The genetic testing company 23andMe has recently filed for bankruptcy and announced plans to sell most of its assets. This development raises concerns about the future of customers’ genetic data, particularly in Utah, where specific privacy laws govern the handling of such information.
Utah’s Stronger Genetic Privacy Protections
Utah offers more extensive safeguards for genetic data than federal law, according to Clark Asay, a professor and Associate Dean at BYU Law School. State regulations such as the Utah Consumer Privacy Act (UCPA) and the Genetic Information Privacy Act (GIPA) grant residents the right to control how their genetic data is stored and used.
Under these laws, Utahns can request that companies delete their genetic samples, erase their accounts, and prevent further use of their data. The Utah Department of Consumer Protection (DCP) advises that anyone who previously submitted a DNA sample to 23andMe can request its destruction.
Is Your Data at Risk If 23andMe Is Sold?
With the company’s assets up for sale, questions remain about what will happen to the genetic data it has collected. Utah Attorney General Derek Brown has reassured residents that state laws give them control over their personal information. However, some experts caution that a change in ownership could alter privacy policies.
Sameer Patil, a professor at the University of Utah’s Kahlert School of Computing, warns that customers should be cautious. He points out that while people may have trusted 23andMe’s policies, a new owner could handle the data differently.
“The way this data is stored, shared, or even sold could change entirely depending on the new buyer,” Patil explained. “Until a sale is finalized, there’s no way to assess whether the new company will maintain the same level of protection.”
Steps to Remove Your Genetic Data from 23andMe
If you want to ensure your genetic data isn’t included in the sale, you can take steps to delete it now. The Utah Attorney General’s Office and the DCP have outlined the process:
-
Log into your 23andMe account at www.23andme.com.
-
Navigate to the “Settings” section.
-
Scroll to the “23andMe Data” section.
-
Click “View” next to the data management options.
-
If you wish to keep a copy, download your genetic data before proceeding.
-
Select the “Permanently Delete Data” option.
-
Confirm the deletion by clicking the link sent to your email.
Additionally, you can adjust your settings to prevent the company from storing your saliva sample or using your genetic information for research.
However, Asay warns that 23andMe may have already shared some data with third parties if customers consented to it in their original agreement. Deleting your data now will prevent any future transfer but may not undo past sharing.
Does HIPAA Protect Genetic Data?
Contrary to what some may assume, genetic data is not covered by the Health Insurance Portability and Accountability Act (HIPAA).
“HIPAA only applies to organizations that handle health records for insurance or government benefits,” Asay explained. Since 23andMe is not a healthcare provider, it is not bound by HIPAA regulations.
However, Utah’s state laws still provide certain protections, though enforcement depends on government agencies rather than individual lawsuits. The DCP encourages consumers to review their rights under UCPA and GIPA for more details on their options.
What Should You Do Now?
If you’re a 23andMe customer concerned about your genetic data, consider taking immediate action to delete your account and samples. While 23andMe has stated that its data policies will remain unchanged during the sale process, experts emphasize that the safest approach is to remove personal information before ownership transfers.
For more information about your rights and privacy protections, visit the Utah Department of Consumer Protection’s website.
