those exact sort of linkage attacks have been on public display. In 2018, the use of DNA data from the GEDmatch database allowed law enforcement agencies to find the Golden State Killer, solving the infamous cold case of a serial rapist and murderer who terrorized West Coast communities for decades. The great irony is that high-profile cases like that one are credited with driving the effort by companies like Ancestry to look internally for ways to monetize data they already have.

With privacy-spooked consumers already thinking twice about submitting new swabs, further erosion of trust threatens to throw a wrench into the system by which DNA is collected and analyzed, with Etwaru and Dixon both warning of trouble ahead if the companies that want our genomic data can’t guarantee trust. “Boy, I think that in the years to come,” adds Dixon, “there’s going to be so many advancements made. If people cannot trust how companies handle DNA, and how it’s transferred, and whatnot, I think that there’s going to be a lot of very significant trust problems going forward.”

Blackstone’s investment comes just as startups like Nebula Genomics, EncrypGen, and Hu-manity.co promise robust rights to control any data you submit. But there is no shortage of evidence that Wall Street deals can pull stakeholders in the opposite direction—destabilizing trust and wrenching controls of assets from traditional custodians. Just ask Taylor Swift, an unlikely private equity critic since her record catalog was sold off to a group called Shamrock Capital, or the former readers of Deadspin, whose writers resigned en masse when private equity owners began telling them what to write.

Financial firms are world leaders in data storage and cyber security, reminds Etwaru—after all, we entrust banks and investment firms with our money. We might even hope that their data expertise can steer Ancestry clear of the data mishaps that have plagued GEDmatch, a DNA database owned by a forensics company. It has suffered hacks, and just this month, accidentally made public supposedly deleted DNA files. But with private equity, carelessness is not the worry, instead it is deliberate actions—and new commercial interests—that become our biggest data concern.

Etwaru says that lurking behind the obfuscation of the terms of service debate is the more central question of intent. Consider the following hypothetical: “If Ancestry.com had put out a survey or a questionnaire to all their users that said, ‘Hey, we’re going to sell it to Blackstone and by the way, Blackstone is going to use it to figure out how to optimize mortgage loans, because certain types of people with certain DNA data don’t pay their mortgage on time. Are you guys OK with us selling this data to Blackstone?’”

“Who would have said, fucking, Yes?” Etwaru asks. “Nobody!”

A collage of news headlines and articles showing Blackstone's checkered past.

Maximizing returns versus protecting privacy

For donors, one question that divides financial institutions from the DNA home testing companies they originally entrusted with their spittle-laden swabs is how will data be used, says Etwaru. “The question I would encourage you to ask is: Do they traditionally have an ethical framework to use assets in any other way, other than in their own self-interest?” he asks. “Let me put it to you this way: If the Red Cross brought Ancestry.com data, would you be upset about it?”

Much of the scrutiny has been concentrated on Blackstone because of their growing public position as a lightning rod for criticism in the world of big-money finance, attracting a polyphony of critical attention even amid Wall Street’s largely amoral business. Blackstone, in its omnivorous desire for assets, has been accused of human rights violations for its forays into residential real estate, of bringing about the collapse of a British retirement homes chain, and of funding the deforestation of the Amazon. Perhaps more concerning for a company now in control of 18 million DNA records, Blackstone’s motel chain agreed to pay out $10 million last year for violating privacy while voluntarily collaborating with U.S. immigration enforcement to raid hotel rooms of guests with Latino-sounding last names and secretly lobbied against legislation that would ban surprise medical charges, to protect the profits of its portfolio company Team Health.

A Blackstone spokesperson said in an emailed response to this story after its publication that the practice occurred at certain local properties without their knowledge, that it was immediately discontinued once they became aware of it, and that they took additional steps, including issuing directives to all 1,400 hotel locations, “making clear they were prohibited from engaging in this practice to help ensure it doesn’t happen again,” they said. They sent a statement from Motel 6, which read, “Motel 6 fully recognizes the seriousness of the situation and accepts full responsibility for both compensating those who were harmed and taking the necessary steps to ensure that we protect the privacy of our guests.” They also sent a link to a 2019 response they made to what they called “the Hidrovias allegation,” referring to the Brazilian company in which Blackstone is invested and the allegation of Amazon deforestation.

