23andMe Bankruptcy: Privacy Risks for Millions’ Genetic Data

23andMe, the popular U.S.-based genetic testing company known to the public since 2006, recently filed for Chapter 11 bankruptcy protection, putting its extensive database of genetic information of millions of users up for sale. This development has alarmed privacy experts and civil rights advocates concerned that highly sensitive data could end up in the wrong hands.

Turning Genetic Data into a Commodity

23andMe gained prominence by promising to help people better understand their genetic predispositions to diseases and enabling connections with long-lost relatives. However, following its bankruptcy filing last Sunday, the genetic profiles of millions of users have become assets available to the highest bidder.

Tazin Kahn, CEO of the nonprofit Cyber Collective, an organization advocating for digital privacy, warns that users have lost control over their sensitive information: “People have no real say over where their data will go. How can we be sure the downstream impact of whoever purchases this data won’t be catastrophic?” she asked.

Unique Risks of Genetic Data

The risks associated with genetic data are particularly severe. Unlike passwords, addresses, or even Social Security numbers, DNA data is immutable. In some cases, genetic information has already been used by law enforcement to solve criminal cases, sometimes without direct consent from individuals who originally provided their data.

In 2023, a serious data breach exposed personal information from around 6.9 million 23andMe users—nearly half of the company’s user base at the time. This incident underscored the vulnerability of genetic data to misuse.

Lack of Adequate Legal Protection

In the United States, there is no comprehensive federal regulation protecting genetic data held by technology companies. Andrew Crawford, an attorney at the Center for Democracy and Technology, highlighted that HIPAA, the U.S. federal law designed to protect medical information, largely applies only when data is held by healthcare professionals, not technology companies like 23andMe.

“HIPAA protections generally don’t apply to data collected by IoT devices, such as fitness trackers, or by private DNA testing companies,” Crawford emphasizes.

Official Warnings to Users

In response to the situation, California Attorney General Rob Bonta issued official guidelines instructing users how to delete their genetic data, request the destruction of existing DNA samples, and prevent third-party access to personal information used in research.

A Wake-up Call to the Public

Emily Tucker, director of Georgetown Law’s Center on Privacy and Technology, described 23andMe’s bankruptcy as a “wake-up call” for the American public: “People must understand that when they provide their DNA to a commercial company, they’re putting their genetic privacy at the mercy of that company’s policies, which could change at any time.”

These risks affect not only the individual user but also their biological relatives, significantly amplifying the severity of potential data misuse.