Latest news with #geneticTesting
CNET
3 days ago
- Business
- CNET
Can I Delete My 23andMe DNA? Everything to Know as the Genetics Company Gets a New Owner
A data breach raised concerns about the safety of sensitive information with 23andMe. Smith Collection/Gado/Getty Images Capping off a dire run of bad news in the last year, 23andMe announced last week that it will be acquired, in a new twist, by a nonprofit called TTAM Research Institute led by 23andMe co-founder Anne Wojcicki. Even with that resolution, the ordeals that the genetic-testing firm has weathered still may have a lot of folks wondering: Can I delete the genetic info that I sent to company? And how exactly can I go about doing that? As we grow increasingly aware of how much of our personal information is gathered across the internet, our genetic information is perhaps the most personal data we could possibly share with anyone, especially commercial ventures. But over 15 million people did just that with 23andMe because of the ancestry-tracking services it offered. These concerns certainly weren't soothed by recent news out of the company. In November, 23andMe announced it would lay off around 40% of its workforce in the wake of a major data leak and ongoing financial and management struggles, including a stock price that plummeted by 70%. Around 6.9 million customers were affected by the data breach, with investigations finding that the hackers responsible for the attack specifically targeted the accounts of people with Chinese or Ashkenazi Jewish heritage, which they spread on the dark web. After all of that, and four years of dwindling sales, 23andMe entered bankruptcy proceedings. At first, a buyer for the company looked to be a pharmaceutical company, Regeneron, which stirred concerns about how the genetic data might be used. Then, in June, in a final round of bidding, TTAM got the green light to acquire 23andMe for $305 million (compared with Regeneron's $256 million offer). "I am thrilled that TTAM Research Institute will be able to continue the mission of 23andMe to help people access, understand and benefit from the human genome," Wojcicki said in a statement. That may not be enough to satisfy privacy-conscious people out there. To get all the details about what you can do with the data 23andMe has from you, keep reading, and for more, find out how much 23andMe will pay out in a class-action settlement and read about the complex relationship between DNA testing companies and privacy. You can also check out CNET's Best DNA Testing services of 2025 list. Can you delete your 23andMe account? Yes. If you used 23andMe for DNA testing, you have the option to delete your account and personal information whenever you choose. A 23andMe spokesperson told CNET that once your request is submitted, the process of deleting data begins "immediately and automatically" and can take about 30 days to complete. But not all your data is deleted in 30 days. In its June 13 press release announcing its acquisition, TTAM said it "will honor 23andMe's existing policies that allow individuals to delete their account and genetic data and opt out of research in perpetuity." It also said all customers will receive an email with details about TTAM's privacy policies and "instructions on how to delete data or opt out of research." What data is deleted after you close your 23andMe account? The answer to this is more complicated. Your 23andMe data will be deleted after you request the deletion of your profile, a company spokesperson told CNET. The process gives you the option to have the company discard your genetic sample, too, if you initially requested that 23andMe store it. And your information will no longer be usable for any of the company's research projects. However, there's more to it than that. "If a customer opted in to 23andMe Research, their Personal Information will no longer be used in any future research projects," the spokesperson said. "Please note, data cannot be removed from research that's already been conducted." Bay Area news site SFGate found that genotyping laboratories that worked on a 23andMe customer's sample will also hold on to the customer's sex, date of birth and genetic information, even after they're "deleted." A 23andMe representative said that by law, labs are required to retain the information for a set period of time -- from two to three years -- after which it will be deleted. The representative also said that this data is retained only by the genotyping lab, not 23andMe itself. If the lab were to be the subject of any sort of breach, the data it retains is anonymous -- it doesn't include a name, address, email, phone number or other contact information -- and the genetic information included is raw and unprocessed. Before you delete your 23andMe account, download your data Before closing your account, consider saving all your 23andMe information first, including