The fighter Genetic Testing Company has been declared in bankruptcy, and her co -founder and CEO has resigned. Now, its millions of customers wonder what happens with their genetic data and if it is safe.
CBC News listened to readers this week that they had concerns about the safety of their data, how they can delete their personal information and what the new property could mean. We have tried to answer as many as we can.
CBC News contacted 23Andme. The company responded by pointing its press release and its open letter to customers.
First, what happened?
23Andme, based in San Francisco, announced on Sunday that it will seek to sell “substantially all its assets” through a reorganization plan approved by the Court. The co -founder Anne Wojcicki, who made multiple failed acquisition offers, resigned as CEO. 23Andme did not say if there are other interested bidders.
23Andme was founded in 2006, with the promise of revolutionizing the future of genetics and medical care. The company became known for its saliva -based DNA test kits, bought by millions of customers eager to learn more about their ancestry, and then immersed further in health research and the development of medicines.
But he has faced an uncertain future for some time. Beyond the battles to go privately, the company struggled to find a profitable business model since it was made public in 2021. Then, in 2023, the computer pirates presented the personal data of almost seven million of 23 and the customers for a period of five months, giving a great blow to the reputation of the company and aggravated their growth problems.
In November, the company fired 40 percent of its workforce.
The 23Andme Genetic Testing Company says that the computer pirates obtained access to the profiles of millions of its users in October. Now, some customers are involved in a proposed class demand against the company.
Is the company still in business?
Yes. 23 Andme says he plans to continue operating.
In an open letter to the customers published on Sunday, the company wrote that “orders and subscriptions will continue as normal, and any purchase or genetic test kits sent for processing will be managed without interruptions.”
23Andme added that customers still have full access to their accounts, reports and data stored.
OK. So what about my data now?
Although the company’s privacy policies say that the data could be sold to other companies, 23Andme says that customer data will continue protected.
In its recently updated privacy policies, the company writes that if it is involved in a bankruptcy, fusion, acquisition, reorganization or sale of assets, “you can access, sell or transfer your personal information as part of that transaction and this privacy statement will apply to your personal information as transferred to the new entity.”
However, the company said that the bankruptcy process will not affect how it stores, manages or protects customer data. His open letter to customers declared that “any 23Andme buyer must comply with the applicable law regarding the processing of customer data.”
John Bringardner, the Newsletter Executive Editor debt debt, points out that any new 23Andme buyer will have to comply with the regulatory approvals that ensure that “customer data does not end in unscrupulous hands.”
But Toronto’s lawyer and cybersecurity expert Brent Arnold said his concern is that when a company is in bankruptcy, privacy problems and compliance are sometimes the latest in their minds.
“They are just thinking of overcoming restructuring, which the business survives,” he told CBC. “Then everything else becomes secondary, including the proper protection of their data.”
Are my data safe?
For those who wonder, they are not alone. The officials, including the Attorney General of California, Rob Bonta, had questioned what would happen to the genetic data collected by 23Andme. Last week, Bonta issued a consumer alert by urging customers to eliminate their accounts.
“Given the financial anguish reported from 23 Andme, I remind the Californians to consider invoke their rights and order 23 to eliminate their data and destroy any sample of genetic material held by the company,” he wrote on Friday.
On Tuesday, the New York Attorney General, Letitia James, also encouraged customers to eliminate their accounts and secure their data, calling the Banking announcement of 23 “worrying” Andme.
The Washington Post technology columnist, Geoffrey Fowler, wrote on Monday that “unless you take measures, there is a risk that your genetic information can end in the hands of another person, and used so that you had never considered.”
The current12:24Is your DNA safe with 23Andme?
Millions of people shared their DNA with 23 Andme, but now the company is in financial problems and eliminates 40 percent of its workforce. What does that mean for all the genetic information that the company possesses?
It is unknown who will end up possessing me in the future, and experts point out that the risks remain.
“The personal data collected by 23Andme have always been at risk,” Bringardner wrote in a comment sent by email to Associated Press on Monday. He pointed out the violation of 2023 data that compromised the ancestral information for almost seven million 23 years.
He adds that the dispute that covers from the consequences of this violation helped increase the liabilities that finally contributed to the presentation of current bankruptcy.
Arnold added that 23Andme can be particularly vulnerable to computer pirates at this time. “They are probably not in such a good position to repel an attack as they would be when they ran with full financing.”
How could my data be used potentially?
In November, when 23Andme announced that I was dismissing 40 percent of its employees, the professor at the University of Alberta, Timothy Caulfield, he told CBC’s The current There are “reasons to worry” about your personal data, especially since not only the violations have happened in the past, but that they could happen in the future, with any company.
Caulfield, a Health Research President and Health Policy from Canada, said that it is possible that if he was predisposed to genetic conditions, and someone learned, the information could be used for “disastrous ends.”
Potentially, these nefarious purposes could include discerning their relatives and ancestry, digging up family secrets or revealing clues about the diseases that it has or could be predisposed, said Ginny Fahs, director of Research and Development of Products of the Innovation Laboratory of Consumer Reports, in the Washington Post.
“If the data reaches certain insurers, they can deny coverage or charge you more for life, disability or long -term care insurance due to their genetics,” Fahs said.
There is also a risk that if the data is sold to a new company, they may want to use them in a different way, Fowler wrote in the Washington Post. It points out the company’s privacy policy that says that its data could be sold or transferred as part of a transaction of the company.
What protections are in place?
Earlier this month, researcher Sara Gerke, associate professor at the University of Illinois, told the Podcast of the New England Journal of Medicine that the United States does not have comprehensive laws on data privacy and that “the entire system in itself has many weaknesses and does not properly protect the privacy of consumers.”
However, bankruptcy laws can offer some protections to 23Andme customers, he added, especially since it is a public process in which regulators can intervene or peoples can investigate the sale. Even so, there are also weaknesses in the bankruptcy system, Gerke added.
“And, ultimately, it does not necessarily stop the sale of customer data to the best bidder.”
Arnold said that, although Canadian clients will be under the Canadian Privacy Law, Canada has not had much luck in enforcing their privacy laws abroad.
“The conclusion is this: you don’t have much control over where [your data] goes “.
Can I remove my information?
Yes, with warnings.
Gerke said that worried people can be proactive by eliminating their accounts. However, he points out that this only provides a “partial relief” because if you have already consented that your data is used for research that is already published or included in a data set, which cannot be retracted (on the closing page of your account, 23Andme points out that your information will not be used for any future research).
In addition, 23Andme clearly establishes that even if you cancel your account, “it will retain limited information” about you.
In its privacy statement, the company writes: “23 Andme and/or our hired genotyped laboratory will retain their genetic information, date of birth and sex as necessary for the fulfillment of the applicable legal obligations … even if you choose to eliminate your account.”
The company explains that you can directly eliminate your account in the configuration of your account. You can download your data to your personal device before deleting them.
