23andMe is bankrupt. Should you worry about your DNA data?

After a spate of woes that include a major data breach and hefty cut to its workforce, genetics testing company 23andMe filed for Chapter 11 bankruptcy this past Friday. Its search for a buyer instantly raised a question, given the sensitive nature of the data it holds—what’s to become of user data if the company is sold?

Privacy experts are wary of what comes next, as outlined by news reports from NPR and ABC. You can break down the concerns like this:

• Your data will likely be part of what is sold to a new buyer
• When transferred, a new privacy policy could take effect
• Those changes could lower the amount of privacy you’re entitled to—for example, it could be sold to third-party companies

The third point in particular is raising alarm across the internet, because unlike genetic testing done through health care providers, 23andMe’s data is not protected under the U.S.’s Health Insurance Portability and Accountability Act (HIPAA). HIPAA establishes strict guidelines about who can access a U.S. resident’s medical information, as well as how its stored. It also enshrines your right to see your own medical records. Since 23andMe is not part of the health care industry, these rules don’t apply to its handling of genetics data. A new owner of 23andMe theoretically could more freely sell or share your data with third-parties.

Hush Naidoo Jade Photography / Unsplash

On the flip side, U.S. residents are protected by the Genetic Information Nondiscrimination Act (GINA), which prevents health insurance companies and employers from discrimination on the basis of genetic information. So while worries exist about your genetics data becoming more widely accessible, certain organizations would be legally barred from making claim or employment decisions based on such information.

Should this legal protection feels sufficient to you, you could wait to see what happens. Any new terms would need to be approved by you before they take effect, whether that were to happen now or after a buyer is found. 

However, we do now live in an era of uncertainty around data security. AI, for example, is only taking off now. We don’t fully know yet how such tools will get applied to large datasets, and nor the outcomes. For example, could you get targeted for scams specific to a genetic marker you have, if the data were to leak? Could life insurance companies deny policies based on AI-powered actuarial analysis, fueled by such data?

If those are the kinds of questions you have, you can delete your data—and still hang onto a copy of your results for your personal records. Just be sure to download them before requesting a wipe of yourself from 23andMe’s servers. 

^{To see a larger version of each image, right-click and choose to view in a new tab (PC), or long-press and open in a new tab (mobile).}

Here’s what to do:

1. Log into your account
2. Open your settings
3. Find the 23andMe Data section
4. Click View
5. To download: In the upper sections of this settings screen, choose to download various forms of genetics data
6. To delete: Scroll down to the Delete data section
7. Choose Permanently delete data

An email will be sent to you to confirm the deletion. Click the link in the email to verify the request.

In addition to deleting your data, you may want to check two other settings:

1. If you chose to have 23andMe keep your saliva sample and DNA, you can revoke your permission and request dispose of this material in your settings—look under Preferences.
2. If you allowed your genetic data to be used for research by 23andMe and third-parties, you can revoke your consent. Look for Research and Product Consents in your account settings.

While the news about 23andMe’s potential sale is lighting up the internet, keep in mind that you have some time to figure this out—no deals have yet been announced. Cofounder and newly resigned CEO, Anne Wojcicki, intends to continue her attempts to buy the company, as well. And as mentioned above, you would need to agree to new data privacy terms before becoming subject to them.

But you should decide how you feel, and how you’d like to proceed. Genetics data is a sensitive piece in the bigger jigsaw picture of your online privacy. And these days, privacy and security have become tightly intertwined.