To address such risks, DeCode developed an encryption tool known as the Identity Protection System. After months of testing the system, the government replaced those individuals carrying encryption keys in their pockets with the automated encryption software. The encryption takes place at the Noatun Research Services Center, a blood collection facility financed by DeCode, where doctors send those patients who agree to participate in DeCode studies. The Data Protection Commission of Iceland members can log in remotely and find out what data has been sent back and forth and halt the process if they so choose.

But Hauksson and others say that doesn’t go far enough. In a small country like Iceland, they argue, it’s easy to figure out individual identities based on clinical data, even if personal identification numbers are encrypted. Mannvernd has filed a case in court, suing the government and DeCode for violating Icelanders’ right to privacy.

DeCode says a majority of Icelanders support its work, at least according to a recent Gallup Poll it commissioned. But Hauksson attributes that result to a DeCode marketing campaign that appealed to Icelanders to contribute to the global fight against diseases. Though Hauksson thinks the Icelandic population does offer a wealth of data for genetic disease research, he would prefer that public institutions use the data in the interest of medical progress rather than profit. Neither DeCode nor its partners, Hauksson points out, have revealed any data on their disease-gene discoveries for others in the genomics community to verify or build on.

Opposition to DeCode’s information monopoly isn’t limited to Icelandic naysayers. Dr. George Annas, a medical ethicist and professor at Boston University’s Schools of Law, Medicine and Public Health, says DeCode should obtain informed consent from individual Icelanders before including their medical records in the database and should allow them to withdraw from studies they don’t approve of. The Data Protection Commissioner of the European Union and the World Medical Association has echoed those beliefs.

DeCode’s Stefansson shrugs off the criticism. "The opposition isn’t large; it’s just been somewhat noisy," Stefansson insists. Pointing to DeCode’s third-party encryption technology, he says it would be a lot easier to get information on Icelanders by simply walking into a doctor’s office and grabbing their records.

Annas says that the controversy over DeCode is mild compared with what would erupt if other companies and national governments attempted similar collaborations. And while no one expects a U.S. company to gain the kind of monopolistic access to national medical, genealogical and genetic information that DeCode has, similar databases are expected to proliferate on a smaller scale, generating the same ethical concerns.