The field of personal genetics began around the beginning of the millennium; it has grown slowly and steadily, but is reaching a point where it will become commonplace within very few years for the majority of Europeans to have access to either their own entire genetic code, or at least a detailed map of individual genetic variants. The speed and nature of developments has outstripped the regulatory frameworks in place for existing clinical diagnostic or testing services, but the debate has also been gathering pace, and although in some countries new laws are starting to appear, the regulatory area for personal genetics services remains far from clear throughout Europe. There is much uncertainty that has to be faced by all providers of personal genetics services, including private companies, national health services and practitioners.

Personal genetic testing generally screens for common genetic variations, which do not have such significant health impact, but are responsible for most of the differences between individuals, including nutrient metabolism and responses to medication. Products and services available encompass nutrigenetics, pharmacogenetics and health-risk assessments. A major change occurred recently in 2007 with the advent of the personal genome scanning services from high-profile companies, including deCodeMe, 23andme and Navigenics that introduced genome-wide scanning direct to the consumer through the internet.

The first personal genetics products were sold directly to the consumer (DTC) with no practitioner involvement – this was controversial and sparked a debate on all aspects of the services (ethics, confidentiality, test validity, test utility, marketing claims, etc) for which no regulations existed. During 2001, Sciona Ltd in the United Kingdom notified the Human Genetics Commission (United Kingdom) about their proposed new service, the HGC concluded that it was outside the scope of the 1997 Advisory Committee on Genetic Testing ‘Code of Practice and Guidance on Human Genetic Testing Services supplied Direct to the Public’, which was prepared in response to cystic fibrosis testing and the Sciona test went on sale. In response to the controversy generated, the HGC set up a public consultation into DTC genetics and made recommendations in 2003 (updated in 2007),1 which have been influential in framing the worldwide debate but have not resulted yet in regulations in the United Kingdom.

In the USA and the rest of Europe, the situation is similar; there has been much debate, with so far few results in terms of regulations. Germany is an exception, where recently strong restrictive regulations were passed, which targeted and effectively ban DTC and require a prescription from a medically qualified practitioner for any genetic testing.2 Some other European countries (such as France and Switzerland) have pre-existing laws, which could be applicable to DTC and if so, would be as restrictive as the new German legislation. It is not sure how these laws can be applied to DTC services offered over the internet from outside these countries, but it has definite implications for European services and providers. Very recently, the Food and Drug Administration has been reviewing the market in the USA and appears to have decided that DTC genetic testing is a ‘medical device’ and will be regulated as such. It has not yet detailed the type of regulation or what class they will be given (a class II device would require an expensive and time-consuming pre-market review and post-market observation).3 This would have a significant impact on the USA market, but the issue is not likely to be resolved quickly.

This review and discussion will seek to clarify the situation in Europe and how it applies to companies providing or considering providing personal genetics services, and the practitioners (medical or otherwise), other resellers (eg, pharmacies) and individuals wishing to use those services. It will identify what are regarded as obligations regarding best practice for the protection of the consumer (including practitioners etc), which in turn will provide the necessary information to identify and protect reputable and useful services.

What to regulate?

Personal genetics services currently involve sending a DNA sample (buccal swab or saliva) to the service provider, and a few weeks later the results are received either electronically or in hard copy format. Services may be delivered through DTC over the internet or in high-street stores, through sales and marketing networks, non-medically qualified healthcare professionals (dieticians, nutritionists, pharmacists, nurses, etc) and medical practitioners. In addition, some services include follow-on sales of products, especially nutritional supplements. In the case of DTC services through the internet, these are usually available worldwide, which adds to the complexity of regulation within individual countries. Services offered include health-risk assessments, nutrigenetics, ancestry, parentage and pharmacogenetics.

Regulations or strong guidelines are required for at least two purposes, both with the aim of reducing the possibility of harm, while trying not to be overly cautious and exclude possible benefits for the consumer: (1) To protect the growth of beneficial personal genetics services, allow the existence of harmless, even if not necessary, beneficial services. (2) To protect the consumer from harmful services, and they also need to protect from harm by not prohibiting useful services.