Blackstone denies responsibility for the collapse of Southern Cross care homes which happened after it disinvested, it has published a long response to claims of wrongdoing in the real estate sector, and it maintains a commitment in public statements to responsible environmental stewardship.

Yet, arguably the greater worry for anyone whose DNA data might one day pass into the hands of private equity are not the ill intents of any individual actors but the systemic self-interests of the enterprise as a whole. The principal responsibility of any asset manager, after all, is to maximize returns for investors, a position which incentivizes monetizing data or any other asset to the fullest extent allowed by law. This is usually in the interest of the startups. “Their ability to see value in places where a [scientist or startup CEO] might not be able to, is I think an important aspect of the value proposition of private equity,” says Roberts, the Pennsylvania finance professor.

That may be the main reason to fear private equity—the prospect that DNA assets could be of more value to new corporate parents if the original goal of improving human health is sidelined or dropped.

Roberts says that while most private equity firms will aim to boost the value of a company they buy in order to eventually sell it, it is conceivable that a large firm could buy up a genomics startup to exploit its database solely to help another company—say, a retailer—it also owns. “One could imagine that a private equity company might acquire a company precisely because it’s got another company in its portfolio that it’s trying to boost or sees better growth potential in the future,” says Roberts. “There’s a whole bunch of interesting dynamics here.”

Wall Street interest is nothing new (in fact, at least three of the Ancestry stakeholders Blackstone bought out were private equity investors, although much smaller fish). But for genomics startups, this latest move comes at a time of economic chaos, when consumer-facing companies find themselves struggling just as private equity is sitting on record piles of unspent cash and looking for new assets to capitalize on. For genomics founders and CEOs who have value-driven missions to collect and analyze a mountain of DNA in order to expand scientific understanding and improve human health, private equity could be a rope line to the summit. On the other hand, drug development can take decades—far beyond the time scope of a private equity fund. That may be the main reason to fear private equity—the prospect that DNA assets could be of more value to new corporate parents if the original goal of improving human health is sidelined or dropped.

Critics see private equity’s short-termist, asset-stripping practices to be of benefit to few beyond their boardrooms and investors. In introducing her Stop Wall Street Looting Act of 2019, Senator Warren said, “For far too long, Washington has looked the other way while private equity firms take over companies, load them with debt, strip them of their wealth, and walk away scot-free—leaving workers, consumers, and whole communities to pick up the pieces.”

Faced with uncertainty, there is no shortage of suggestions for avenues to respond. Etwaru is known for pursuing an addition to the Universal Declaration of Human Rights, a 31st human right “to legal ownership of their inherent human data” including their genome. Academics in the field of marketing and ethics have recently published their own framework to guide commercial regulation and best practice. Others, including the Electronic Privacy Information Center, have said Blackstone’s Ancestry deal shows the need for a comprehensive U.S. privacy law.

Hidden value for human health

While a right of retraction may be one important aspect of DNA ownership for consumers, the right to actually use genomic data is critical for realizing its true value for human health, says Grishin, the cofounder of Nebula Genomics.

“Genomic data on its own without any other information attached to it is not particularly useful,” says Grishin. But matching genetic data to other information, like personal medical history, may be the only way to tease out the genes that lend susceptibility for rare diseases and chart a path toward discovering new treatments.

Both Grishin and Conley say they are doubtful whether this can be done effectively by some far removed data-splicer—if DNA is completely siloed off from the person and properly de-identified.

Instead, Grishin advocates a model that gives people ownership of their DNA but allows them to participate in the scientific process by asking them survey questions and giving them the choice to voluntarily submit associated medical data. Suppose, proposes Grishin, someone donates their DNA and then, later, develops cancer.  “If you can kind of follow that person, keep that person engaged, and that person will share information that says they got sick and received the treatment, and then, the first treatment didn’t work and the second treatment worked better—that’s all valuable information.”

Grishin says most of their donors are not motivated by a desire to receive a share of the proceeds of drug development. But rather, just as millions of people donate blood each year, people surveyed by Nebula (and as part of the $95 study) said they prioritized transparency and the ability to say yes to their DNA being used for drug research. That’s where the greatest value to humanity may come.

“Generally speaking, genomics is still in its infancy,” says Grishin.

Editor’s note: This story was updated on January 29, 2021 to include post-publication responses from a Blackstone spokesperson.

Go Deeper