Once valued at US$6 billion, 23andMe is on the verge of bankruptcy. That could have implications for its trove of sensitive information on customers. Photo / 123RF
Once valued at US$6 billion, 23andMe is on the verge of bankruptcy. That could have implications for its trove of sensitive information on customers. Photo / 123RF
DNA testing company 23andMe is in financial crisis, raising questions about what will happen to the data it holds on 15 million customers.
New Zealanders are concerned their genetic information could be on-sold and used for other purposes, including insurance or law enforcement.
The company says customers can delete their data and destroy their samples –but there are some catches.
New Zealanders who have provided DNA samples to genetic testing service 23andMe are concerned about what the company’s collapse could mean for their personal data.
The popular US-based service is on the verge of bankruptcy, with some reports suggesting it could be sold – creating uncertainty about the future ofits trove of genetic information from 15 million customers worldwide.
Donor Conceived Aotearoa founder Rebecca Hamilton said 23andMe was one of the most popular services for New Zealanders seeking information about their biological parents.
For around $200, customers can send a saliva sample to 23andMe and get a report on their ancestry and some health information. Hamilton used it for find her biological father, who had donated sperm anonymously in the 1970s.
But she and other customers were now in the dark about what 23andMe’s demise meant for their personal information and samples.
“No one knows right now. The company is promising to uphold privacy protections, but there is uncertainty about what they might be willing to do if they are facing bankruptcy.
“The concern is not so much that anyone’s personally identifiable information would be disclosed, but that even anonymised DNA data is valuable for insurance companies, drug companies, law enforcement. And when people gave 23andMe their DNA samples, they weren’t doing it to provide data to these third parties.”
Losing control of your DNA is very different to losing a credit card or driver’s licence, said Auckland-based lawyer Rick Shera, whose specialties include privacy law.
“At least those can be replaced and therefore the damage can be quarantined. When your DNA goes west, then that’s it. And in technology terms, it’s immutable – it can’t be changed.”
Shera said there were fewer privacy protections in the US compared to other jurisdictions like Europe or Australia. While US companies had extensive privacy policies, they could be changed at any time and legal protections were “piecemeal” depending on the US state. If a company went bankrupt and sold the data, the buyer did not necessarily have the same privacy obligations.
“So the risk is that if you’re giving your DNA to a company based in the United States, then the reality is that there’s very little you could do if they wanted to do something else with it.”
Lawyer Rick Shera said US privacy protections were "piecemeal".
Can customers delete their data?
After taking a test, 23andMe retains data on customers’ birthdates and any self-reported information, as well as genetic information, including their genotype and physical samples like saliva. Users must give permission for their information to be shared with third parties for research, such as pharmaceutical companies.
In a statement, a 23andMe spokeswoman told the Herald customers could delete their account at any time, which the company did immediately and automatically after receiving a request. If a person asked 23andMe to store their genetic samples, they would be discarded – a process which could take around 30 days.
However, this process did not completely erase a person’s information. 23andMe said it had to retain some information to comply with legal obligations, including a customer’s age, sex and “a subset of raw, uninterpreted genetic data”. Some reports said this data was held for up to three years.
The spokeswoman said chief executive and co-founder Anne Wojkicki had already committed to taking the company private and was not open to considering third-party takeover proposals.
“Anne also expressed her strong commitment to customer privacy and pledged to maintain our current privacy policy, including following the intended completion of the acquisition she is pursuing.
“Beyond Anne’s pledge to maintain current privacy policy, we note that for any company that handles consumer information, including the type of data we collect, there are applicable data protections set out in law that would be required to be followed as part of any company’s decision to transfer data as part of a sale or restructuring.”
Potential for discrimination
Genomics Aotearoa co-director Professor Peter Dearden said large datasets of genetic information could be valuable when in the right hands. In particular, such data could help health systems to be more predictive and tell people their likelihood of developing a condition or disease.
His organisation wants New Zealand to urgently follow other countries in passing anti-discrimination legislation which protected genetic information from being misused.
Dearden said he was concerned that if a person had their genome sequenced under New Zealand’s current legal settings, it could potentially be used against them in future, such as to deny them insurance or even a mortgage.
“We should use that genetic information to get better outcomes for them, but not to discriminate.”
Otago University geneticist and Genomics Aotearoa co-director Professor Peter Dearden.
While most people assumed 23andMe was an ancestry company, its core business was selling genetic data to third parties for research, such as pharmaceutical companies wanting to test novel drugs, Dearden said.
“So … if they’ve got a new drug, they know this drug doesn’t work very well for people who have this particular variation. Then by accessing big databases like 23andMe, they can say what proportion of the population has that variation, which means that drug wouldn’t work or would have bad side effects.
“So like many of these gig-economy companies, the product they’re actually selling is your information.”
