23andMe, a prominent genetic testing company, filed for bankruptcy protection in March 2023, stirring concerns about the future of its customers’ genetic data. The filing has drawn an unprecedented response from some 15 million customers. In the wake of that announcement, nearly 1.9 million people—approximately 15% of the customer base—have taken the proactive step of requesting their genetic data be deleted. This step comes amidst an increasing demand to prevent the sale, charter, or misappropriation of sensitive data.
Joseph Selsavage has an unenviable challenge. Now he has to row through stormy seas to convince the traveling public that their personal information is kept safe with private contractors. The bankruptcy has raised questions about how the company will handle the genetic information it once shared with the public. At the same time, several states, including New York, have brought suit against the sale of these private details.
Customer Concerns Over Genetic Privacy
The wave of deletion requests shows that public sentiment about genetic data privacy among consumers has undergone a seismic shift. Customers, once willing to share their DNA for research purposes, are now reconsidering their choices amidst uncertainty following the bankruptcy filing. The legal landscape surrounding genetic data is rapidly shifting as well, with more than two dozen states signing onto lawsuits against 23andMe.
Given these changes, consumers should make an effort to educate themselves and take extra precautions. Withdrawing your consent for research is simple and without difficulty. It’s really easy — just navigate to Research and Product Consents under Account Settings in your 23andMe account. This option provides customers with precisely the level of control they need over how their data is used and shared in the future.
“23andMe will also retain limited information related to your account and data deletion request, including but not limited to, your email address, account deletion request identifier, communications related to inquiries or complaints and legal agreements for a limited period of time as required by law, contractual obligations, and/or as necessary for the establishment, exercise or defense of legal claims and for audit and compliance purposes.” – 23andMe’s privacy policy
Legal Actions and Regulatory Scrutiny
The legal challenges facing 23andMe are the most recent example of increasing scrutiny regarding genetic data privacy. The Attorney General of New York has taken action to protect residents’ genetic information amid concerns that it could be sold or improperly accessed. The lawsuits from state Attorneys General unite to point out the lack of clear regulations on how genetic data should be used and stored.
Until these broader questions are resolved, customers are in an uncomfortable situation when it comes to knowing what will happen to their valuable genetic information. The financial ramifications of the Chapter 11 bankruptcy petition could change the manner in which 23andMe conducts business and its future intent to protect customer information.
Navigating the Future of Genetic Data
The questions posed by 23andMe’s bankruptcy—and its potential fallout—are crucial to consider if we hope to address the future of genetic data management. An increasing number of customers request to delete their genetic information. The onus is now on the company to change its policies to better address all these concerns. Transparency and consistent communication will be imperative for it as it seeks to win back the trust of its millions of customers.
Customers who have given private companies access to their DNA must continue to be informed about their choices and rights regarding their genetic data. This goes to how much data 23andMe still holds onto even after one requests deletion of their data. The 22-page company-wide privacy policy states that the company will retain personal information only as strictly necessary to fulfill legal obligations.
“23andMe will also retain limited information related to your account and data deletion request, including but not limited to, your email address, account deletion request identifier, communications related to inquiries or complaints and legal agreements for a limited period of time as required by law, contractual obligations, and/or as necessary for the establishment, exercise or defense of legal claims and for audit and compliance purposes.” – 23andMe’s privacy policy
