B.C.’s privacy watchdog is sounding the alarm: British Columbians’ genetic data could be for sale. Read More
Advertisement 1
‘This is a very alarming situation’: There’s no guarantee that Canadian regulations can permanently safeguard customer data after the American company’s bankruptcy sale
Reviews and recommendations are unbiased and products are independently selected. Postmedia may earn an affiliate commission from purchases made through links on this page.
Article content
B.C.’s privacy watchdog is sounding the alarm: British Columbians’ genetic data could be for sale.
Article content
Article content
Following the bankruptcy filing last week by the U.S. genetic testing giant 23andMe, approximately 15 million customers — including many in B.C. — face the unsettling possibility that their most personal information could end up in the hands of the highest bidder.
Article content
Story continues below
Article content
The Silicon Valley-based company has filed for bankruptcy protection, seeking to sell “substantially all of its assets” through a court-approved reorganization.
Article content
Sunrise
Article content
Founded in 2006, the company pioneered DNA testing using saliva samples from customers to provide them insights into their ancestry and genetic risks for diseases.
Article content
In an open letter to its customers, 23andMe said that any buyer “will be required to agree to comply with our privacy policy and with all applicable law with respect to the treatment of customer data.”
Article content
The company’s privacy policy says it will not provide customers’ personal information to insurance companies, employers, public databases or law enforcement, without a valid court order, subpoena, or search warrant.
Article content
Despite these reassurances, B.C.’s information and privacy commissioner raised concerns.
Article content
Story continues below
Article content
“Genetic information is some of the most sensitive data we can share,” Michael Harvey, the commissioner, said in a statement. “When we talk about protecting it, it’s not only our own privacy that is at stake, but also those of our biological relatives with whom we share our genetic makeup.”
Article content
Stories You May Like
-
Remains of missing B.C. teen finally identified after 18 years
-
Miscarriage of justice? Bullets from 1994 B.C. murder case can be retested for DNA, says court
-
Advertisement embed-more-topic
Story continues below
Article content
Harvey said B.C. users can review their privacy settings, opt out of having their data and biological samples shared for research purposes, or permanently delete their data through 23andMe’s platform.
Article content
On Friday, the commissioner said that enforcement is challenging if 23andMe’s biological samples are sold as assets to another company — or several companies. He said it’s because it would be difficult to track “where they have gone and who is doing what with them.”
Article content
Some B.C. residents have already deleted their information from the 23andMe platform.
Advertisement 1
Advertisement 2
Advertisement
Article content
Vancouver’s Peter Toth said permanently removing his genetic data was a no-brainer after seeing the company facing financial trouble.
Article content
“My big concern was that when the company got sold, there was no guarantee it would go to a Canadian buyer,” Toth said. “That this new company might use my data not for scientific purposes, but solely for financial benefit.”
Article content
Canadian and U.K. officials are still investigating a 23andMe data breach from 2023, which exposed the genetic data of nearly seven million customers. The company agreed to pay $30 million to settle a class-action lawsuit over its failure to protect customer information.
Article content
Victoria Lemieux, professor of archival science at the University of B.C., agrees that B.C. users should delete their data from the platform, but she fears it may not be enough.
Article content
“This is a very alarming situation,” said Lemieux.
Article content
Story continues below
Article content
While 23andMe says that data from customers who opt into research is anonymized, Lemieux points out there’s no guarantee that Canadian regulations can permanently safeguard customer data after the bankruptcy sale.
Article content
“The new owner could use the data for purposes the user did not originally consent to, by finding loopholes,” Lemieux explained.
Article content
She referred to the July 2018 sale of a $300-million stake in 23andMe to British pharmaceutical giant GlaxoSmithKline Plc., which granted it access to 23andMe’s customer data for drug target discovery and other research. At the time, GSK said 80 per cent of customers had consented to have their data used for research, emphasizing the vast genetic data pool the company gained in the partnership.
Article content
“They structured the deal to bypass consent, allowing the company to use 23andMe data for their drug research,” Lemieux said.
Article content
Story continues below
Article content
Lemieux is concerned for her parents, who purchased genetic testing services for their birthdays, thinking it would be a fun way to learn about their ancestry. Now, she worries about the risks of having our family’s genetic data in the hands of a for-profit company.
Article content
“They’re 85 now, and they don’t understand the risks,” Lemieux said.
Article content
“If a sale involves personal data, the owners should not be able to just take our data and run,” she added.
Article content
The Privacy Commissioner of Canada’s office has said it is closely monitoring the situation and is in contact with the company. A spokesperson, Vito Pilieci, said Canada’s Personal Information Protection and Electronic Documents Act applies regardless of the company’s ownership.
Article content
Under the law, individuals have the right to withdraw consent for the use of their personal information, subject to legal or contractual restrictions and reasonable notice. In some cases, this may require the company to delete the data.
Article content
23andMe will continue to operate during the sale process.
Article content
— With files from The Canadian Press
Article content
Article content
Article content
Article content
Article content