Written by 
Key Takeaways
- 23andMe is facing a financial crisis and may be sold or privatized, potentially putting the genetic information of over 15 million people at risk.
- The company can sell your data if an acquisition occurs, as mentioned in their privacy policy, and the data isn’t protected by HIPAA.
- There is still time to download and delete your data through the web browser or the app.
23andMe, the DNA genetic testing and ancestry company, is facing a financial crisis. There’s chatter about a potential sale, and CEO Anne Wojcicki seems undecided on the next move. What happens to your genetic information if the company gets sold?
What We Know So Far
The company has a deadline to meet:if 23andMe does not raise its share price above $1 by November 4, the company will be delisted, which makes it likely that the company will be sold or taken private. This crisis comes after concerns over the company’s financial stability, recent privacy breaches, and changes in leadership.
Data Sent to 23andMe Isn’t Protected by HIPAA
Unfortunately, unlike your doctor’s office, 23andMe’s data isn’t protected by the Health Insurance Portability and Accountability Act (HIPAA), which is a U.S. federal law that sets data privacy and security for safeguarding sensitive medical information. This means that healthcare providers must follow strict rules to protect medical data, but companies like 23andMe aren’t legally required to do so. Though genetic companies are still required to follow other privacy laws like the Federal Trade Commission Act (FTC), they aren’t under strict scrutiny like doctors and hospitals are.
23andMe Can Sell Your Data
What is concerning is that 23andMe’s privacy policy states that it’s allowed to sell customer data in the event of a merger or acquisition. So if it ends up selling, guess what? Your data is gone, along with everything else.
Currently, 23andMe gives you the option to opt out of research and advertising purposes. The company also states that it does not intentionally share personal information with public databases, insurance companies, employers, or law enforcement unless there’s a search warrant, valid court order, or subpoena involved. However, if the company sells, there’s no guarantee that the new owners will stick to the same policies.
Who’d Buy Your DNA Data?
DNA data is unique to you—not only can it identify you, but it can also be used to identify your relatives, predict the likelihood of certain diseases, and find out ancestral history going back generations. So, while data and genetic research has an enormous number of benefits, it also raises ethical concerns about misuse.
So, who’d want to buy all that information? Insurance companies, pharmacuetical firms, and biomedical research firms are the most obvious candidates, though they’re hardly alone. For example, insurers might want genetic data to view the likelihood of individuals developing certain diseases, which could influence life or health insurance premiums. Multiple countries, including the US, have banned discrimination on the basis of genetic data in employment and health insurance. However, it does not extend to other forms of insurance, and remember, just because something is banned, doesn’t mean it never happens.
Can You Delete Your Data?
If this all makes you uneasy, you’re certainly not alone. The good news is that you can delete your data.
To delete your data from 23andMe, sign in to your account on a browser or the app, and go to “Settings” via the cog icon:
Scroll down to the “Delete Your Data” option. If you want to download your data before you delete it, select “Access Your Data”:
Confirm your date of birth, and click “Confirm”:
If you want a copy of your genetic data for your records, be sure to download it from the settings before hitting delete.
Once you confirm the deletion, 23andMe will start the process. The company will even destroy your physical DNA sample if you originally opted to have it saved. Just be aware that once your data is gone, your account will be too, and permanently.
There is big money in genetic data, and consumers should be aware. Whether it’s a worthwhile risk to give your genetic data to any company or not is still up for debate. I know I won’t be.