Bad news: 23andMe has gone bankrupt and is up for sale. Who knows where all that data they store is going to end up? I sent in my saliva sample years ago, they’ve got my genetic sequence on file, and I hadn’t worried about it until now, but now I am concerned. So is Rebecca Watson.
Another issue that came to light in the past few years is how can a for-profit corporation remain solvent when they make all their money on a product that, by definition, a customer can only buy once? And that’s why today, the biggest problem everyone has is that 23andMe has, in fact, declared bankruptcy. And that means that if you’re one of their customers, your genetic data might end up in the hands of someone you don’t trust.
23andMe has stated that they’ll be protecting that data throughout the bankruptcy proceedings, but people are understandably skeptical of that considering that they already gave hackers access to the data for 7 million users a few years ago, giving up user passwords and allowing the hackers to see users’ family trees.
That’s why California Attorney General Rob Bonta issued a consumer alert reminding people that the Genetic Information Privacy Act and the California Consumer Privacy Act give customers the right to demand that23andMe delete all their data and even destroy any samples they might still have on file. Obviously that’s for Californians, but it’s part of the reason why customers anywhere can in fact log in and do that, and Bonta gives step by step instructions for anyone who wants to.
Here’s the steps you can take to clear your data:
To Delete Genetic Data from 23andMe:
Consumers can delete their account and personal information by taking the following steps:
Log into your 23andMe account on their website.
Go to the “Settings” section of your profile.
Scroll to a section labeled “23andMe Data” at the bottom of the page.
Click “View” next to “23andMe Data”
Download your data: If you want a copy of your genetic data for personal storage, choose the option to download it to your device before proceeding.
Scroll to the “Delete Data” section.
Click “Permanently Delete Data.”
Confirm your request: You’ll receive an email from 23andMe; follow the link in the email to confirm your deletion request.
I’ve started the process for my data. However, there is an option to first request that they email your genetic data, and yes, I clicked on that…and it’s been 3 days, and I still haven’t received it. I think I’m going to have to cancel and just go ahead and delete everything without saving a copy. This is a comment that ought to chill you right down to the nucleus of all your cells: Charles Murray wants someone to buy the company for him, or his racist friends:
Charles Murray: Okay, my billionaire friends. $23m is pocket change! And it would make me so happy.
Nope, nope, nope. I’m going to have to kill my data fast.
Hey, I don’t have any billionaire friends. What have I done right in my life?
This displays a level of naivety that would be charming if it weren’t so dangerous.
The services offered to individuals were never the real product. The real product was always the gigantic trove of genetic data they collected. All that stuff about tracing your ancestry or screening for genetic risk factors was just marketing, to persuade people to not only hand over their genetic data to a for-profit corporation, but to actually pay for the privilege.
That was the point of Rebecca’s rhetorical question. A company can’t plan unending growth by selling one thing to each person, so that’s not what their business plan was: it was accumulating data that could be sold.
Dunc@ 1
And, presumably the big corporations would be delighted if the vast patient data archives of our NHS were made available for their profit. I know that there has been talk of making it anonymous and using it for non-profit research but if making it available for US commercial advantage were a price for concessions from Trump who would then boast of his patriotic acumen…
Also, tell them to destroy your samples. It took my wife a week to get her data, I’m still waiting for mine. They have a lot more than our genetic data. We were loyal customers, answering bazillion questionnaires for science.
It is a sad fact that the data held by 23&me (and most other corporations) has probably already been sold/given to others, so trying to delete it and/or get it is a fools errand. It’s like giving someone a report printed on paper and when you ask for it to be returned, they give you a poor photocopy of what you gave them.
Our organization is prudent not paranoid in NOT sharing such private info with others. Trust is earned.
Welcome to the new Dark Ages.
Ah, that perhaps didn’t come across especially clearly (to me, at least) in the quoted excerpt, I expect it was probably more obviously rhetorical if you actually watch the video.
shermanj @ #5 — I would assume they have sold or shared the data with other organizations, but I would also assume they scrub any PII from the data. If they sell the info with PII, that might be particularly problematic. The EU would really bang on them for that.
I’ve never done a 23&Me test, so not a problem for me although I suppose I’ve had DNA screening done by medical providers.
And I wouldn’t even be sure your data is actually deleted.
I don’t have any insight into the inner workings of 23andMe of course, but I’ve worked for companies where data they weren’t allowed to possess was marked to not be shown using the normal interface, but was still there on the database, easily accessible by me and the other developers and admins because deleting vast amounts of data from a relational database with indexes and foreign keys can be complicated and time consuming and the boss simply didn’t care. And I’ve heard the same story from people working for other companies.
I really would like to do 23 and Me or similar but this is exactly why I haven’t. I just don’t trust them with my data.
My health insurance company asked if I’d like to get a genetic screening for markers that might be of concern for me. And the answer is “yes I would”. Of course I would- it would be useful information to alter my diet and possible habits to find out if I’m in danger of some cancers over others or heart disease et cetera. But I don’t want THEM to have it. And there’s the rub- if I get it my insurance will have it and no matter how much they pinky swear that it’ll never adjust my coverage or deductibles I think they’re lying.
I just submitted my request to delete my data, but like mordred said, who knows whether they’ll do it.
@10 antigone10 – And there’s the rub- if I get it my insurance will have it and no matter how much they pinky swear that it’ll never adjust my coverage or deductibles I think they’re lying.
Once they found you were prone to a specific (genetic) condition, they could easily raise your premiums
A few mentioned they already sold this data, wouldn’t be surprised if insurance companies were, or will be first in line. They could use the data to adjust premiums either individual or across the board based on how many of the insured they carry and what they are predisposed to. There must be an algorithm for that.
@7 robro wrote: ‘I would also assume they scrub any PII from the data’
I reply: I made no assumptions, that would be foolish. I reported info from reliable tech sources. Why would you risk personal info with sketchy corporations and only hope they are honest and ethical?
@11 stuffin is correct. If your insurance gets the info, they will use it as a weapon against you.
A guy I know is a careful driver. He tows a trailer with his late model truck, so he must apply the brakes harder than without the weight of the trailer. His truck sent all his driving info to his insurance and they warned him that his ‘abnormally hard breaking’ would cause an increase in his premiums WTF!
Crapitallism at its best!
re shermanj @12: That is the reason to NOT use those devices that the insurance companies gladly provide that saves all of your driving info.
That guy made his “don’t bother, who cares?” argument in an article in Reason magazine. That fact alone is an admission that his argument is crap and unworthy of any reputable publication.
I’m all for deleting one’s data from 23&Me, but I wouldn’t trust them not to keep at least one copy of all their/our information anyway. What other assets do they have? This would be a bit like expecting a car manufacturer to tear down their factories before buyers can bid to buy them out.
submoron @#3
I think the NHS has already done that, I seem to recall there was a hoohaa a while back about it.