If you’ve ever sent a spit sample to 23andMe, your genetic information could soon be sold.
The California-based company, which allowed customers to learn about their ancestry by submitting saliva samples in the mail, filed for bankruptcy in March. As part of that process, it’s auctioning off the DNA profiles of more than 15 million people — including an estimated 700,000 Canadians.
A new lawsuit filed Monday in the U.S. seeks to halt that sale. But if it fails, privacy advocates say Canadians have every reason to be worried that their most personal, unique and unchangeable identifying information could be sold without their consent.
“It’s literally assets to the company,” said Aileen Editha, a PhD candidate at Queens University who studies the property rights of human genetic materials. “If my data was in there … I personally would be concerned.”
23andMe has repeatedly said that any company that buys its data will be have to adhere to the law, as well as any privacy agreements customers agreed to when they signed up. Late on Friday, it said it plans to sell its assets to the company’s former CEO.
William Tong, the attorney general of Connecticut, doesn’t find that reassuring.
He, along with representatives from 26 other U.S. states and the District of Columbia, are plaintiffs in a lawsuit filed Monday in bankruptcy court seeking to block the sale of personal genetic data by 23andMe without customer consent.
“We’re fighting tooth-and-nail to protect consumers,” Tong told As It Happens host Nil Kӧksal.
“Entrepreneurs, particularly in the tech industry and the health-care industry and the biotech industry, need to understand that they have to take care of the personal information that they get from consumers.”
In an emailed statement to CBC, 23andMe said the lawsuit is “without merit.”
“The sale is permitted under 23andMe privacy policies and applicable law. We required any bidder to adopt our policies and comply with applicable law as a condition to participating in our sales process,” 23andMe said.
On Friday evening, 23andMe announced the winning bidder for its assets is TTAM Research Institute, a California company led by 23andMe’s co-founder, Anne Wojcicki.
Wojcicki stepped down as CEO when the company filed for bankruptcy.
23andMe had previously selected biotech firm Regeneron Pharmaceutical as the lead offer, but later re-opened the bidding process, allowing Wojcicki to seal the deal with a $305 million US bid.
The sale still must be approved in the courts before it’s official.
Tong noted that Wojcicki presided over the company in 2023, when a massive privacy breach at the company saw hackers access the private consumer information of nearly seven million customers.
“You’ve got a bidder who represents the original founder who messed things up in the first place, and did not do enough to protect the people whose information was given to 23andMe,” Tong said.
23andMe customers urged to delete personal data
That data breach prompted law firm KND Complex Litigation to launch a class-action lawsuit against 23andMe on behalf of affected Canadians.
But the lawsuit came to halt when 23andMe filed for Chapter 11 bankruptcy, says KND attorney Sage Nematollahi.
As it stands, Nematollahi says, any Canadian wishing to pursue a claim against the company must file it as an individual through Missouri’s bankruptcy court.
Nematollahi says his law firm is fighting in the B.C. courts to continue acting as the representative of all Canadian 23andMe customers in U.S. courts.
“It is really impractical for every Canadian customer to go on some website for the U.S. insolvency proceeding, which is replete with legalese and that sort of stuff, and try to pursue their own individual claims,” he said.
So what recourse do Canadian customers have, aside from navigating U.S. bankruptcy courts and waiting for American lawsuits to play out?
Editha of Queens University says Canada has several laws that protect genetic data, but she’s not sure they are robust enough to meet the needs of a complex case like this one.
“The tricky part is when it concerns a multinational company, because so many laws and so many different actors and interests come into play,” she said.
“The only way really to get around it is for people to withdraw their data and request 23andMe delete their information from the database.”
It’s advice that Tong, as well as several other privacy experts, have echoed to CBC.
Some customers have already consented to have their information used for research purposes when they signed up for 23andMe, Editha said. That means their information may have already been sold to third parties, like pharmaceutical companies.
“There’s sort of no turning back at that point,” she said. “But what my request can do is actually stop them from including my information in this sale going forward.”
Editha says companies often rely on the fact that many people lack the time, capacity or legal literacy to fully understand what rights they’re signing away when they sign up for a service.
“They really advertise like the, ‘Oh, look at all this fun stuff that we can provide you with your DNA if you send it to us.’ But then … the fine print of it isn’t really being disclosed in an appropriately visible manner,” she said.
“That’s what really needs to happen, is making sure that people have the power to make decisions and to make decisions based on informed consent.”
With files from Reuters and The Associated Press. Interview with William Tong produced by Cassie Argao
