Maryland Quietly Drops Parts of Genealogy Privacy Law
A WMAR-2 News investigation has heard that the Maryland Department of Health quietly stopped implementing key elements of a landmark privacy law designed to protect ancestry data online.
The law, signed into law last year, was seen as a model for other states seeking to set standards for when law enforcement can tap into DNA uploaded by Americans researching their heritage.
“States that don’t have laws like ours are a bit like the Wild West,” said Natalie Ram, a law professor at the University of Maryland.
State law set some of the nation’s first limits on forensic genetic genealogy, a technique used occasionally to help solve the toughest murder and rape cases.
Authorities take DNA from a crime scene and if they don’t find matches to known offenders in law enforcement databases, they match the sample against profiles of millions of Americans whose DNA is online from ancestry research.
“Like where I would go to try to find my long-lost loved ones, we would use exactly these same publicly available tools to try to find out, who owns this DNA?” said Ray Wickenheiser, director of the New York State Police Crime Lab System.
Forensic genetic genealogy became a more popular practice after 2018, when it helped catch Joseph DeAngelo, the notorious “Golden State Killer”.
But unlike a police search of a house or car, there were virtually no standards for when and how law enforcement could tap into online genetic genealogy data.
Maryland law established some of the nation’s first guardrails on the investigative tool.
“It’s complete,” Ram said. “It regulates the initiation of forensic genetic genealogy, how it is conducted.”
The WMAR 2 News investigation found that, nearly a year after the law came into force in October 2021, key elements of it have yet to be rolled out.
The Maryland Department of Health has not yet published best practices and minimum qualifications for people using forensic genetic genealogy.
In a required annual report, a branch of the governor’s office failed to disclose how often law enforcement accesses ancestry data, as well as the number of complaints.
The health department also suspended a task force working on the new regulations, without providing an explanation even to members of that task force, including Wickenheiser.
The Maryland Department of Health did not respond to detailed questions from WMAR 2 News about the lack of progress.
But emails obtained through state open records requests show that in March a decision was made to stop implementing major parts of the law.
Dr. Tricia Nay, director of the Health Department’s Office of Health Care Quality, wrote in a March 16 email: “Unfortunately, OHCQ has not received staff or funding for this bill, so we are unable to implement it at this time.
A health department spokesperson confirmed there were no funds to support the law in this fiscal year, which extends through June 2023.
This was news for Ram, who worked with lawmakers to pass the pioneering law.
“It’s about me,” Ram said. “I would like to see this law implemented, and I hope resources are available to do so.”
The law faced other challenges, including concern and opposition from a key head of the health department.
In an email dated June 13, 2021, Paul Celli, Public Health Administrator for Clinical and Forensic Laboratories wrote, “I just don’t know how to start all of this. The bill charged the OHCQ with all of this without any consultation on it… I don’t even agree with most of what is in it…”
The emails show that this summer communication appeared to break down between the Maryland Department of Health and the Maryland State Police, another agency also required to help roll out the law.
“I still don’t know what MDH’s plan is in relation to the regulations. They remained silent and I tried every avenue available to me to get a resolution to no avail,” reads a July 13 email from Dan Katz, lab director for the Maryland State Police.
Katz declined an interview request for this story.
Maryland Department of Health spokesperson Chase Cook sent a statement in response to WMAR 2 News’ findings: “The Maryland Department of Health has been actively working internally and with our partner state agencies on implementation of this law, which we believe has not been implemented anywhere else. in the USA. We will provide further updates as they become available.
For now, ancestry websites set their own privacy policies.
The Terms of Service for ancestry.com and 23andme.com state that they will not knowingly share data with law enforcement.
There are looser restrictions on GEDmatch.com, a free online ancestry database used to find the Golden State Killer
The site has 1.8 million profiles.
Users must unsubscribe if they do not wish to share their data with the police.
“For me, it’s critical that Maryland continue this,” Wickenheiser said. “The sooner we can have these discussions and put these laws in place, the better. We want to prevent and solve crime, and we also want to make sure that we respect people’s rights. »
A major test of how things are going in Maryland is just weeks away.
The law requires the health department to establish licensing requirements for labs using forensic genetic genealogy by Oct. 1.