Privacy Panic as 23andMe Goes Bust, NY and CA AGs Sound Alarm Over DNA Data Dilemma

In the wake of the DNA testing company 23andMe filing for Chapter 11 bankruptcy and its quest for a new buyer, California and New York attorney generals have issued warnings to the company's customers regarding their data privacy. New York Attorney General Letitia James is expected to advise 23andMe clients to jettison their personal data from the site, as reported by CBS News New York. This follows a similar caution by her Californian counterpart, reflecting growing concerns over potential misuse of genetic information.

After a significant data breach in 2023 that compromised millions of user profiles, the company's market value took a hit. 23andMe's CEO Anne Wojcicki has announced her resignation and her intention to bid for the company, as stated in a report by Wirecutter. While 23andMe holds data of over 15 million people who've used its services for insights into their ancestry and health risks, the sale of the company raises questions about the fate of this sensitive information.

Experts are urging customers to take proactive steps. "Delete. Delete. Delete. Stop them from having your information. You should have deleted it as soon as you got whatever curiosity you got out of it, that you found out what you wanted," explained Justin Cappos, a professor at New York University, in an interview with CBS News New York. Detailed instructions for deleting data from 23andMe have been made available, directing customers to log into their accounts and navigate through the settings to delete their data and destroy their genetic sample. Despite reassurances from 23andMe that any buyer will adhere to data privacy laws, advocates remain skeptical. David Siffer from the Surveillance Technology Oversight Project shared his concerns with CBS News New York about the repercussions if a company decides to sell the collected data.

Meanwhile, the Wirecutter has updated its recommendations to users, suggesting they remove their genetic data to safeguard against potential misuse. They've provided step-by-step guidance for information deletion and revocation of research consents on their platform.

Not only is the personal data of users at risk, but potentially that of their relatives as well, due to the inheritable nature of DNA. The Electronic Frontier Foundation underlined the immutable and revealing nature of genetic data which could implicate family members, even if they have never interacted with the company themselves. The EFF's blog post indicates the inherent risks, considering law enforcement's past use of genetic profiles from home DNA test companies to solve crimes, despite the assurance from 23andMe that they require a warrant before releasing any customer data.