In a shocking turn of events, 23andMe, the popular genetic testing company, has filed for Chapter 11 bankruptcy. Founded in 2006, the company quickly became a household name, allowing millions of people to explore their ancestry and learn about genetic health risks. However, after years of growing concerns—including a significant data breach settlement, management shake-ups, layoffs, and the closure of its drug development division—23andMe has found itself in financial turmoil.
As the company enters the bankruptcy process, many customers are left wondering: What happens to their genetic data? With over 15 million users worldwide, this is no small concern. Here’s a breakdown of what consumers need to know about how their genetic information might be handled moving forward.
What’s at Stake: The Future of 23andMe’s Customer Data
One of the primary concerns surrounding 23andMe’s bankruptcy is what will happen to the personal data of users, which includes highly sensitive genetic information. While the company has reassured customers, stating that the data will be managed according to its existing privacy policy, the uncertainty surrounding the situation raises valid questions.
So, what could happen to your genetic data in this process?
-
Data Sale or Transfer: In the event of a bankruptcy or sale, a user’s 23andMe data could be transferred to a new company or sold as part of the bankruptcy proceedings. This is outlined in the company’s privacy policy, which also states that the new company must adhere to existing privacy guidelines. However, this doesn’t guarantee that the terms won’t change once the data is transferred.
-
Privacy Policy Changes: Experts caution that the existing privacy policy, which governs how 23andMe handles data, can be altered. Should the company be acquired, the new owners could issue a new privacy policy, possibly altering how your data is used or shared. For instance, a new policy could involve greater data sharing with third parties or more lenient rules regarding sharing genetic information with law enforcement or other entities.
-
Data Use in Research: About 80% of 23andMe users have opted in to have their data used for medical research. While the company has previously promised to anonymise this data for research purposes, it’s important to note that it may not be entirely anonymous at 23andMe. The company can link the data back to its users, even if researchers don’t have access to identifying details.
What Legal Experts Say About Your Genetic Data
The legal and ethical implications of 23andMe’s bankruptcy are far-reaching. Dr. Arthur Caplan, a bioethics professor at the NYU Grossman School of Medicine, raises significant concerns about data privacy. He notes that while 23andMe promised to protect customer data, the company has not built sufficient consent mechanisms for users regarding how their genetic data could be used in the event of such a situation.
Anya Prince, a professor at the University of Iowa College of Law, pointed out that the privacy policy is key here. The policy allows for the sale or transfer of genetic data under bankruptcy conditions, which could mean your data ends up in the hands of a new company that may or may not respect the same privacy standards. Moreover, the policy allows the company to change its terms, meaning data privacy protections may be altered at any time, potentially exposing consumers to greater risk.
What Happens to Your Data in a Sale or Bankruptcy?
As I. Glenn Cohen, a professor of health law and bioethics at Harvard Law School, explains, 23andMe has indicated in bankruptcy filings that any buyer of the company would have to comply with its current privacy rules. However, it’s common for new owners to issue updated privacy statements and ask users to agree to the new terms.
In practice, this means a new company could potentially alter the way your data is shared, including:
-
Sharing with law enforcement: The current privacy policy states that 23andMe will only share your data with law enforcement after receiving a valid subpoena, search warrant, or court order. A new company might decide to adopt a different approach, allowing more frequent sharing of genetic data with authorities.
-
Data sharing with employers or insurance companies: Another potential concern is whether a new company might share your genetic information with employers or insurance companies—entities that could use genetic data for discriminatory purposes. The existing privacy policy protects against this, but a new owner could alter these terms.
Why This Matters: The Lack of HIPAA Protection for Genetic Data
Unlike health data shared with your doctor, genetic data collected by companies like 23andMe is not covered by HIPAA (Health Insurance Portability and Accountability Act). HIPAA provides strong protections for your medical information, ensuring that it’s kept confidential. However, because 23andMe operates as a business, not a healthcare provider, its policies are not bound by these same regulations.
This means that while your doctor cannot share your health data without your consent, a company like 23andMe has much more leeway in how it handles your genetic data. This becomes particularly concerning when the company faces bankruptcy, as your data could be sold or transferred without the same privacy protections afforded to patient information under HIPAA.
What Can You Do to Protect Your Data?
If you’re worried about what might happen to your genetic data, you do have some options. For instance, you can delete your account and request that your genetic sample be destroyed. Many states, like California, have genetic privacy laws that give you the right to delete your data and revoke permission for its use in research.
Here are some steps you can take to protect your genetic information:
-
Delete your account: Visit 23andMe’s website to learn how to delete your account and remove your genetic data from their systems.
-
Destroy your sample: If you’re in a state with strong genetic privacy laws, you may also be able to request that your saliva sample be destroyed.
-
Revoke research consent: You can opt-out of having your data used for medical research, providing greater control over how your information is shared.
Conclusion: The Uncertain Future of 23andMe and Its Users’ Data
The bankruptcy of 23andMe raises serious questions about the future of users’ genetic data. While the company has promised that it will continue to follow its privacy policy during the sale process, the reality is that customers’ sensitive data could be transferred to a new company that may not honour those same privacy protections.
As the situation unfolds, users must be aware of the risks and take proactive steps to protect their genetic information. Whether that means deleting accounts, revoking consent for research, or simply staying informed about changes to privacy policies, consumers must remain vigilant in an increasingly uncertain digital landscape.
Relevant Links for Further Reading
Photo credit: CNBC
