An investigation by WMAR-2 News has found that the Maryland Department of Health and Human Services has quietly halted implementation of key portions of a landmark privacy law protecting ancestral information online.
The law, enacted last year, was seen as a model for other states looking to set standards for when law enforcement can access DNA uploaded by Americans researching their heritage.
“States that don’t have laws like ours are kind of a wild west,” said Natalie Ram, a law professor at the University of Maryland.
State law set some of the first frontiers in the nation for forensic genetic genealogy, a technique sometimes used to help solve the toughest murder and rape cases.
Authorities collect DNA from a crime scene, and when they can’t find a match for known criminals in law enforcement databases, they compare the sample to profiles of millions of Americans whose DNA was obtained from online genealogy research.
“Like trying to find my long-lost relatives, would we use the exact same publicly available tools to find out whose DNA this is?” said Ray Wickenheiser, director of the New York State Police’s Crime Lab System.
Forensic genetic genealogy has become a more popular practice after 2018 when it helped capture Joseph DeAngelo, the infamous “Golden State Killer.”
But unlike a police search of a home or car, there were virtually no standards for when and how law enforcement could access genetic genealogy data online.
Maryland law established some of the nation’s first guard rails for the investigative tool.
“It’s comprehensive,” Ram said. “It governs the initiation of forensic genetic genealogy, how it is carried out.”
WMAR 2 News’ investigation found that almost a year after the law came into force in October 2021, important parts of it have yet to be rolled out.
The Maryland Department of Health has yet to publish best practices and minimum qualifications for individuals using forensic genetic genealogy.
In a mandatory annual report, a branch of the governor’s office has failed to disclose how often law enforcement accesses ancestry data and the number of complaints.
The health department has also suspended a task force working on the new regulations without even giving any members of that task force, including Wickenheiser, an explanation.
The Maryland Department of Health did not respond to WMAR 2 News’ detailed questions about the lack of progress.
But emails obtained by government requests for open records show a decision had been made by March to halt implementation of large parts of the law.
dr Tricia Nay, director of the Department of Health’s Office of Health Care Quality, wrote in a March 16 email, “Unfortunately, the OHCQ has not received staff or funding for this bill, so we are unable to implement it at this time.”
A spokesman for the Department of Health confirmed that there are no funds to support the law this fiscal year, which runs through June 2023.
That was news for Ram, who was working with lawmakers to get the landmark law on the books.
“That worries me,” Ram said. “I want this law to be implemented and I hope there are resources available to do that.”
The law faced other challenges, including concern and opposition from a key Health Department head.
In an email dated June 13, 2021, Paul Celli, Public Health Administrator for Clinical and Forensic Laboratories, wrote: “I’m just not sure how to start with all of this. The bill mandated OHCQ to do all of this without consultation…I don’t even agree with most of what it says…”
Emails show that by this summer, communications appeared to have broken down between the Maryland Department of Health and Human Services and the Maryland State Police, another agency also required to help introduce the law.
“I still don’t know what MDH intends to do with the regulations. They have gone silent and I have tried every avenue at my disposal to try to find a solution to no avail,” said Dan Katz, the Maryland State Police lab chief, in a July 13 email.
Katz declined a request to be interviewed for this story.
Maryland Department of Health and Human Services spokesman Chase Cook sent a statement responding to the WMAR 2 News findings: “The Maryland Department of Health and Human Services has been actively working internally and with our partner state agencies to implement this law of which we are aware that it has not been implemented anywhere else in the United States. We will provide further updates as they become available.”
For now, Ancestry sites set their own privacy rules.
The Terms of Service for ancestry.com and 23andme.com state that they will not voluntarily provide data to law enforcement agencies.
There are looser restrictions on GEDmatch.com, a free online ancestry database used to find the Golden State Killer
The site has 1.8 million profiles.
Users must opt out if they do not wish to share data with the police.
“It’s critical to me that Maryland continues like this,” Wickenheiser said. “The sooner we can have these discussions and get these laws in place, the better. We want to prevent and solve crime, and we also want to make sure that we respect people’s rights.”
A major test of how things are going in Maryland is just weeks away.
The law requires the health department to establish licensing requirements for labs that use forensic genetic genealogy by October 1.
