When the Referee Suits Up for Both Teams: The Self-Audit Problem in American Genomic Governance

American genomic governance rests on a quiet paradox. The biobanks, direct-to-consumer testing firms, and university research offices that steward millions of Americans' genetic profiles are, in most cases, the same entities that draft their data policies, certify their compliance, and investigate their own breaches. The referee, in effect, wears the jersey of one of the teams on the field.

This working paper argues that the resulting structure — self-drafted rules, self-performed audits, self-adjudicated disputes — is not an accident of neglect but a predictable feature of a sector that grew faster than its oversight. It closes with a proposal: a recognized, credentialed profession of independent genomic data auditors, modeled loosely on the certified public accounting tradition.

The Anatomy of a Closed Loop

Consider the typical lifecycle of a governance failure. A research repository adopts a data access policy written in-house. Compliance with that policy is assessed by an internal privacy office reporting to the same executive chain that approved the policy. When an incident occurs — an unauthorized secondary use, an over-broad data-sharing agreement, a law enforcement request handled without documented review — the investigation is conducted internally, and the findings rarely leave the building.

None of the actors involved need be acting in bad faith. The problem is structural. Internal auditors face career incentives, information asymmetries, and institutional loyalties that no code of conduct fully neutralizes. In genomics, where the underlying data is immutable, re-identifiable, and shared across relatives, the stakes of a soft audit are unusually high.

Failures That Followed the Pattern

The historical record offers instructive, if uncomfortable, case studies. University IRBs — the institutional review boards that oversee human subjects research — have been criticized by federal watchdogs and bioethics scholars for being housed within the very institutions whose research they approve, with funding and staffing dependent on the research enterprise they are meant to police. Reports from the HHS Office for Human Research Protections over the past two decades document repeated instances of approved protocols that bore little resemblance to the consent documents participants signed.

In the commercial sphere, the 2018 Golden State Killer investigation revealed that law enforcement had searched a consumer genealogy database without the informed knowledge of most users — a practice governed at the time by terms of service written, interpreted, and enforced by the company itself. Subsequent scrutiny by state attorneys general found that several firms' privacy practices diverged materially from their public representations, a gap that only external examination would have surfaced earlier.

These episodes share a signature: no independent party was positioned to notice, document, or disclose the divergence between promise and practice.

The European Counterexample

The European Union's General Data Protection Regulation offers a useful contrast. Article 37 requires many organizations to appoint a Data Protection Officer who must possess expert knowledge, be free of instructions regarding the exercise of their tasks, and cannot be dismissed for performing them. Crucially, the DPO must report to the highest level of management, not to the operational units whose conduct they assess.

The DPO model is imperfect — independence within an employer's payroll has limits — but it establishes a principle the American framework lacks: the person evaluating data practices must be institutionally insulated from the consequences of that evaluation. Genomic data, classified as a special category under GDPR, receives this scrutiny by default. In the US, where no comprehensive federal privacy statute exists, genomic data protection is a patchwork of the Genetic Information Nondiscrimination Act, the Common Rule, HIPAA, and state laws — none of which mandate independent review of data stewardship.

A Proposal: The Genomic Data Auditor

We propose the establishment of an independent auditing profession for genomic data stewardship, with the following elements:

• Credentialing. A certification body — potentially convened through professional societies in bioethics, health informatics, and information assurance — would establish examination standards covering genomics, privacy law, security architecture, and audit methodology.
• Mandated independence. Auditors would be engaged by institutions but contracted with term protections, reporting obligations to a board or trustees, and prohibitions on contingent compensation tied to favorable findings.
• Standardized reporting. Audit findings would follow a public disclosure format, with confidential annexes for security-sensitive details, analogous to financial audit standards under the Public Company Accounting Oversight Board.
• Liability and privilege. Statutory safe harbors would protect good-faith disclosures, addressing the current chilling effect on honest internal reporting.

Critics will note that auditing professions can become captured, box-checking enterprises — the financial crisis of 2008 offers a cautionary tale. This is a fair objection, and it argues for rigorous standard-setting and public transparency of audit reports, not for abandoning the model. Financial markets did not conclude that independent audits were worthless because individual auditors failed; they strengthened the profession's independence requirements.

Conclusion

The United States has built the world's most productive genomic research enterprise on a governance foundation that asks institutions to police themselves. The record suggests this foundation is inadequate to the material it holds. A credentialed, independent genomic data audit profession would not resolve every tension in American data governance, but it would insert the one element the current system conspicuously lacks: a referee whose paycheck does not depend on the score.