Processes that may be regulated include laboratory analysis (genotyping), creation and delivery of the personalised report (ensure the right results go to the right person), and the content of the report itself.

The type of regulation includes:

  1. 1

    Analytical validity: a measure of the accuracy of the genotyping.

  2. 2

    Clinical validity: concerns the accuracy of the interpretation, that is, the accuracy with which a test predicts a clinical outcome. For example, a certain set of single-nucleotide polymorphisms might be predicted to influence cholesterol levels under given dietary circumstances.

  3. 3

    Clinical utility: the measure of the likelihood that the recommended therapy or intervention will lead to a beneficial outcome.

The regulation of analytical validity is relatively straightforward and each country has its own laboratory accreditation procedures that cover accuracy and reproducibility, although they vary from one country to another and there are no common EU requirements (this may change with the EU in vitro diagnostic (IVD) devices directive, see below). The EuroGentest project was recently set up that goes beyond accreditation and aims to deal with all quality aspects in genetic testing, including clinical validity and utility.4 Clinical validity is less clear, but generally straightforward for many genetic risks and gene–environment interactions; however, there is not always wide agreement on when genetic association may be considered valid. Clinical utility tends to be assessed after the test is offered and the decision is usually made by the payer such as the government or private insurance. For personal genetic testing that is not yet reimbursed by either payer, the decision maker will be the end user (practitioner and/or patient/customer).

Clinical utility is the most controversial aspect; it is often difficult to define and has to take into consideration many factors, including positive or negative psychological or motivational effects on the end user. It is generally proposed that clinical utility can only be thoroughly established through randomised clinical trials, but these are challenging for the personal genetics environment, which is rapidly evolving, often includes diet and lifestyle changes and has small cumulative effects over decades (see Gulcher and Stefansson5 and Ransohoff and Khoury6 for an example of the current debate), and benefits may extend beyond purely clinical utility.7 Several organisations are developing tools to help clarify issues around clinical utility, and to provide independent assessments of the utility of existing genetic tests. These include the EU-funded ‘Clinical Utility Gene Cards’ run by EuroGentest,8 ‘Gene Dossiers’ by the UK Genetic Testing Network,9 Evaluation of Genomic Applications in Practice and Prevention by the USA Center for Disease Control,10 and the USA National Institutes of Health is developing a Genetic Testing Registry to encourage transparency.11 These are promising and necessary developments, but in the meantime the utility of a test remains the most difficult category to regulate, and a common point of view is that the regulations should cover the analytical validity, the truth of the material used to disseminate information about the test (eg, advertising and marketing) and the personal report itself at least in the short term.

Developments in European regulations for personal genetics

Several processes are underway to harmonise regulations throughout Europe, and questions often raised are:

  1. 1

    Should genetic-testing services be allowed to be sold DTC?

  2. 2

    If so, should unrestricted sale apply to all, including clinical risk assessments or should DTC be limited to non-clinical tests for example, nutrigenetics, sports performance, ancestry and so on?

  3. 3

    Should the provision of genetic counselling be a requirement for any type of genetic test, should it be limited to clinical tests, or is it necessary at all, given that genetic counselling evolved to deal with highly penetrant clinical genetics in which the presence of a mutation always has serious consequences, compared with the common variation, low penetrance health-risk assessments which do not?

  4. 4

    Each person has a right to know his/her own genetic code, why should there be any barrier in accessing this information?

  5. 5

    Would the requirement for a gatekeeper, such as a practitioner, before a person can access his/her own results be a contravention of personal rights to privacy?

  6. 6

    What is the balance between control and access to minimise harm from both overprotection and insufficient protection?

These are some of the main questions but the list goes on covering all sorts of ethical, legal and social issues.12

In Europe, the situation is very much ‘under development’, there is no EU-wide regulation; some countries have no legislation equipped to deal with personal genetics; and some countries (eg, France and Switzerland) appear to have some laws designed for clinical genetics (eg, serious genetic disease diagnosis), which may or may not be applicable to some parts of personal genetics services, and Germany has recently introduced strict laws aimed specifically at such services. Recent reviews13, 14 have covered these in some detail, and the following will provide information and comments from a provider's point of view. Most legislation/regulation specifically for personal genetics is at the review/debate/proposal stage and it is not clear what will survive, what modifications will be made and what the results will be over the next few years. Any personal genetic services (from company to practitioner) will need to have several strategies in place to prepare for and react to a number of different possibilities, especially the likelihood (for pan-European providers) that there will not be, in the short term, common EU-wide legislation, and that different levels of service may be regulated in different ways on a country-to-country basis.

