It's a question raised by many critics of DNA service 23andMe have raised for years: who has access to my genetic data once it's been collected?

Now, the question is being asked with increased urgency as the company teeters on the verge of collapse. As NPR explains, the company has lost about 99% of its value in the years since its 2021 IPO. But if 23andMe files for bankruptcy, what happens to the genetic data of the 15 million-plus customers who have used the service since 2006?

“HIPAA does not protect data that’s held by direct-to-consumer companies like 23andMe,” Anya Prince, a law professor who specializes in genetic privacy at University of Iowa's College of Law, told NPR. Prince does note that states like New York and California offer some protections to genetic data. She adds that, in those states, “if customers are really worried, they could ask for their samples to be withdrawn from these databases under those laws."

Speaking to the New York Times, Yale Biomedical Informatics professor Mark Gerstein said the threat is that a "threat actor" could gain access to personal genetic data and reveal "someone’s medical characteristics and potential for health risks…like psychosis or heart disease."

But Andy Kill, a spokesperson for 23andMe assured the public that the company follows "laws that regulate the data we collect and believes strongly that customers should have the choice and ability to decide how their data is used…Nothing about that commitment has changed.”

Still, many question the weight of Kill's statement.

Following a data breach at the company in February, Suzanne Bernstein, a law fellow at the Electronic Privacy Information Center told The Guardian that "there are no serious safeguards, no regulation around the collection and sale of really sensitive personal data…For 23andMe, the nefarious [data] breach constitutes a security issue, but so does the company sharing your information with a party that you didn’t know about. Customers may technically consent to their data being shared by accepting the terms and conditions, but those are really long and a lot of people don’t read them.”

Arizona v. Mitcham

A case before the Arizona Supreme Court asks whether the government can test biological material it already has in its possession (such as donated blood) without first obtaining a warrant. In an amicus brief for the case, the ACLU has argued that "given the revealing nature of DNA, collecting and analyzing it constitutes a seizure and a search under the Fourth Amendment." Moreover, "a person’s limited consent to a search of biological material for a specific purpose—in this case, a blood alcohol test for a DUI arrest—does not overcome that requirement."

Verdict

The potential dissolution of 23andMe may be the first time the general public has considered the implications of genetic data privacy. For proponents of stricter regulations, this may be the perfect opportunity to build in new safeguards.

‍