It's not required for a company, but if it doesn't exist then I think it's okay to assume that they are not following the highest ethical guidelines.
Back in 2010, the company "23 And Me" caused an uproar because they were gathering data without an IRB. They instead got a post-hoc review when, during a publication peer review, they were asked about the missing IRB. Their board said basically that since the data isn't traceable to an individual, it falls outside of the requirements for an IRB.
People are still pissed off about this. See http://scientopia.org/blogs/drugmonkey/2013/02/21/plos-genet... . I agree - the IRB exception must be done before the data is gathered, not afterwards.
What is to prevent someone from dumpster diving to collect dna?
While that dna is anonymous if anything interesting turns up in the dna it would be possible to trace it back to the owner with some certainty because if it was, say, at a restaurant you could (assuming the use of credit cards, security cameras) be tied to patrons of that restaurant or workers. And at that point you could triangulate enough to have a reason for further investigation and/or get warrants for things. Perhaps (ianal).
Taking this further how would something like that be viewed? I'm curious to what extent that would be viewed as unethical (in the US SCOTUS already has said you can pick through trash). So it appears to be legal.
In general? Nothing. The only prohibitions I know of are the ones I mentioned (related to scientific research), plus some prohibitions related to the use of DNA to affect insurance or employment.
I can't easily predict what the future might bring. Science fiction stories have postulated that a police officer might use some sort of sequencing device to vacuum a place to see who was there recently. To be countered by someone releasing dust/cells picked up from public transport seats.
My guess though is that it will be acceptable. Just like state camera surveillance is acceptable.
http://www.youtube.com/watch?v=TiLX4bkKguA - video of several arrests using said premise.
A great way to build a database of dna! To be used for other reasons.
While I am not seriously thinking that this is some plot to do this it reminds me a bit of the scheme that the authorities use to round up people wanted on warrants by sending them a message that they have won a vacation. Then they all show up at the convention center to collect their winnings and are arrested en masse saving time and trouble.
In a sense this is really (or I should say really I should say "could be") an example of social engineering.