Direct to consumer genetic testing

This is the area in which there is most disagreement on what should or should not be allowed – range of opinion goes from nothing to everything. The Council of Europe is preparing a protocol, which is likely to be broadly against DTC, at least regarding ‘medical’ tests. This document will be legally binding on member states that sign up, and in any case is likely to be influential (see below).15, 16, 17, 18

Lifestyle vs medical

Adding to the difficulty of reaching clear regulations is the definition of a test – what is a ‘lifestyle’ test and what is ‘medical’? A nutrigenetic test for example, is often described as a lifestyle test and the results are not used to give individuals a ‘risk assessment’ for various diseases. However, it is argued that you cannot talk about genes, health and lifestyle without there being a medical component, and the fact that individuals are given genetic results for which disease risk information is easily available on the internet means that it should be classified as ‘medical’. The tests offered by 23andMe and DeCodeMe would appear to be clearly ‘medical’ as they describe disease risk, however, both companies argue that they are providing information for education purposes only and not for the purposes of making health decisions. It is a grey area, but generally opinion is that the nutrigenetic type tests will be classified as lifestyle, and may be freely available DTC, whereas health-risk assessments may at least require some sort of pre-market review.

The main proposals for European regulation

Several influential groups have worked for several years to develop policy proposals for regulating personal genetics services, the main focus has been DTC, but they are also applicable for services provided through practitioners, and the information is useful for all who wish to either use or provide personal genetics services.

Human genetics commission

As described above, the HGC set up a consultation in 2002, since then it has taken the lead in Europe regarding personal genetics and DTC services; recent efforts have been made towards promoting industry self-regulation through a strict code of practice. The HGC has published two relevant reports; Genes Direct (2003) and More Genes Direct (2007) and current proposals for further work are described in a recent newsletter, Direct testing framework – paper HGC08/P16.19 (See Box 1).

The council of Europe convention on human rights and biomedicine

The Council of Europe has created a Europe-wide legal document the European Convention on Human Rights and Biomedicine20 and in 2008 it published an Additional Protocol concerning Genetic Testing for Health Purposes.21 This document includes articles that specifically take into account the emerging field of personal genetics and DTC sales (Box 2).

The requirement for ‘individualised medical supervision’ would appear to prohibit DTC sales and require service delivery through medical practitioners only, excluding other state-registered practitioners (eg, dieticians and nutritionists) who could be important partners in the delivery of personal genetics. Furthermore, some classic genetic disease prediction has recently been introduced into some services, for example, cystic fibrosis and Tay Sachs disease,22 and in these cases, Article 8 of the Additional Protocol requires that before and after test independent genetic counselling be made available to the patient/customer.

This is an important document that if enacted will be legally binding in those states that accept it; however, ‘… countries such as the United Kingdom and Germany have neither signed nor ratified the European Convention (or its additional protocols); to date, of the 46 member states of the Council of Europe, a total of only 34 and 21 states have signed and ratified the original Convention, respectively… several years may pass before the additional protocol enters into force, and it will apply only in those countries that have ratified it.’23

The IVD directive and genetic testing problems and proposals

The European IVD medical devices directive (directive 98/79/EC) constitutes the main regulatory framework for genetic tests marketed in Europe.24, 25 The directive regulates the placing on the market and the putting into service of IVD medical devices with the aim of ensuring their safety and performance for patients and users and it includes genetic tests. It contains many essential requirements for genetic tests but only covers the product, not the broader aspects of testing (how testing, as a service, should be regulated) as the provision of healthcare services is under the control of individual EU Member States.

