What happens to your DNA data now that 23andMe has filed for bankruptcy?

The struggling genetic testing firm 23andMe has filed for bankruptcy,, and its co-founder and CEO has resigned. Now, its tens of millions of consumers are questioning what occurs to their genetic knowledge — and whether or not it is safe.

CBC Information heard from readers this week who had issues in regards to the safety of their knowledge, how they’ll delete their private data, and what new possession might imply for them. We have tried to reply as many as we are able to.

CBC Information reached out to 23andMe. The corporate responded by pointing to its press release and its open letter to customers.

First, what occurred?

San Francisco-based 23andMe introduced on Sunday that it’ll look to promote “considerably all of its belongings” by means of a court-approved reorganization plan. Co-founder Anne Wojcicki, who made a number of failed takeover bids, resigned as CEO. 23andMe didn’t say whether or not there are different bidders.

23andMe was based in 2006, with a promise to revolutionize the way forward for genetics and well being care. The corporate turned recognized for its saliva-based DNA testing kits — bought by tens of millions of consumers desirous to be taught extra about their ancestry — and later dived additional into well being analysis and drug improvement.

However it has confronted an unsure future for a while. Past battles to go personal, the corporate struggled to discover a worthwhile enterprise mannequin since going public in 2021. Then in 2023, hackers exposed the personal data of almost seven million 23andMe clients over a five-month interval, dealing a serious blow to the corporate’s popularity and compounding its progress issues.

In November, the company laid off 40 per cent of its workforce.

WATCH | Proposed class motion over knowledge breach: 

Proposed class-action lawsuit over 23andMe knowledge breach

The genetic testing firm 23andMe says hackers gained entry to the profiles of tens of millions of its customers in October. Now, some clients are concerned in a proposed class-action lawsuit towards the corporate.

Is the corporate nonetheless in enterprise?

Sure. 23andMe says it plans to proceed working. 

In an open letter to customers posted Sunday, the corporate wrote that “orders and subscriptions will proceed as regular, and any purchases or genetic testing kits despatched in for processing will probably be dealt with with out disruption.”

23andMe added that clients nonetheless have full entry to their accounts, reviews and saved knowledge.

OK. So what occurs to my knowledge now?

Although the corporate’s privateness insurance policies say that the info may very well be offered to different corporations, 23andMe says buyer knowledge will stay protected.

In its just lately updated privacy policies, the corporate writes that whether it is concerned in a chapter, merger, acquisition, reorganization or sale of belongings, “your Private Info could also be accessed, offered or transferred as a part of that transaction and this Privateness Assertion will apply to your Private Info as transferred to the brand new entity.”

Nonetheless, the corporate mentioned the chapter course of won’t have an effect on the way it shops, manages or protects buyer knowledge. Its open letter to clients acknowledged that “any purchaser of 23andMe will probably be required to adjust to relevant regulation with respect to the remedy of buyer knowledge.”

John Bringardner, the chief editor of the e-newsletter Debtwire, notes that any new purchaser of 23andMe should adjust to regulatory approvals that guarantee “buyer knowledge will not find yourself in unscrupulous fingers.”

However Toronto lawyer and cybersecurity knowledgeable Brent Arnold mentioned his concern is that when an organization goes bankrupt, privateness points and compliance are typically the very last thing on their minds.

“They’re simply fascinated by getting by means of the restructuring, having the enterprise survive,” he advised CBC. “So every part else turns into secondary, together with correctly defending your knowledge.”

Is my knowledge secure?

For individuals who are questioning, you are not alone. Officers, together with California Legal professional Normal Rob Bonta, had questioned what would occur to the genetic knowledge collected by 23andMe. Final week, Bonta issued a consumer alert urging clients to delete their accounts.

“Given 23andMe’s reported monetary misery, I remind Californians to think about invoking their rights and directing 23andMe to delete their knowledge and destroy any samples of genetic materials held by the corporate,” he wrote Friday.

