A University of Iowa legal scholar who’s an expert on genetic privacy says Iowans who used the genetic testing company 23andMe might consider deleting their data and profiles, pronto, as the company filed for bankruptcy this week.
UI law professor Anya Prince says there may be cause for concern about how all of that genetic data the company harvested about you might be used — or misused.
Prof. Anya Prince (UI photo)
“It’s really important for people to understand that, in the case of a bankruptcy, their genetic data is an asset of 23andMe that can be sold to a new company,” Prince says. “It’s really unclear what that new company will look like, what they would do with the data, and so for people who are worried about that, deleting their information from 23andMe’s databases now can minimize some of the harm.”
The company is insisting that all data collected from some 15-million customers nationwide is safe and secure, but Prince isn’t so sure.
“23andMe has done some things that are helpful for privacy of people’s genetic information, but you have to understand that the privacy policy that everybody agrees to right now says that the data can be sold, and it says that the new company also has to comply with that privacy policy,” Prince says. “All that sounds great, except that the privacy policy also says that it can be changed at any time.”
The company’s at-home test kits are easy to use and the reports sent back to customers based on their D-N-A often provide information about their ancestry and family members. Still, depending on the test, those genetic markers may also reveal predispositions to diseases.
“Life insurance companies can charge higher premiums based on genetic information,” Prince says, “so if that 23andMe data got shared with a life insurance company, you maybe would face higher premiums based on your genetic information.” Also, law enforcement might be able to access your genetic data without a warrant, which could have all sorts of implications.
Should Iowans skip doing any DNA tests? Prince says it comes down to a personal choice.
“I, for example, am an extremely private person, and so I would be less comfortable with that sort of data being shared,” she says. “It’s really important to remember that when this is outside the healthcare setting, it’s not protected by our health privacy law, HIPAA.” That stands for the Health Insurance Portability and Accountability Act.
When 23andMe went public in 2021, its market value rocketed to nearly $6-billion. In the first nine months of this fiscal year, the company reported losses of $174-million.