The directive is currently under review (see Box 3) in an attempt to provide a framework, which if adopted will be required to be incorporated into national law of all member states. It will address specifically some aspects of genetic testing but there are problems, for example, it may not cover genetic-testing products wherein the lab that does the actual screening is situated outside of Europe. Many contributors are not happy with this because (a) it is a major loophole and (b) it penalises commercial European screening labs.26

European technology assessment group (ETAG)

ETAG was set up to provide scientific services to the European Parliament on social, environmental and economic aspects of new technological and scientific developments.26 It presented a report on DTC in March 2009;27 the main focus was the offer of genetic testing through internet. An expert panel was formed and the websites of 38 providers were analysed. The survey revealed that misleading or inadequate information is commonplace and that some tests offered through the internet are of doubtful quality or utility. Overall, there are serious concerns about offering tests over the internet; the report acknowledges that regulation will be complex and that it must be proportionate to the risks posed by the tests, noting that some tests pose more risks than others. The report concludes that there is a requirement for Europe-wide controls – they highlight the IVD directive, a European Code of Practice, and a proposal to set up a Europe-wide quality control and accreditation system for laboratories. With regard to policy proposals for legislation, they highlight the work of the United Kingdom HGC as being the most thorough exploration, and the report is in full agreement with the list of proposals made by the HGC, see Box 1. The ETAG report is not a legal document but is advisory.

European Society of Human Genetics

This organisation, which is very active in promoting genetic research and in the application of high standards in clinical genetics, recently published a policy statement on DTC genetics for health-related purposes.28 The ESHG strongly supports tight regulation incorporating the proposals of European IVD Directive, the OECD council Recommendations on Quality Assurance in Molecular Genetic Testing29 and the Council of Europe Additional Protocol.

Public health genomic European network

PHGEN ( is an EU-funded network developed to promote a common understanding of Public Health Genomics (PHG) between all stakeholders in Europe and the need for European coherent guidelines. Currently in its second funding cycle, one of the main aims of PHGEN II is to produce the first edition of European Best Practice Guidelines for Quality Assurance, Provision and Use of Genome-based Information and Technologies. It also publishes the PHG Journal ( and is developing a ‘Wiki’ at The application of PHG is also addressed by the work of the independent United Kingdom PHG Foundation (

Industry code of practice

It is likely that clear regulations are not going to be in force for several years in the EU and may even be obsolete by the time they become law and almost all stakeholders (industry, academics, healthcare professionals and consumers) agree that the current situation is far from ideal. There is too much opportunity for poor quality ‘exploitative’ products to enter the market and there is little opportunity for consumers and practitioners to obtain reliable, impartial information on the tests that are currently available. The quickest way to improve the current situation may be the creation of a code of practice agreed upon by the major stakeholders, and the HGC has taken the initiative.30 The recently published (August 2010) ‘Common Framework of Principles for direct-to-consumer genetic testing services31 covers all aspects, including testing, marketing, customer support, quality of information and so on (see Box 4). These apply to tests provided or marketed through DTC or through a non-medically qualified intermediary (pharmacist, alternative health provider, nutritionist, etc). The Principles were developed by a broad-based working group, including representatives from the genetic testing industry, experts in regulation, clinical and molecular genetics and genetic counselling and support.

Regulations in individual European countries

The most recent comprehensive review of regulations is in a 2003 paper,32 the situation has not changed much yet, but is likely to do so over the next few years, and it is clear that most existing regulations refer to clinical genetic testing for genetic diseases, which are not applicable to the majority of personal genetics. Countrywide information is also available on the EuroGentest website,33 some strict laws are in force in some countries that may apply to some personal genetics services, in particular in France and Switzerland, where involvement of a medical professional is required. In these countries, the issue is not straightforward though as the laws were developed before the arrival of the DTC companies, some of whom claim that they are not selling medical services (see below).

In Germany the Human Genetic Examination Act was approved in mid 200934 and requires that any genetic test that diagnoses or predicts disease, or assesses response to medication needs to involve a medical doctor (or a qualified specialist in human genetics when genetic disease is tested) and counselling services must be offered. It is an effective ban on DTC testing and also testing by practitioners other than medical doctors. Under this law, a dietician or nutritionist cannot order a genetic test, even the one designed to give dietary advice. It has been criticised as being too extreme, in the opinion of the United Kingdom PHG Foundation; it represents ‘a regressive and paternalistic approach that takes genetic exceptionalism to an extreme’.35

Possible future regulations

Strict regulation

According to the Council of Europe Additional Protocol, all genetic testing, including personal genetics, would be subject to specific requirements:

  1. 1

    Genetic tests must meet generally accepted criteria of scientific and clinical validity.

