The struggling genetic testing company 23andMe has filed for bankruptcy, and its co-founder and CEO has resigned. Now, its millions of customers are wondering what happens to their genetic data — and whether it’s secure.
CBC News heard from readers this week who had concerns about the security of their data, how they can delete their personal information, and what new ownership could mean for them. We’ve tried to answer as many as we can.
CBC News reached out to 23andMe. The company responded by pointing to its news release and its open letter to customers.
First, what happened?
San Francisco-based 23andMe announced on Sunday that it will look to sell “substantially all of its assets” through a court-approved reorganization plan. Co-founder Anne Wojcicki, who made multiple failed takeover bids, resigned as CEO. 23andMe did not say whether there are other interested bidders.
23andMe was founded in 2006, with a promise to revolutionize the future of genetics and health care. The company became known for its saliva-based DNA testing kits — purchased by millions of customers eager to learn more about their ancestry — and later dived further into health research and drug development.
But it has faced an uncertain future for some time. Beyond battles to go private, the company struggled to find a profitable business model since going public in 2021. Then in 2023, hackers exposed the personal data of nearly seven million 23andMe customers over a five-month period, dealing a major blow to the company’s reputation and compounding its growth problems.
In November, the company laid off 40 per cent of its workforce.
The genetic testing company 23andMe says hackers gained access to the profiles of millions of its users in October. Now, some customers are involved in a proposed class-action lawsuit against the company.
Is the company still in business?
Yes. 23andMe says it plans to continue operating.
In an open letter to customers posted Sunday, the company wrote that “orders and subscriptions will continue as normal, and any purchases or genetic testing kits sent in for processing will be handled without disruption.”
23andMe added that customers still have full access to their accounts, reports and stored data.
OK. So what happens to my data now?
Though the company’s privacy policies say that the data could be sold to other firms, 23andMe says customer data will remain protected.
In its recently updated privacy policies, the company writes that if it is involved in a bankruptcy, merger, acquisition, reorganization or sale of assets, “your Personal Information may be accessed, sold or transferred as part of that transaction and this Privacy Statement will apply to your Personal Information as transferred to the new entity.”
However, the company said the bankruptcy process will not affect how it stores, manages or protects customer data. Its open letter to customers stated that “any buyer of 23andMe will be required to comply with applicable law with respect to the treatment of customer data.”
John Bringardner, the executive editor of the newsletter Debtwire, notes that any new buyer of 23andMe will have to comply with regulatory approvals that ensure “customer data won’t end up in unscrupulous hands.”
But Toronto lawyer and cybersecurity expert Brent Arnold said his concern is that when a company is going bankrupt, privacy issues and compliance are sometimes the last thing on their minds.
“They’re just thinking about getting through the restructuring, having the business survive,” he told CBC. “So everything else becomes secondary, including properly protecting your data.”
Is my data safe?
For those who are wondering, you’re not alone. Officials, including California Attorney General Rob Bonta, had questioned what would happen to the genetic data collected by 23andMe. Last week, Bonta issued a consumer alert urging customers to delete their accounts.
“Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company,” he wrote Friday.
On Tuesday, New York Attorney General Letitia James also encouraged customers to delete their accounts and secure their data, calling 23andMe’s bankruptcy announcement “concerning.”
The Washington Post’s tech columnist Geoffrey Fowler wrote Monday that “unless you take action, there is a risk your genetic information could end up in someone else’s hands — and used in ways you had never considered.”
The Current12:24Is your DNA safe with 23andMe?
Millions of people shared their DNA with 23andMe, but now the company is in financial trouble and shedding 40 per cent of its workforce. What does that mean for all the genetic information the company holds?
Who will end up owning 23andMe down the road is unknown, and experts note that risks remain.
“Personal data collected by 23andme has always been at risk,” Bringardner wrote in an emailed commentary to the Associated Press on Monday. He pointed to the 2023 data breach that compromised ancestral information for nearly seven million 23andMe customers.
He adds that litigation spanning from the aftermath of this breach helped drive up liabilities that eventually contributed to the current bankruptcy filing.
Arnold added that 23andMe may be particularly vulnerable to hackers right now. “They’re probably not in as good a position to repel an attack as they would be when they were running with full funding.”
How could my data potentially be used?
In November, when 23andMe announced it was laying off 40 per cent of its employees, University of Alberta professor Timothy Caulfield told CBC’s The Current that there are “reasons to be concerned” about your personal data, especially given that not only have breaches happened in the past, but they could happen in the future — with any company.
Caulfield, a Canada research chair in health law and policy, noted it’s possible that if you were predisposed to genetic conditions, and someone found out, the information could potentially be used for “nefarious purposes.”
These nefarious purposes potentially could include discerning your relatives and ancestry, unearthing family secrets, or revealing clues about diseases you have or could be predisposed to, said Ginny Fahs, director of product research and development for Consumer Reports’ Innovation Lab, in the Washington Post.
“If the data makes its way to certain insurers, they may deny you coverage or charge you more for life, disability or long-term care insurance because of your genetics,” Fahs said.
There’s also a risk that if the data is sold to a new company, they might want to use it in a different way, Fowler wrote in the Washington Post. He points to the company’s privacy policy that says your data could be sold or transferred as part of a company transaction.
What protections are in place?
Earlier this month, researcher Sara Gerke, an associate professor of law at the University of Illinois, told the New England Journal of Medicine’s podcast that the U.S. doesn’t have comprehensive data privacy laws and that “the entire system itself has a lot of weaknesses and doesn’t protect consumers’ privacy properly.”
However, bankruptcy laws can offer some protections to 23andMe customers, she added, especially given that it’s a public process where regulators can step in or ombudsmen can investigate the sale. Still, there are weaknesses in the bankruptcy system, too, Gerke added.
“And ultimately it does not necessarily stop the sale of customer data to the highest bidder.”
Arnold noted that, although Canadian customers will fall under Canadian privacy law, Canada hasn’t had much luck in enforcing its privacy laws abroad.
“The bottom line is this — you don’t have much control over where [your data] is going.”
Can I delete my information?
Yes, with caveats.
Gerke said that people who are concerned can be proactive by deleting their accounts. However, she notes this only provides “partial relief” because if you’ve already consented for your data to be used for research that’s already published or included in a dataset, that can’t be retracted (On its account closure page, 23andMe notes that your information will not be used for any future research).
Plus, 23andMe clearly states that even if you cancel your account, it “will retain limited information” about you.
In its privacy statement, the company writes, “23andMe and/or our contracted genotyping laboratory will retain your Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations … even if you chose to delete your account.”
The company explains you can directly delete your account in your account settings. You can download your data to your personal device before deleting it.
