Amidst the Chapter 11 bankruptcy filing of the genetic testing company 23andMe, concerns are escalating over the fate of customer data. In a decisive move, Georgia's Attorney General Chris Carr has urged residents to delete their accounts and personal data, echoing the sentiments of several other attorneys general across the nation. These legal authorities are sounding the alarm because the highly sensitive data that 23andMe possesses might now be considered an asset, up for grabs in the corporate sell-off, reported Online Athens.
Since its inception in 2006, 23andMe has accumulated the genetic profiles of over 15 million users, offering insights into ancestry and health predispositions through its consumer-friendly saliva kits. However, with bankruptcy in the offing, the personal genomics pioneer is now looking to "sell substantially all of its assets," said a spokesperson. With a potential buyer acquiring this data, it may become vulnerable. According to FOX 5 Atlanta, Emalyn Cork, an Emory Health Sciences Genetics Counselor, reflected on these developments, saying, "Information has always been vulnerable but now... it’s up for sale essentially... that is the valuable part of that company."
Moreover, protection laws may not provide enough cover as this sensitive information changes hands. Dr. Ifeoma Ajunwa, an Emory University Law Professor and a critic of direct-to-consumer genetic testing, warned that, "All that company’s assets are up for sale and could be transferred to the highest bidder," highlighting that 23andMe is not subject to health privacy laws like HIPAA, as per her interview with FOX 5 Atlanta. She advised users to reach out to the company directly to request a "hard" delete of personal data if the option is not provided for an automatic one in the terms of service.
Should users decide to heed the Attorney General's advice, the process for deleting their data from 23andMe is thankfully straightforward. Account holders can start by signing into their account, navigating to "Account Settings," and then selecting the option to permanently delete their data. For those who wish to retain a copy of their personal genetic information before deletion, they may request a download of their raw data and summaries. Once the request for deletion is confirmed via email, the data is irretrievably gone, as spelled by the 23andMe account deletion policy, according to Online Athens.
While the company has issued a statement asserting their ongoing commitment to user privacy and transparency in managing their customers' data, including the assertion that any prospective buyer will adhere to privacy laws, this reassurance falls short for many as the ambiguous future of their genetic profiles weighs heavily on their minds. For additional information and step-by-step guidance on deleting a 23andMe account, users may visit the company’s account closure request page or reach out to customer service directly.
