1 week Ago
Genetic information company 23andMe has said that it is headed to bankruptcy court, raising questions for what happens to the DNA shared by millions of people with the company via saliva test kits. Last week’s announcement clears the way for a new company to purchase 23andMe — and the wealth of genetic information in its databases. The privacy statement of 23andMe reads: “If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction.
” As people scramble to scrub their information, experts say the situation presents a privacy nightmare that could have cascading effects. The uncertainty around 23andMe’s data spotlights the risks for anyone using genetic-testing services, they added. The sector has boomed in recent years with companies such as Ancestry, FamilyTreeDNA and others also amassing their own troves of genetic data.
“I don’t think the average consumer could foresee all of the future uses, or all of the future people, that could be controlling or accessing their information years from when they do a swab,” said Sara Geoghegan, senior counsel at the Electronic Privacy Information Center. “People are right to be concerned about the privacy of their genetic information.” It’s unclear who might take ownership of 23andMe.
But experts said there are a lot of reasons genetic data could be valuable. “There are a breadth of commercial actors that may want to use genetic data for all sorts of commercial enterprises,” said Jennifer King, a privacy and data policy fellow at the Stanford University Institute for Human-Centered Artificial Intelligence. Pharmaceutical companies and precision medicine companies might be interested in acquiring such data, King said.
Drugmaker GlaxoSmithKline purchased a $300 million stake in 23andMe in 2018 and licensed its data for drug development. Another genetic-testing company also may want to grab the database, she added. In 2020, private equity giant Blackstone acquired Ancestry for more than $4 billion.
“There were a lot of questions at that time. What would they want to do with all of this data?” said Katie Hasson, associate director at the Center for Genetics and Society. “I don’t know who, or what companies specifically, would want to buy 23andMe,” Hasson said.
“But we are seeing the ways that our personal data is being vacuumed up and collated, and sold to different companies for marketing, targeting for ads, and who knows where it goes from there.” In a statement to customers, 23andMe said that it “will seek to find a partner who shares our commitment to customer data privacy” and that “any buyer of 23andMe will be required to comply with applicable law with respect to the treatment of customer data.” But there aren’t many laws applicable to personal genetic data, experts said.
If 23andMe’s trove is sold, “your data could be used for all sorts of things that you did not sign up to have it used for,” King said. “This has been a question and a concern for a long time: What happens to this data in these databases when one of these companies goes out of business or gets sold to another?” Hasson said. Information collected by genetic-testing companies is not protected by the Health Insurance Portability and Accountability Act (HIPAA), which sets standards for how health care providers, insurers and others handle patients’ health information.
But the data is undoubtedly valuable and poses major privacy risks given its immutable nature. “Genetic information is permanent. It’s also sensitive.
It reveals information about your health, your purported ancestry and relationships far beyond what you may be aware of yourself,” Hasson said. Law enforcement has used genetic data in its investigations. In 2018, police tapped into GEDmatch’s DNA database to find the “Golden State Killer” suspect, jump-starting law enforcement interest in “genetic genealogy.
” While there are policies that limit law enforcement’s use of such databases — and many of these services say they won’t voluntarily share information — loopholes and gray areas exist, experts said. Genetic data can reveal a person’s risk for certain diseases and health problems. The Genetic Information Nondiscrimination Act (GINA) prohibits the use of genetic information in employment and some insurance decisions but has “big loopholes,” Hasson said.
The law does not address life, long-term care or disability insurance, nor employee wellness programs. Disclosure of genetic data on individual health risks can lead to other forms of discrimination as well — someone known to be predisposed to Alzheimer’s disease may face limits as they seek housing, experts said. “The fact that consumers can’t know all of the ways their data could be used is very harmful,” Geoghegan said.
It may also be used in ways that no one anticipates, as scientific discoveries expand what information can be derived from DNA, experts said. If someone shared their DNA with 23andMe, experts say they should delete their data immediately and request the company to dispose of any genetic material samples. The Washington Post has instructions on how to do that.
“Delete, delete, delete,” Geoghegan said. “Consumers should delete their accounts while they still can.” 23andMe’s bankruptcy — and the looming questions around its hefty genetic database — should serve as a cautionary tale, Geoghegan added, for anyone that has shared their DNA with a genetic information service.
Those consumers should also consider deleting their data — regardless of the company’s current financial status, experts said, noting that it’s risky to have such sensitive data lingering in others’ hands. Privacy statements of both Ancestry and FamilyTreeDNA say that consumers have the right to request that the companies delete their data and destroy any genetic samples. “Get the information you want and don’t let the data sit there,” King said.
“Once you’ve had the fun you wanted to have with the company and the results you got, get rid of it — have that sample destroyed and ask for the data to be deleted.” This case also stresses the need for stronger national policies that protect people’s privacy, she said. “Corporate changes can so drastically alter the safeguards for our sensitive personal information,” Geoghegan said.
“The pinkie promise that these companies will protect your sensitive information is not meaningful. We need meaningful, enforceable privacy regulations in place to best protect us.”.
