Law Office of August Bournique

Many of 23 and Me’s former customers are asking to have their data and samples deleted or destroyed out of concern that they may be sold during the company’s likely bankruptcy.  23 and Me isn’t making it easy, and one argument they have for retaining data is that medical record retention laws require them to. Below I look at their specific claims and offer a possible way to refute them.

While it’s almost impossible to protect yourself from the predatory market for private data, one can try, especially for things like genetic data, which may be used to limit your future access to healthcare or insurance.  This week, the genetic testing company 23 and Me offers an example of how hard getting personal data deleted can be. To be clear 23 and Me as a company isn’t and may never have done anything wrong in any legal sense.  What they have done is collected the genetic information of millions of people and then stumbled towards bankruptcy. 23 and Me’s hoard of genetic data is likely their most valuable asset – and it will be sold if it can be. Customers concerned that their personal genetic information could be sold might think they can demand that information deleted under laws like the GDPR or California Consumer Privacy Act and may have the impression that it’s fairly a simple process where 23 and Me will have to honor your request.  It seems like they won’t. At least not completely. Instead, you may eventually get an email that promises to delete some of your data and then adds this:

“23andMe and our third party genotyping laboratory will retain Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations, including the U.S. Federal Clinical Laboratory Improvement Amendments of 1988 (CLIA), California Business and Professional Code Section 1265, and College of American Pathologists (CAP) accreditation requirements.”

Leave a Comment