23andMe, the biggest and earliest entrant of the consumer genetics industry, has just filed for Chapter 11 bankruptcy protection in federal court yesterday. This step is intended to help begin a sale process to get the greatest value possible for its business. With more than 12 million DNA kits sold since its establishment in 2006, the company has seen great success. Surprisingly, it is not considered a medtech company. As a result, its customers’ personal information is not protected under the HIPAA Privacy Rule. In a surprising turn of leadership, Anne Wojcicki, the company’s CEO, has stepped down from her position at the head of the company. In light of this unstable situation, 23andMe strongly recommends that customers download their personal data from the Account Settings page. Make sure to do this before you delete your account.
The company’s DNA kits require a saliva sample to isolate DNA from. This DNA is subsequently sequenced to provide personalized health and ancestry insights. The genetic information gathered through these kits could be passed on to a third party during the bankruptcy process. Alternatively, it could be privatized through a sale during the process. Consumers need to do their part to keep their data safe. This means purging their genetic data and disposing of any genetic materials they have on file for the consumer.
The Implications of Bankruptcy
23andMe has made the difficult decision to file for Chapter 11 bankruptcy protection. This proactive step is designed to position its business for sale in a manner that realizes maximum value to its shareholders. This legal action lets the company restructure its debts and assets, but it frees it to continue operating as it goes through the process. The implications of this restructuring on the future management of customers’ genetic data are concerning.
"Any buyer will be required to comply with applicable law with respect to treatment of customer data," stated 23andMe.
Even with these assurances, the possibility of their customer data falling into the hands of a new ownership group has many customers worried. Publicly the company appears to have a strong privacy policy, but buried deep within are clauses changing that on a whim.
"The privacy policy also says that the new company has to follow the existing privacy policy, which sounds great, but the existing privacy policy also says that it can be changed at any time," highlighted Prince.
Protecting Personal Information
There are five simple steps customers can take to safeguard their sensitive personal data and information. Users can delete their accounts at any time directly through their account settings, as well as revoke any permissions granted in the past for research. Moreover, they should be able to withdraw their consent for their data to be used by the company itself or outside researchers on the company’s behalf.
"If you participated in 23andMe Research, your Personal Information will no longer be used in any future research projects. If you asked us to store your genetic samples, they will be discarded. We will retain limited information about you, including records of this deletion request, and other information as required by law and otherwise described in our Privacy Statement," clarified 23andMe.
In addition, the New York Attorney General and California Attorney General have both made statements about how genetic data must be protected. New York’s Attorney General Letitia James has encouraged residents to lead the charge in protecting their personal data.
"23andMe's bankruptcy announcement is concerning and I am urging New Yorkers to take action to safeguard their data. New Yorkers can follow instructions offered by my office to delete their data or destroy any DNA samples held by 23andMe. Anyone experiencing issues deleting their information stored with 23andMe should contact my office," stated Letitia James.
Similarly, Rob Bonta, California's Attorney General, reminded Californians of their rights under the state's robust privacy laws.
"California has robust privacy laws that allow consumers to take control and request that a company delete their genetic data," noted Rob Bonta.
Navigating Future Challenges
As Anne Wojcicki departs from her role as CEO, 23andMe has even more issues to deal with during its ongoing financial restructuring. We want customers to be informed about their fundamental rights and to be proactive in making sure that their personal data is protected. That means a new company now has a chance to buy 23andMe’s assets. This underscores the importance of consumers being informed and actively doing things to protect their genetic information.
