Photo credit: www.cnbc.com
Signage at 23andMe headquarters in Sunnyvale, California, U.S., on January 27, 2021.
David Paul Morris | Bloomberg | Getty Images
The rise of DNA testing has transformed how individuals engage with genealogy, allowing everyday people to discover their ancestry. For many users, the thrill of learning about distant familial connections, such as finding out that they are related to historic figures, outweighs concerns regarding the implications of sharing their genetic data. However, the recent bankruptcy filing by 23andMe, a leader in consumer genetic testing, raises critical questions about the fate of the personal data collected from millions of users.
Following 23andMe’s bankruptcy announcement last week, there has been a surge in calls urging consumers to delete their DNA data from the company’s database. The reaction reflects growing unease regarding data privacy, and although experts may dispute whether immediate action is necessary, concern is palpable among those who submitted DNA samples.
Data from Similarweb shows a noteworthy spike in website traffic for 23andMe: on March 24, the day the bankruptcy was revealed, the site garnered 1.5 million visits, a staggering increase of 526% from the previous day. Of those, approximately 376,000 were specifically aimed at help pages for deleting user data, while another 30,000 visits were made to the customer care section for account closure. Traffic on the following day continued to rise, reaching 1.7 million visits and nearly 480,000 focused on data deletion.
Margaret Hu, a law professor and director of the Digital Democracy Lab at William & Mary Law School, views this situation as a significant threat to data privacy. She emphasizes that the events surrounding 23andMe’s financial difficulties highlight the urgent need for comprehensive federal data protection regulations.
In light of the concern, some state governments are providing guidance to their residents. The California Attorney General’s Office is actively advising Californians to erase their data and destroy any saliva samples stored by 23andMe. However, Hu argues that similar advice should extend to consumers across the entire nation.
The implications of 23andMe’s data potentially falling into malicious hands present a significant concern—not just for individuals but also for national security. The Pentagon has previously warned that DNA kits could pose risks to military personnel.
This is not the first time 23andMe has faced data security issues. In 2023, a major breach compromised the data of almost 7 million users, leading to a settlement that included a $30 million payout and a commitment to three years of increased security measures. Hu notes that the company’s bankruptcy heightens the vulnerability of the data it holds.
Research, Development, and Data Privacy
In the early days of genetic testing, a significant number of users were willing to share their genetic information for scientific research, with up to 80% opting in during 23andMe’s rapid expansion. However, as the market for direct-to-consumer DNA kits began to saturate, 23andMe pivoted towards forming partnerships with pharmaceutical companies, aiming to leverage its genetic data in drug research.
When 23andMe sells genetic data to research firms, it is typically provided in an aggregated format, with identifying personal information stripped out. No direct identifiers, such as names or emails, are shared, and demographic data is kept separate from genetic information. Despite these protocols, Hu expresses worries that under new ownership or financial pressure, the company’s practices regarding user data could shift, leading to greater risks for consumers.
Recently, 23andMe stated its intent to seek a buyer that aligns with its commitment to privacy. However, no official response to inquiries regarding this matter has been provided by the company.
Since its founding in 2006, 23andMe has attracted consumers eager to explore their lineage, including individuals like 70-year-old Elaine Brockhaus from Lansing, Michigan. She and her family initially embraced the excitement of discovering their ancestry through 23andMe’s services. Yet as the company’s financial instability becomes apparent, this initial enthusiasm has shifted to concern, prompting her family to delete their accounts entirely.
Brockhaus reflects on their experience, noting the benefits of the platform and how it enriched their understanding of heritage and health risk factors. Nevertheless, the looming bankruptcy has altered their perspective dramatically, leading to collective action to remove their data from the database.
A Broader Context of Cybersecurity Risks
Brockhaus contends that the challenges faced by 23andMe are emblematic of larger issues in the consumer health market, where data sharing often carries inherent risks. She points out that other health-related services also expose consumers to potential privacy invasions, suggesting that vigilance is necessary without succumbing to fear. “We have to be proactive, but not panicked,” she adds.
Jon Clay, vice president of threat intelligence at Trend Micro, argues that consumers should view 23andMe’s bankruptcy as a serious threat. He cautions that any transfer of data during a potential sale needs to be conducted with the utmost security to prevent exploitation by cybercriminals.
Clay highlights the value of 23andMe’s data, asserting that it can lead to serious ramifications, including identity theft and medical fraud, if misused. He urges companies facing bankruptcy to prioritize the security of their customer data and refrain from sharing it during the transition.
In contrast, some experts believe that the broader lessons drawn from the 23andMe situation extend beyond the company’s collapse. Rob Lee of the SANS Institute emphasizes the importance of consumer awareness regarding the digital footprint generated through various transactions, underscoring the necessity for ongoing discussions about data privacy and security.
Legal experts like Lynn Sessions have noted that federal laws, such as HIPAA, may not protect the personal data provided to companies like 23andMe. Although some state laws offer guidance on genetic information, the lack of uniform protection has created vulnerabilities.
While Meredith Schnur from insurance firm Marsh acknowledges that 23andMe’s bankruptcy does not elevate risk for former users beyond existing concerns, she points out the importance of recognizing that personal data is often already exposed in various contexts.
Linda Avey, co-founder of 23andMe, recently criticized the company’s leadership for losing sight of consumer needs and innovation. She remarked that the downfall of 23andMe contains many cautionary elements. The current bankruptcy issue cannot be sidelined, and as the sale process unfolds, apprehensions persist regarding the fate of sensitive genetic data.
As Hu pointed out, during bankruptcy proceedings, the primary focus may not be on maintaining data privacy but rather on securing the best financial deal possible. She warns that new owners may link genetic and consumer data, creating compounded risks for individuals. The potential for further transactions following the initial sale looms, heightening the risk that sensitive data may be sold indiscriminately, potentially even to foreign adversaries. As such, the situation has implications beyond individual privacy—it raises national security concerns as well.
Source
www.cnbc.com