[vintermann]

Some DNA companies (FTDNA for one) play fast and loose with this.

FTDNA gives you a vcf file, which contains the variant calls, but not the raw reads which those calls are made from (as in the BAM file). They do keep that data, because they charge extra for a BAM file download. It's almost certainly against the GDPR. Worse, I think they do it for anticompetitive reasons - they own the largest Y-DNA tree, and don't want you uploading your raw data to competing trees (in particular YFull).

[sergey-a]

Storing genetic data is not against GDPR. It matters where they store it and who else has access to the data.

[vintermann]

That's not the issue. If you store PII, which genetic data certainly is, you have to delete it on request, and you have to allow the user to download all of it, everything they have on you, in standard formats. That's the reason all DNA services have data download options in the first place, but FTDNA's is incomplete.

FTDNA should either offer the BAM file for free on request, or offer the same information in a standard format - such as a fasta file with the reads, or a reference-compressed BAM file - so that the user should be able to reconstruct it on their own, or with a competing service (this is actually a service YSEQ offers). They currently don't do this, which means they're withholding PII.