For digital privacy advocates, one of their worst fears is coming true in real time.
If all goes according to 23andMe’s latest plan, some yet-to-be-determined buyer will own the sensitive genetic data of 15 million people. It’s a decision that F. Mario Trujillo, a staff attorney for the Electronic Frontier Foundation, told Gazetteer SF is “a horrible idea that should be avoided at all costs.”
23andMe was once the darling of biotech firms in Silicon Valley. Founded by Anne Wojcicki more than 20 years ago, the company took the tech industry by storm with the promise of revolutionizing genetics and health care. At its peak in 2021, the company was worth $6 billion.
Now, 23andMe is looking to sell most of its assets through bankruptcy proceedings. That has brought into question what exactly will happen with the genetic data of 23andMe customers, leading privacy advocates and lawmakers, including California Attorney General Rob Bonta, to encourage customers to delete their data. And fast.
23andMe has tried to assuage those concerns. Board chair Mark Jensen, in a press release issued Sunday, said the company is still committed to protecting people’s genetic data “and being transparent about the management of user data going forward,” adding that “data privacy will be an important consideration in any potential transaction.”
But Trujillo argues that 23andMe has a “responsibility to its customers to make it as easy as possible for people to delete all their data before anything like this happens,” he said via email. “23andMe should give every user a real choice to say ‘no’ to a data transfer.”
So far, that hasn’t exactly happened.
Some 23andMe customers who have tried to delete their data were met with error messages Monday night, the Wall Street Journal reports. Others, myself included, were able to successfully delete genetic data from 23andMe.
23andMe did not respond to multiple requests for comment from Gazetteer request regarding how many data deletion requests the company has received since filing for bankruptcy.
In the email confirming my deletion request on Monday, 23andMe said it “will only retain limited information for the establishment, exercise or defense of legal claims, and as otherwise permitted or required by applicable law, and our genotyping labs are required to retain some additional information to comply with legal obligations.”
Trujillo said the 23andMe news should be a “wake-up call for lawmakers, who must work to pass stronger comprehensive privacy protections in general and genetic privacy protections in particular.”
State-based privacy laws, like California’s Genetic Information Privacy Act, is “a good start” but many lack the ability to allow customers to file a civil suit, Trujillo added.
23andMe competitor Ancestry, which has more than 27 million customers, has also undergone some changes as of late. Earlier this year, chief executive officer Deb Liu stepped down from her position, and the board tapped now-former chief financial officer Howard Hochhauser for the top role.
When Gazetteer reached out to Ancestry regarding what the company is doing to reassure its own customers that their data won’t suffer a similar fate, spokesperson Gina Spatafore directed us to a blog post from Hochhauser. In the note, published on Monday, Hochhauser acknowledged that the news “may leave some questioning the future of the industry or the value of DNA.”
He added that Ancestry is “stronger and more committed than ever to innovating” and that the company is “here to stay.”
But just as this should be a wake-up call for lawmakers, this may also be a wake-up call for customers. Maybe it was never a good idea to give a private company access to some of our most sensitive data.
