Jonathan LoTempio, Jr,, The Hastings Center; What 23andMe Owes its Users
"In the intervening years, 23andMe has sent you new findings related to your health status. You wonder: Is my data protected? Can I get it back?
There are protections for users of 23andMe and other direct-to-consumer genetic testing companies. Federal laws, including the Genetic Information Nondiscrimination Act (GINA) and the Affordable Care Act, protect users from employment and insurance discrimination. Residents of certain states including California have agencies where they can register complaints. 23andMe, which is based in California, has a policy in line with California citizens’ new right to access and delete their data. European residents have even more extensive rights over their digital data.
American users can rest assured that there are strong legal mechanisms under the Committee on Foreign Investment in the U.S. that can block foreign acquisition of U.S. firms on national security grounds. For certain critical sectors like biotech, the committee may consider, among other factors, whether a proposed transaction would result in the U.S. losing its place as a global industry leader as part of its review.
Any attempt by a foreign company to acquire 23andMe would be subject to a CFIUS review and could be blocked on national security grounds, particularly if the foreign company is headquartered in a “country of special concern” such as China, Russia, or Iran. As for acquisitions by U.S. companies, the legal landscape is a bit more Wild West. Buyers based in the U.S. could change policies to which users agreed long ago, in a world rather different than ours.
November 2024: With a new board the immediate crisis at 23andMe has been averted. However, long-term concerns remain regarding potential buyers and how they might respond to 23andMe’s layoffs and shuttering of its drug development arm, both of which suggest instability of the company. 23andMe and other DTC genetic testing companies should consider what they owe their users.
One thing they owe users is to implement a policy that, in the case of a sale, the companies will notify users multiple times and in multiple ways and give them the option of deleting their data."
