(NewsNation) — DNA testing company 23andMe “obtained the consent from our customers” to transfer their genetic data, interim CEO Joseph Selsavage told lawmakers Wednesday.
“When the customer signed up to the service, they have agreed … to consent to our privacy and terms of service, which specifically says that we, in the event of a bankruptcy sale, that we can actually transfer their data,” Selsavage said during a Senate Judiciary Committee hearing.
Judge determined OPM broke law with DOGE access to data
Selsavage’s assertion comes amid a multistate lawsuit about the potential sale of its customers’ genetic data and warnings from security experts.
Concern stems from the potential transfer or sale of 23andMe’s extensive database, which houses the genetic information of more than 10 million customers.
“We are requiring that anyone bidding for 23andMe must agree to comply with our privacy policies,” Selsavage said during his opening statement. “We recognize the vital importance of protecting every individual’s right to access and control their own genetic information.”
23andMe ‘doing everything we can’ for data privacy: CEO
Ranking committee member Sen. Dick Durbin, D-Ill., asked, “Two or three buyers removed, your best intentions don’t mean much, do they?”
“My understanding is that 23andMe is doing everything we can to ensure the next buyer adopts the policies and consents of 23andMe,” Selsavage said.
When asked whether the company would consider upping policy privacy protections for its users, Selsavage said he would “take that suggestion back to our team.”
Hundreds of pharmacies are set to close: How it could impact you
Harvard Law School deputy dean I. Glenn Cohen contended that, even if maintaining the current privacy policy is a condition of the sale, there is nothing in place to prevent the buyer — or 23andMe — from altering it at any point in time.
“The main privacy protection for those customers is just a promise the company has made in its privacy statement,” Cohen said.
Woman alleges Costco cabinet display fell on her in $14M lawsuit
Adam Klein, director of the University of Texas’ Strauss Center, said he’s concerned the average American’s genetic data could prove valuable to foreign actors, including China.
Klein warned that genetic data collected by 23andMe — if sold to or hacked by bad actors — could be used to track and identify people or train advanced artificial intelligence systems.
27 states, DC sue to block 23andMe genetic data sale
Regeneron, a biotechnology company, announced on May 19 that it would “acquire substantially all of the assets” of 23andMe through a $256 million deal.
In the purchase announcement, Regeneron said it plans to process the company’s data “in accordance with the consents, privacy policies and statements, terms of service, and notices currently in effect.”
On Monday, dozens of states and the District of Columbia sued to block the data transfer, citing consumer consent.
Torrid to close up to 180 stores this year, retailer announces
Oregon Attorney General Dan Rayfield called the DNA information “personal, permanent, and deeply private.”
“People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder. We’re standing up in court to make sure Oregonians — and millions of others — keep the right to control their own genetic information,” Rayfield said in a news release.
The purchase came two months after 23andMe filed for Chapter 11 bankruptcy following a data breach in 2023 and the exit of its CEO, Anne Wojcicki.
Can you still delete your 23andMe data?
Following the bankruptcy announcement, California Attorney General Rob Bonta warned users to purge their data and make use of “robust privacy laws.” That advice is still applicable.
Users can delete their data from 23andMe’s website by:
Logging into their account
Clicking on “Settings” under their profile
Finding the “23andMe Data” section
Clicking “View,” then “23andMe Data”
Choosing the “Permanently Delete Data” selection
According to Bonta, 23andMe will then send a follow-up email allowing users to confirm their decision to delete their data
Users can delete their account altogether by:
Scrolling to the “Account Information” section
Selecting “Delete Your Account”