your raw genotyping data, your DNA relatives and your ancestry composition. Some of the files can take up to 30 days to prepare, so make a plan for how you want to approach this. Downloading your raw DNA file will let you upload your genetic data to another service for family or ethnicity searches, if you want. Here's how to download your raw genotyping data and related information: Log into your 23andMe account. Head to Settings and in a browser scroll to the bottom and tap View next to 23andMe Data. In the app, scroll to the bottom of Settings and tap Access your data under 23andMe data. Here, you can select which information you want to download before you delete your account. This includes an overview of your 23andMe reports, your ancestry composition raw data, your family tree data and your raw genetic data. Note: These files come through as PDF, TXT, JSON and other formats, and you'll need the appropriate apps to view the data. For your DNA file, 23andMe will send you an email with a link you use to download the data. You can also recreate everything in spreadsheets, as mapped out here, or take screenshots of everything. Some of the downloads come through right away, but some can take 30 days, 23andMe said. How to delete your 23andMe account and data Once you delete your data from 23andMe, unless you've downloaded it first, it's gone, the company warns. Ready? Here's how to delete your data: Head to Settings again, scroll down to 23andMe Data, and tap View. You may be asked to verify your birthdate to continue. If you've already downloaded or otherwise captured all the information you want to keep, scroll to the bottom and tap the Permanently Delete Data button. 23andMe will send you an email asking you to confirm your request. Once you do, the company will begin the deletion process and you will lose access to your account. If you had the company store your genetic samples, it will discard them. For more, find out how 23andMe fares against its main competitor, Ancestry.
RNZ News
3 days ago
- RNZ News
Global genetic testing company fined millions for data breach
world politics 20 minutes ago United Kingdom correspondent Edward O'Driscoll spoke to Lisa Owen about global genetic testing company, 23andMe being fined millions by a UK watchdog over a massive data breach, as well a cyclist who suffered devestating facial injuries now being the owner of a 3D-printed face.
CTV News
4 days ago
- Business
- CTV News
Joint investigation from Canada and U.K. says 23andMe failed to protect user data
Privacy Commissioner of Canada Philippe Dufresne leaves after a news conference at the National Press Theatre in Ottawa on Thursday, Feb. 29, 2024. (THE CANADIAN PRESS/Justin Tang) Genetic testing company 23andMe failed to take basic steps to protect customer data, according to a joint investigation from Canada and the U.K. into a massive global data breach. As a result, the U.K. is imposing a £2.31 million fine on the company. This is a breaking news update. Read our previous coverage below. Canada and the U.K. are announcing the results of a joint investigation into a global data breach at genetic testing company 23andMe. Canada's privacy commissioner Philippe Dufresne and U.K. information commissioner John Edwards are scheduled to reveal their findings at a news conference in Ottawa on Tuesday morning. In September, 23andMe agreed to pay US$30 million to settle a lawsuit after hackers accessed the personal data of nearly seven million customers and posted their information for sale on the dark web. The 2023 attack appeared to specifically target customers with Chinese and Ashkenazi Jewish ancestry. The joint investigation by privacy authorities in Canada and the U.K. was launched in June 2024 to examine the scope of the breach and 23andMe's response. 'In the wrong hands, an individual's genetic information could be misused for surveillance or discrimination,' Dufresne said in a news release when the investigation was announced. 'Ensuring that personal information is adequately protected against attacks by malicious actors is an important focus for privacy authorities in Canada and around the world.' 23andMe filed for bankruptcy in March. On June 13, it was announced that a non-profit led by 23andMe co-founder Anne Wojcicki would purchase the troubled company for US$305 million. Founded in 2006, 23andMe claims to have more than 15 million customers worldwide. The business was centred around at-home DNA testing kits that use saliva samples to provide genetic insights about health risks and ancestry. The California-based company went public in 2021, but never made a profit. 23andMe saliva collection kit A 23andMe saliva collection kit is shown on March 25, 2025, in Oakland, Calif. (AP Photo/Barbara Ortutay) With files from Reuters and CNN
Sky News
4 days ago
- Business
- Sky News
23andMe fined millions by UK watchdog over 'profoundly damaging' cyber attack
