23andMe, a genetic testing and ancestry-tracing company, collects the most personal data from its customers: their DNA.
Now, after a data breach in late 2023 and the resignation of the entire board of directors, the company faces an uncertain future, and many customers believe that the genetic information they once willingly handed over may be vulnerable. CEO Anne Wojcicki also previously said she would consider a potential takeover of the company, which has raised concerns among customers about what would happen to their data in the event of a sale.
Wojcicki later clarified that she was not considering takeover offers from third parties, and that she intended to take the company private.
“Anne also expressed her strong commitment to customer privacy and pledged to maintain our current privacy policy, including after the intended completion of the acquisition she is pursuing,” 23andMe said in a statement to CBS MoneyWatch.
In a social media post on X earlier this month, Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation (EFF), suggested that 23andMe account holders take steps to delete data held by the company.
“If you have a 23andme account, today is a good day to log in and request that your data be deleted,” she wrote.
Other cybersecurity experts confirm that user data is no longer at risk today in the midst of the company’s turmoil, but all 23andMe customers should review its privacy policies and think about how they share their data and with whom they want.
23AndMe faces class action lawsuit 00:22 Is my data safe?
Galperin and other cybersecurity experts recommend account holders take steps to protect their data, including by deleting their 23andMe accounts.
“A lot of people are focused right now because of concern about the potential change in ownership,” Anya Prince, a University of Iowa law professor and genetic privacy expert, told CBS MoneyWatch. “But data is no more vulnerable today than it was while 23andMe continued.”
In addition to sharing their data with 23andMe, customers have always had the ability to consent to 23andMe sharing their non-identifying genetic information with third parties, for a variety of purposes, including the development of medical research. “However, it could be identifiable because the genetic data is very unique. So there are vulnerabilities, but they are not necessarily unique to where 23andMe is now,” Prince added.
What can someone do with my genetic data?
A person’s genetic information reveals a lot about his or her family’s health. “So, if someone has access to that information, and they can identify you, they can learn something about your health,” Prince said.
It is conceivable that a pharmaceutical manufacturer could better tailor its advertising to individuals, for example.
“It may be harmless, as products will be marketed for diabetes if you have a predisposition. It may be annoying, but it’s harmless,” she explained.
23andMe said nearly 80% of its customers agree to participate in the company’s research program, which it said has produced more than 270 peer-reviewed publications revealing new genetic insights into diseases.
New bill could force California to reveal identity of people who share your child’s DNA at 04:47
“Some people are unhappy with what’s being shared. They don’t want their information going to companies so they can advance their research because they might say, ‘I paid 23andMe for genetic testing and they’re making money,’ and pharmaceutical companies are making money from my data,” Prince said. “This may seem like a personal insult.”
How can health insurance companies use my information?
Since 2008, the Genetic Information Nondiscrimination Act (GINA) prohibits health insurance companies from denying coverage to individuals or increasing premiums based on genetic test results. In addition, most states have their own laws that at least limit discrimination in genetic information.
“Health insurance companies won’t be able to deny access, so health insurance is safe,” Prince said.
Protections for other types of insurance, including long-term care and disability, are less robust.
“In the vast majority of states, these types of insurance are allowed to take into account a person’s genetic information,” she explained. Only Florida has written laws prohibiting the three types of insurance from making decisions based on an individual’s genetic information.
While current laws prohibit insurance companies from discriminating against individuals, a more sinister third party, armed with large amounts of genetic information, could do harm, said Jason Kelly, director of activity at the EFF.
“The concern is not about what people might find out today, but in the future,” Kelly said. “Having access to this type of information can give a person a tremendous amount of information about groups of people and perhaps individuals.” “There is a kind of dystopian nightmare scenario where this kind of data could be linked to individuals or leaked to the Internet.”
Can I delete my data?
An individual account holder can request deletion of his or her genetic information under the terms of 23andMe’s Privacy Policy.
“You have the ability to download the data and delete your account if you are no longer interested,” Prince explained.
If you have already consented to the company sharing your data in a non-specific way for research purposes, you can revoke that consent, but you cannot withdraw data that has already been shared. “You can’t find it in any drug company it’s already shared with, because there’s no person’s name associated with it,” Prince said. “So there’s nothing that can be done there.”
The process of deleting a person’s data from the 23andMe database is automated and straightforward.
“If, at any time, you are no longer interested in participating in our services, you can delete your 23andMe account directly through your account settings,” the company says on its website.
This requires you to log into your account and place an order. The Company then sends you a confirmation of the data deletion request by email, which you must verify. Then the deletion process begins.
Kelly urges people to “think carefully about how much data they give away when they use a service like this.”
He noted that few, if any, people within his organization used the ancestry tracking service.
“In general, sharing such data with any third party is something people should take seriously,” he said. “For a long time, people didn’t know what information they were providing and how it was being used, and people are becoming more aware of how their information is being used or could be dangerous if there is a data breach.”
The company’s stock, which has traded in 2021 at more than $16, closed Monday at 29 cents.
More CBS News
Megan Cerullo
