By definition, there's nothing more personal than someone's unique genetic code. So when California Attorney General Rob Bonta warned residents last week that the looming bankruptcy of genetic testing and analysis company 23andMe could put the biological data of some 14 million users at risk, his consumer rights alert struck a particularly sensitive nerve. Here, it seems, is the nightmare scenario about which many privacy experts had long warned.
Residents should "consider invoking their rights" to demand 23andMe "delete their data and destroy any samples of genetic material," Bonta said in a press release. The company claimed in an open letter that its bankruptcy filing does not "change how we store, manage or protect customer data." Any future buyers will be "required to comply with applicable law" regarding user data. Even so, security specialists remain concerned about what could happen to 23andMe's genetic treasure trove.
'Several fronts' of concerns 23andMe has attempted to assuage user fears by claiming "any customer data it shares with other parties is anonymous and can't be traced to individual users," said CBS News. Still, concerns about data protection have "swirled in recent years," said CNBC, particularly after "hackers accessed the information of nearly 7 million customers" in late 2023.
Privacy experts are "watching the company's challenges with concern on several fronts," said Geoffrey Fowler at The Washington Post. Not only is safeguarding against hacks "hard for any company to do under bankruptcy proceedings," but new ownership could use your data for "new purposes" not included in the original user agreement.
What protections are available? Many customers may have assumed their private genetic data is protected by laws such as the Health Insurance Portability and Accountability Act, or HIPAA, which "creates rules about what can be shared," said health law expert I. Glenn Cohen to the Harvard Gazette. But since 23andMe is a direct-to-consumer business and not a medical provider, the law treats those clients "essentially as a consumer, not as the patient." Bankruptcy laws offer "some protections, but they are not perfect."
Ultimately, 23andMe's bankruptcy represents "one of the biggest threats to Americans' personal data in decades," said Sen. Ron Wyden (D-Ore.) on Bluesky. "I strongly urge you to delete your data to protect it from whoever the new buyer might be." |