Bonta, the California attorney general, didn’t specify the risks of leaving your “trove of sensitive consumer data” with 23andMe. But privacy advocates I’ve spoken to have been watching the company’s challenges with concern on several fronts.
First, you are relying on 23andMe to keep your DNA safe from hackers. But that could be hard for any company to do under bankruptcy proceedings — and 23andMe has had plenty of security trouble in the past. (On its website, 23andMe says the company has achieved three certifications to demonstrate the strength of its security program.)
There’s also a risk that your data could get sold or transferred to a new company, which might want to use it for new purposes. The
privacy statement of 23andMe seems to treat your data as a company asset that’s on the table like anything else. It reads: “If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction.”
On the website page to delete your data, 23andMe says: “If the company does change ownership in the future, your data will remain protected under the current 23andMe Privacy Policy unless and until you are presented with materially new terms, with appropriate advanced notice to review those material changes as required by law.”
A new owner could also try to change the company’s practices and privacy policy — and it would be on you to keep on top of the changes.
“The DNA data could be used to discern your relatives and ancestry, unearth family secrets, and reveal clues about diseases you have or could be predisposed to. If the data makes its way to certain insurers, they may deny you coverage or charge you more for life, disability, or long-term care insurance because of your genetics,” said Ginny Fahs, director of product R&D for Consumer Reports’ Innovation Lab.
“This is some of the most precious data that exists about you; you’re right to be concerned that it may be up for grabs,” she said.
But you do have rights over your data before any of that comes to pass. The California Consumer Privacy Act of 2018 gives you the right to delete data from businesses that collect it. While the law specifically applies to California residents, many other states have passed similar laws.
California also has a separate law pertaining to DNA data called the Genetic Information Privacy Act. It gives you the right to delete your account, have your biological sample destroyed, and revoke consent you may have previously given to use or disclose your genetic data.
When you request to delete your data, a confirmation email from 23andMe says it also automatically discards your sample and unenrolls you from research programs.
Before you delete your data, you might want to choose to download some or all of it. If you do, just make sure you have a good way to store and keep it safe. Unlike a password or telephone number, this is data you’re stuck with for the rest of your life.
