Following 23andMe’s bankruptcy filing in March, and its subsequent acquisition by Regeneron in May, concerns have arisen regarding the security of its 15 million customers’ genetic data. Recent developments include a lawsuit from over two dozen states and guidance regarding data deletion from 23andMe accounts.
Pharmaceutical company Regeneron is purchasing 23andMe for $256 million, following a bankruptcy auction. Regeneron intends to use 23andMe data to aid in discovering new drugs, while stating that it will endeavor to maintain 23andMe’s privacy practices.
During a House Oversight Committee hearing this week, 23andMe’s interim chief executive, Joseph Selsavage, disclosed that approximately 1.9 million customers, about 15% of the company’s user base, have requested deletion of their genetic data.
23andMe board of directors resign, leaving CEO ‘surprised and disappointed’
Separately, more than two dozen states have initiated legal action against 23andMe, asserting it must secure explicit consent from customers before any sale of their private data.
Individuals with 23andMe accounts can take the following steps to initiate data deletion:
- Navigate to the Settings section of your profile.
- Scroll down to the selection labeled 23andMe Data.
- Click the View option and scroll to the Delete Data section.
- Select the Permanently Delete Data button.
Upon completing these steps, users will receive an email from 23andMe containing a link to confirm the deletion request. A copy of user data may be downloaded before deletion.
23andMe’s privacy policy stipulates that the company and its labs “will retain your Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations.”
The privacy policy also states, “23andMe will also retain limited information related to your account and data deletion request, including but not limited to, your email address, account deletion request identifier, communications related to inquiries or complaints and legal agreements for a limited period of time as required by law, contractual obligations, and/or as necessary for the establishment, exercise or defense of legal claims and for audit and compliance purposes.” This means that 23andMe may retain some user information indefinitely.
Users can also revoke permission for their data to be used for research. This can be done by navigating to the Preferences section within the 23andMe account settings page.
23andMe data breach settlement claim: How to get compensation
Additionally, consent for 23andMe and third-party researchers to use genetic data and samples for research, can be withdrawn from the Research and Product Consents section in account settings. Although this consent can be reversed, previously shared information cannot be deleted.
Customers are advised to encourage family members to also consider deleting their data, given the potential impact on relatives. Similarly, friends should be encouraged to take precautions to protect their data as well.
