What will happen to DNA data of 15,000,000 customers after popular testing site files for bankruptcy
Popular DNA testing site 23andMe, which millions of customers have used to find out more about their ancestry, has filed for bankruptcy. Here's what we know about what will happen to that personal data.
In recent years, the opportunity to learn about your family history has intrigued people across the US and beyond. People want to know if their grandparents' tales about Irish blood is real or whether they really have Italian genes buried somewhere, and the rise of DNA testing website has made that easier than ever.
The process is simple: order a kit from your chosen website, submit a sample of DNA - typically saliva - and send it off to be tested. You might not think much about it, but what happens if your DNA ends up in the wrong hands?
This is the concern of many people after popular website 23andMe declared it had filed for bankruptcy in a press release on March 23, saying it had chosen the route to 'facilitate a sale process to maximize the value of its business'.
Advert
Why has 23andMe filed for bankruptcy?
After going public in 2023, the DNA testing company has failed to turn a profit, BBC News reports.
The company has faced allegations that it failed to protect the privacy of nearly seven million customers whose personal information was exposed in a data breach in 2023, and in the wake of the settled lawsuit 23andMe got rid of 200 of its employees.
Now the company's CEO, Anne Wojcicki, has resigned with immediate effect, with finance chief Joe Selsavage set to take over as interim chief executive.
Explaining the decision to file for bankruptcy, Mark Jensen, Chair and member of the Special Committee of the Board of Directors, said: “After a thorough evaluation of strategic alternatives, we have determined that a court-supervised sale process is the best path forward to maximize the value of the business.
“We expect the court-supervised process will advance our efforts to address the operational and financial challenges we face, including further cost reductions and the resolution of legal and leasehold liabilities. We believe in the value of our people and our assets and hope that this process allows our mission of helping people access, understand and benefit from the human genome to live on for the benefit of customers and patients.”
What happens to all the data held by 23andMe?
Approximately 15 million people are believed to have submitted DNA to 23andMe, meaning all of their data now hangs in the balance.
In its press release, 23andMe stated that it 'intends to continue operating its business in the ordinary course throughout the sale process', and assured there are 'no changes to the way the Company stores, manages, or protects customer data'.
But with the prospect of a sale in the air, customers still have questions.
Speaking to NPR, 23andMe customer Chenedy Wiles said: “I absolutely think this needs to be clarified. The company has undergone so many changes and so much turmoil that they need to figure out what they’re doing as a company. But when it comes to my genetic data, I really want to know what they plan on doing.”
When contacted by the publication, Andy Kill, a spokesperson for 23andMe, did not comment specifically on what the company might do with the genetic data it holds.
However, he reiterated a commitment to privacy, saying: “For our customers, our focus continues to be on transparency and choice over how they want their data to be managed.”
Kill noted that approximately 80 percent of 23andMe’s customers agreed when they signed up to the service to have their genetic data analyzed for medical research; a choice that plays into an agreement between 23andMe and pharmaceutical giant GlaxoSmithKline, which allows the drugmaker to use customer data to develop new treatments for disease.
When it comes to issues relating to law enforcement, Kill made clear that 23andMe uses 'all legal measures' to resist requests about DNA data.
Can 23andMe customers do anything to protect their data?
Anya Prince, a law professor at the University of Iowa's College of Law who focuses on genetic privacy, told NPR that the Health Insurance Portability and Accountability Act (HIPAA) does not apply to 23andMe, and therefore does not protect the data the company holds.
However, some states, including California and Florida, do give consumers rights over their genetic information.
Prince said: “If customers are really worried, they could ask for their samples to be withdrawn from these databases under those laws.”
UNILAD has reached out to 23andMe for comment.
Emily Brown