  2. 2

    Clinical utility should be an essential criterion for a test to be offered.

  3. 3

    A quality assurance programme should be implemented.

  4. 4

    Adequate previous information is provided whenever a test is considered.

  5. 5

    Appropriate genetic counselling should be available in the case of predictive tests.

  6. 6

    Persons providing genetic services must have appropriate qualifications, to enable them to perform their role in accordance with professional obligations and standards.

On the basis of these points a strict regulation would include:

  1. 1

    Statutory control should require transparency of evidence of the claims that are made by manufacturers or tests providers, before the test comes to market.

  2. 2

    Professional bodies and codes of practice should ensure that those offering, providing and interpreting genetic tests are working within an appropriate framework, and only offer tests for which there is evidence of clinical utility.

  3. 3

    Routine use of tests should be reimbursed only after they have been evaluated effectively.

  4. 4

    Commercial companies should not analyse samples of minors for genetic conditions, unless the tests are ordered by health professionals.

This type of framework has also been developed into a specific set of proposals for an EU-wide regulatory framework, based on the IVD directive. The proposals of the directive (see Box 3) enacted in their strictest form would resemble the new German legislation, which requires all testing to involve practitioner and prohibits DTC testing but with the added requirement for demonstration of clinical utility.

As far as service providers and users in Europe are concerned, the strict regulatory framework includes major requirements that would have a significant effect on the business models and service availability:

  • Pre-market evaluation: adds to time and cost to the development of tests – a significant problem in a fast-moving field. Personal genetics services require flexibility to allow new genes and single-nucleotide polymorphisms to be added, as the evidence reaches the level required, and if each addition required pre-market evaluation, it would reduce flexibility and may even be unworkable given the rapid pace of discovery and replication.

  • Clinical utility: as discussed above, this is not a straightforward concept to apply to personal genetic services, in which multiple effects of genes and environment contribute to the development of the common complex disease

  • Medical practitioner only: very restrictive, it would exclude alternative and complementary practitioners, dieticians, nutritionists, nurses, pharmacists and so on.

Relaxed regulation

The field of personal genetics is moving so rapidly that legislation is likely to be out of date by the time it is enacted. In a few years, it is probable that genotyping will be routinely performed and that individuals will already have their genetic information before making use of interpretation services, meaning that the laboratory testing step would simply be a laboratory-assay service and not linked directly to specific personal genetic services. In addition, the sale through internet of tests and services will make regulations hard to enforce. Given these circumstances, there are proponents of a more relaxed regulatory environment involving industry self-regulation through a strict code of practice, and market forces.

The self-regulatory approach, promoted by the HGC, has broad-based support, including members of the PHG community, identifying that ‘current problems with the application of European law seem to derive from the uncertainty as to how the regulations can and need to be interpreted’.36

What is a genetic test?

The regulatory framework is further blurred by the definition of what exactly is a genetic test. Traditionally a genetic test would screen a gene for the presence of disease-causing mutations and require little interpretation beyond positive or negative. The new genetic services focus mainly on screening variations of low penetrance, are based on association/epidemiological studies and deal with risks and probabilities rather than definites – they are no longer simple diagnostics with obvious medical consequences. Often several genes are included in the overall calculations of apparent genetic risk using complex algorithms and non-standard population data. On the basis of the calculated risks, further steps may be involved in the interpretation of the results and translation into advice on lifestyle changes designed to reduce the disease risk. Is the genetic test a simple laboratory screen for a genetic variation or is it the whole process from genotyping to interpretation? Are the software algorithms used to interpret the results, part of the ‘genetic test’ and should they be included in the regulations? Some of the DTC companies claim that they are offering health-related information rather than healthcare claims, and only the latter would be covered by proposed regulations. Examples of the confusion can be seen from the various statements on the websites of 23andMe and Decode, respectively, that includes:

