It's a little sketchy, but it was a public database. Everyone who submitted data (and who skimmed the policy) knew that. The fact that if I submit my DNA it gives you information about my family, who were never consulted about the privacy of their DNA, is where it gets ethically hazy.

I find I've pretty much accepted that personal privacy had a good century or two's run, but it's on life support at a hospital that's way behind on its utility payments.

If the private company that owns the database wants to use the data, they're within their rights to do it. This is the result you get when your culture is institutionally opposed to publicly held, nationalized clearinghouses.