23andMe Sued for Potential Sharing of Customer DNA
27 US states, along with the District of Columbia (DC), are suing the genetic-testing company 23andMe in an effort to prevent non-consensual sharing of personal information such as DNA. Most plaintiff states are suing through their respective attorneys general.
The plaintiff states (and DC) are listed below in the lawsuit:
The plaintiffs basis for relief states they’re “seeking declaratory judgment… regarding the validity and extent of the Debtors’ interest in each customers’ genetic material and related data – including whether the Debtors have the right to sell and transfer it to any buyer without first obtaining express and informed consent from each customer.”
The suit explains possible consequences for customers if 23andMe is allowed to share personal DNA.
“For example, this data can be used to identify and track those who are related to the 23andMe consumer – including future generations yet unborn,” the lawsuit states. “In other words, the magnitude of the data in this proposed sale stretches far beyond the 23andMe consumers, impacting those who have no awareness of the sale as well as humans who do not even exist yet.”
The lawsuit further argues that customers of 23andMe did not expect to have their information shared due to the company’s privacy policy, which promises the security of their information.
The states urge the company to honor this policy:
“23andMe must honor its representations to consumers by requiring ‘explicit consent’ to th proposed sale based on its ‘Privacy’ webpage, which assures customers that their DNA and health insights, entrusted with 23andMe, will be protected. In its very first bullet point ‘assurance,’ the Privacy page states that ‘You can be assured that your genetic data will not be shared with employers, insurance companies, or public databases without your explicit consent.”
“Based on this,” the lawsuit argues, “customers have a reasonable expectation that their genetic data would not be auctioned off and shared with the highest bidder without explicit consent.”
Notably, the lawsuit states in a footnote that this privacy assurance was removed while the following bankruptcy provision was added, which took place in June 2022. In March, 23andMe filed for bankruptcy and was soon acquired by the pharmaceutical company Regeneron. The provision states:
“If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction and this Privacy Statement will apply to your Personal Information as transferred to the new entity.”
The states petition 23andMe to “obtain express consent for the sale from all customers who signed up for the service prior to June 8, 2022.”