On Tuesday, New York Attorney General Letitia James additionally inspired clients to delete their accounts and safe their knowledge, calling 23andMe’s chapter announcement “regarding.”

The Washington Post’s tech columnist Geoffrey Fowler wrote Monday that “until you are taking motion, there’s a danger your genetic data might find yourself in another person’s fingers — and utilized in methods you had by no means thought of.”

Who will find yourself proudly owning 23andMe down the highway is unknown, and consultants be aware that dangers stay.

“Private knowledge collected by 23andme has all the time been in danger,” Bringardner wrote in an emailed commentary to the Related Press on Monday. He pointed to the 2023 knowledge breach that compromised ancestral data for almost seven million 23andMe clients.

He provides that litigation spanning from the aftermath of this breach helped drive up liabilities that ultimately contributed to the present chapter submitting.

Arnold added that 23andMe could also be significantly weak to hackers proper now. “They’re most likely not in nearly as good a place to repel an assault as they’d be once they have been operating with full funding.”

How might my knowledge doubtlessly be used?

In November, when 23andMe introduced it was shedding 40 per cent of its staff, College of Alberta professor  Timothy Caulfield told CBC’s The Current that there are “causes to be involved” about your private knowledge, particularly on condition that not solely have breaches occurred previously, however they might occur sooner or later — with any firm.

Caulfield, a Canada analysis chair in well being regulation and coverage, famous it is attainable that if you happen to have been predisposed to genetic circumstances, and somebody came upon, the knowledge might doubtlessly be used for “nefarious functions.”

These nefarious functions doubtlessly might embody discerning your kin and ancestry, unearthing household secrets and techniques, or revealing clues about ailments you have got or may very well be predisposed to, mentioned Ginny Fahs, director of product analysis and improvement for Client Reviews’ Innovation Lab, within the Washington Post.

“If the info makes its method to sure insurers, they might deny you protection or cost you extra for all times, incapacity or long-term care insurance coverage due to your genetics,” Fahs mentioned.

There’s additionally a danger that if the info is offered to a brand new firm, they may need to use it otherwise, Fowler wrote within the Washington Submit. He factors to the corporate’s privacy policy that claims your knowledge may very well be offered or transferred as a part of an organization transaction.

What protections are in place?

Earlier this month, researcher Sara Gerke, an affiliate professor of regulation at the College of Illinois, advised the New England Journal of Medicine‘s podcast that the U.S. does not have complete knowledge privateness legal guidelines and that “the whole system itself has quite a lot of weaknesses and does not defend customers’ privateness correctly.”

Nonetheless, chapter legal guidelines can supply some protections to 23andMe clients, she added, particularly on condition that it is a public course of the place regulators can step in or ombudsmen can examine the sale. Nonetheless, there are weaknesses within the chapter system, too, Gerke added.

“And finally it doesn’t essentially cease the sale of buyer knowledge to the best bidder.”

Arnold famous that, though Canadian clients will fall beneath Canadian privateness regulation, Canada hasn’t had a lot luck in implementing its privateness legal guidelines overseas.

“The underside line is that this — you do not have a lot management over the place [your data] goes.”

Can I delete my data?

Sure, with caveats.

Gerke mentioned that people who find themselves involved might be proactive by deleting their accounts. Nonetheless, she notes this solely supplies “partial reduction” as a result of if you happen to’ve already consented on your knowledge for use for analysis that is already printed or included in a dataset, that may’t be retracted (On its account closure page, 23andMe notes that your data won’t be used for any future analysis).

Plus, 23andMe clearly states that even if you happen to cancel your account, it “will retain restricted data” about you.

In its privacy statement, the corporate writes, “23andMe and/or our contracted genotyping laboratory will retain your Genetic Info, date of beginning, and intercourse as required for compliance with relevant authorized obligations … even if you happen to selected to delete your account.”

The corporate explains you possibly can straight delete your account in your account settings. You may obtain your knowledge to your private machine earlier than deleting it.