23andMe: ‘What we do not and will not do is provide medical advice to our customers … The information on this page is intended for research and educational purposes only, and is not for diagnostic use. You should not change your health behaviours solely on the basis of information from 23andMe … Make sure to discuss your genetic information with a physician or other health care provider before you act on the Genetic Information resulting from 23andMe Services’.37

Decode: ‘The website is for informational purposes only and should NOT be used for medical decision making without consulting your physician. The Genetic Scan product is for informational purposes only, is not medical advice, and is not a substitute for professional medical advice, genetic counselling, diagnosis or treatment’.38

They both claim that the interpretations are for information only and yet either implicitly (23andMe) or explicitly (Decode) say that the information can be used by a medical professional. Both companies now screen for sensitivity to drugs such as warfarin, and the legal position of the healthcare provider with respect to the clinical use of these services is not clear. If a patient presents with an increased sensitivity to warfarin, should the healthcare provider use this information directly or order a confirmatory regulated clinical genetic test?

Genotyping or genetic services

Most current and proposed regulations include the actual genotyping as part of the process to be regulated, for example Article 2 of the Council of Europe protocol states that it applies to ‘analysis of biological samples of human origin and aiming specifically to identify the genetic characteristics of a person which are inherited…herein after referred to as genetic tests’.15 Within a few years, this part of the service will be less and less important and will become separated from the most important part, the actual interpretation of the genetics.

When genotyping becomes routine, it will become relatively cheap to set up a personal genetics company, as neither a lab will be required nor will there be the logistics of sample collection, all that will be needed is a website for delivery, and the end-user price is likely to be very cheap or even ‘free’. If there is no form of regulation, at least by a strong code of practice, the situation may become out of control with hundreds of companies offering all types of interpretation services. How will they be regulated, will the current legislation and proposals for future legislation become obsolete even before they are enacted? If a company sets up to sell a health-risk assessment service based on genetic information (supplied by customer), would the proposed regulations be applicable if they become law? A real example of this has already happened, in December 2009. DeCodeme offered a free service to customers of 23andMe – individuals were invited to upload their 23andMe genotyping data to Decode, who then processed the data and provided its own interpretations including health-risk assessments. It is clear that the current DecodeMe product that involves lab genotyping would be covered by all of the legislation/proposals so far, but it is not clear whether the processing and interpretation of the 23andMe data would be covered, as it does not involve ‘analysis of biological samples’.


There is a long way to go before there will be any form of standardised regulations throughout Europe and it will be important for an industry code of practice to develop a strong identity to promote clarity and trust amongst consumers, whether they are practitioners passing on the service to patients, or consumers directly. The requirement for a code of practice is especially strong at this stage of the industry's development – the current lack of clearly demonstrated clinical utility can make the services hard to sell, which in turn can encourage over the top marketing. The principles detailed by the HGC document (see Box 4) provide an excellent basis, and it would be helpful if all service providers (including companies, practitioners, and other resellers such as pharmacists, etc) followed these principles. It is still commonplace that personal genetic services are marketed through websites without giving adequate information, sometimes not even the genes. Scientific references are often not provided to support the services offered and if follow-on products such as creams and supplements are promoted, there may not even be full details of the ingredients let alone the scientific information to justify their use.

The current proposals under discussion do not incorporate sufficiently a scenario in which there is no laboratory procedure and just interpretation services are offered. This would be almost impossible to control, as it can be offered through the internet from anywhere in the world, there would be no possibility of enforcing ‘practitioner only’ services under these circumstances. A fragmented and unclear regulatory environment is not good for anyone, companies, practitioners or customers. As the situation stands at the moment in Europe, how should the various stakeholders act? For existing service providers and those companies considering provision of personal genetics services, the best advice would be to transparently follow the code of practice proposals of the HGC. For users of personal genetics, the advice is to look carefully at the offerings of providers, see whether they follow the code of practice and if it is not apparent, ask the company to provide the information that the code of practice requires, users should put pressure on companies to comply. All stakeholders from industry, academia, medicine, public health and consumers should work together to help to guide the regulatory framework to create an environment that protects the consumer from non-valid tests and services, and protects the growth of this new and exciting industry.