The Future of 23andMe: Data Privacy in Turmoil
The genetic testing pioneer, 23andMe, is currently navigating through a significant crisis, exacerbated by a recent data breach and its ongoing financial struggles. With bankruptcy looming, 23andMe is raising alarms regarding the fate of the genetic information belonging to approximately 15 million customers.
Declining Operations and Financial Challenges
Once valued at $6 billion following its public offering in early 2021, 23andMe has seen its market value drop by more than 99% as it continues to experience substantial losses. The company’s profitability issues stem from decreased consumer interest in its saliva-based testing kits and insufficient growth in subscription models.
In 2023, a prolonged data breach compromised nearly 7 million user accounts, which severely damaged the company’s standing. In response, 23andMe settled a lawsuit related to this data breach for $30 million.
Management Uncertainty and Leadership Changes
Shortly after the data breach settlement, CEO Anne Wojcicki made headlines by exploring third-party acquisition offers for the business. However, she later stated her intention to take the company private instead. This led to immediate resignations of all independent board members, highlighting the managerial instability within the organization.
In March 2024, 23andMe filed for bankruptcy protection, which will likely result in the sale of its assets, including its extensive genetic data collections.
Understanding Data Privacy and Protection
23andMe has collected extensive data from users, including genetic predispositions and family ancestry. Although many customers may believe their data is protected under healthcare laws such as the Health Insurance Portability and Accountability Act (HIPAA), 23andMe is not classified as a HIPAA-covered entity. This means that customers’ information is primarily safeguarded by the company’s own privacy policies, which remain subject to change without notice.
According to Andy Kill, a representative from 23andMe, the company believes its self-imposed data handling model is preferable compared to the traditional HIPAA framework used in healthcare.
Potential Risks in Asset Sale
In light of the company’s financial predicament, there are concerns that customer data could be sold should the company undergo a merger, bankruptcy, or acquisition. The privacy policy explicitly mentions that personal information may be accessed, shared, or sold in such contexts.
Anne Wojcicki has indicated a shift in business focus away from costly drug development towards leveraging the company’s database of customer information for marketing to pharmaceutical companies, raising substantial privacy concerns.
Despite assurances that privacy policies would remain in place during a sale, the practical application may differ significantly under new ownership. Organizations with agendas tied to law enforcement might alter how customer data is utilized, which worries privacy advocates.
Customer Actions to Protect Their Data
With the ongoing turmoil at 23andMe, authorities and privacy advocates suggest that individuals take proactive measures to secure their data. For instance, California’s attorney general, Rob Bonta, has confirmed that state residents can request the deletion of their genetic information under certain laws.
Meredith Whittaker, president of Signal, emphasizes the importance of data deletion, stating, “If anyone in your family gave their DNA to [23andMe], for all of your sakes, close your/their account now.”
If you wish to delete your 23andMe account, the process is straightforward. Users can navigate to Settings > Account Information > Delete Your Account within their profile. However, it’s critical to note that account deletion may not remove all data, as the company retains certain information for compliance and legal requirements.
Conclusion
As 23andMe grapples with leadership instability and the implications of financial decline, many customers are left questioning the privacy and security of their genetic information. These developments serve as a stark reminder to consumers about the importance of understanding data privacy in the ever-evolving landscape of genetic testing services.
First published on October 19, 2024, and updated since.
