Consumer Genomics, 23andMe, and the Challenges of DNA Privacy
Image credits: Sundry Photography | Adobe Stock
The flagship personal genomics company 23andMe recently announced that it has filed for bankruptcy. What does this mean for their customers?
23andMe is a personal genomics and biotechnology company founded nearly 20 years ago. It’s best known for offering direct-to-consumer genetic testing kits that enable individuals to learn about their ancestry, genetic traits, and potential health risks based on their DNA.
Anne Wojcicki, who recently stepped down as CEO, always said that she wanted to put people back at the center of healthcare, empowering them to have more agency in their health and medical decisions. The key to that agency? Data. But how is that very sensitive personal data being handled today?
In their press releases, 23andMe is emphasizing that this bankruptcy filing is intended to make it easier to sell the company’s assets. Yes, that includes customer data. And they’re emphasizing that they are seeking a partner “who shares our commitment to customer data privacy and allows our mission of helping people access, understand and benefit from the human genome to live on.”
The Implications for Consumer DNA Data
Image credits: Nevodka.com | Adobe Stock
In the meantime … what should you do if you’ve already used a 23andMe kit?
With 23andMe filing for bankruptcy, a lot of people are rethinking whether their genetic data is safe. Spoiler alert: it hasn’t necessarily been safe in the past, either—and that’s true whether you used 23andMe or another testing company. The bottom line is that cybersecurity is hard, including for biomedical data, and including in the best of times.
Some privacy experts are encouraging users to consider deleting their accounts—just in case. Why? Because it’s not totally clear who might end up owning all that deeply personal DNA info as 23andMe closes up shop. There’s a real concern that it could be sold off to the highest bidder, whether that’s an AI company, a pharma giant (spoiler: 23andMe has sold anonymized DNA data to pharma companies for years), or someone else entirely. Add in past security breaches and the general messiness of a company in crisis, and you’ve got a lot of folks saying: better to take control now than wish you had later.
How to Take Control of Your Data
If that sounds like you, then the first step is to download all your data from 23andMe, in case you want to use it later for something else. When I did this, it took me almost 2 weeks to get all the files squared away. (I downloaded everything they would give me.) So if you want to take this road, I suggest getting started sooner rather than later.
However ….
The Fine Print: What “Deletion” Really Means
Here's what the 23andMe website says about deleting your account:
"If you participated in 23andMe Research, your Personal Information will no longer be used in any future research projects. If you asked us to store your genetic samples, they will be discarded. We will retain limited information about you, including records of this deletion request, and other information as required by law and otherwise described in our Privacy Statement."
And the Privacy Statement says:
"23andMe and/or our contracted genotyping laboratory will retain your Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations, including the federal Clinical Laboratory Improvement Amendments of 1988 (CLIA), California Business and Professions Code Section 1265 and College of American Pathologists (CAP) accreditation requirements, even if you chose to delete your account.”
The bold font above is my emphasis. Based on this text, it looks to me like deleting the account doesn’t necessarily mean deleting the data.
The Privacy Statement goes on to say:
“23andMe will also retain limited information related to your account and data deletion request, including but not limited to, your email address, account deletion request identifier, communications related to inquiries or complaints and legal agreements for a limited period of time as required by law, contractual obligations, and/or as necessary for the establishment, exercise or defense of legal claims and for audit and compliance purposes."
This last bit doesn’t seem surprising to me, and it doesn’t seem to address information that is as sensitive as DNA data feels to many people.
Is DNA Privacy Even Possible?
Image credits: NCI | Unsplash
Will deleting your 23andMe account make your DNA data “safe”? Maybe, maybe not. Cybersecurity is tough; click on the wrong link in an email, and the DNA data you painstakingly downloaded to protect could get stolen off your hard drive. And since we shed DNA everywhere we go—and DNA sequencing is getting ever cheaper and more accessible—I question whether real “DNA privacy” is even possible these days.
That’s not to say that downloading your 23andMe data and deleting your account is a bad idea! You can see from what I’ve written above that I’ve downloaded my data … although I have hesitated to pull the trigger on deleting the account (mostly because I question whether doing that will really meet my privacy goals). Perhaps by the time this post goes live, I will have deleted my account.
About Tiffany
Dr. Tiffany Vora speaks, writes, and advises on how to harness technology to build the best possible future(s). She is an expert in biotech, health, & innovation.
For a full list of topics and collaboration opportunities, visit Tiffany’s Work Together webpage.
Get bio-inspiration and future-focused insights straight to your inbox by subscribing to her newsletter, Be Voracious. And be sure to follow Tiffany on LinkedIn, Instagram, Youtube, and X for conversations on building a better future.
Buy Tiffany a Cup of Coffee | Image credits: Irene Kredenets via Unsplash.
Donate = Impact
If this article sparked curiosity, inspired reflection, or made you smile, consider buying Tiffany a cup of coffee!
Your support will:
Spread your positive impact around the world
Empower Tiffany to protect time for impact-focused projects
Support her travel for pro bono events with students & nonprofits
Purchase carbon offsets for her travel
Create a legacy of sustainability with like-minded changemakers!
Join Tiffany on her mission by contributing through her Buy Me a Coffee page.