The genetic testing company 23andMe is being fined £2.31m by the UK's privacy watchdog over their 2023 data breach that saw the personal information of seven million people stolen. More than 150,000 Britons had their personal information taken by hackers. Family trees, health reports, race and ethnicity information may all have been stolen, along with addresses, dates of birth and profile pictures. A database shared on dark web forums and viewed by Sky News' US partner network, NBC News, contained a list of 999,999 people who allegedly had Ashkenazi Jewish heritage, according to 23andMe's genetic profiling. "Crazy. This could be used by Nazis," said one person at the time who appeared in the database. The ICO's fine comes after a joint investigation with Canada's privacy watchdog. It is the most severe punishment the watchdog can impose and reflects repeated failures to protect extremely sensitive data, according to the information commissioner. "This was a profoundly damaging breach that exposed sensitive personal information, family histories, and even health conditions of thousands of people in the UK," said John Edwards, the UK's Information Commissioner. "23andMe failed to take basic steps to protect this information. "Their security systems were inadequate, the warning signs were there, and the company was slow to respond. This left people's most sensitive data vulnerable to exploitation and harm." Despite the attack starting in April 2023, 23andMe did not open an investigation until October that year, when an employee discovered the stolen data had been advertised for sale on Reddit. The company's defences only became strong enough to halt the attack by the end of that year - but that was not the end of 23andMe's troubles. 'Sue you to oblivion' By March this year, the best-known genetic testing company in the world had filed for bankruptcy, unable to rebuild trust after the hack and make enough money from its business model. It will now be sold for $305m (£225m) to 23andMe's original co-founder, Anne Wojcicki and her non-profit TTAM. But a blistering exchange in the US Senate last week laid out fresh concerns for the sensitive data users have shared with 23andMe. Senator Josh Hawley accused Joseph Selsavage, the interim chief executive of 23andMe, of lying to his customers when he says they can delete their genetic data from the company's databases. "You're not deleting it," he said, "because if you were, your company wouldn't be worth $300m." "I hope [users] will rush to the courthouse [...] to sue you into oblivion." Mr Selsavage denied Senator Hawley's claims, saying his company deletes all user data when requested. James Moss, the director of cyber investigations at law firm Addleshaw Goddard, told Sky News the ICO's fine was "about as serious as it gets" but an enforcement order, a notice from the watchdog that dictates how data can be used in the future, would be "more important". "That's the notice which looks forward and says, 'look, you have a legal obligation under UK law to continue to protect the personal data of these 150,000 UK citizens'. And that's arguably the more important," he said. A total of 28 US attorneys general last week launched a legal case against 23andMe to protect user data during the sale, and urged customers to purge their information from the firm's database, given the sensitivity of the data it has collected over the years. 23andMe already sells its users' genetic data and has made at least 30 deals with biotech and pharmaceutical companies like GSK. A spokesperson for the 23andMe buyer, TTAM, told Sky News the non-profit had made "several binding commitments to enhance protections for customer data and privacy". These include allowing individuals to delete their account and opt out of research at any time, notifying customers at least two days before the deal closes about what TTAM's acquisition means for them and agreeing, if TTAM were to sell the company again, only to sell it to someone who agrees to adopt TTAM's privacy polices and comply with data laws. Customers will also be offered two years of free Experian identity theft monitoring, while TTAM will continue to allow "de-identified data" to be used for scientific and biomedical research at universities and nonprofits. No money for UK victims The £2.31m fine money will go to the state rather than to individuals affected by the hack. In the US, victims of the hack won $30m in a class action lawsuit last year, but that's not an option in the UK, despite the incredibly sensitive information that was shared. Class action lawsuits for data breaches could "improve and increase accountability for data-protection breaches", according to solicitor Alex Lawrence Archer from the data law agency AWO. "But also help individuals who are affected get something back, help them get redress, because a fine paid to the ICO doesn't achieve that. Although [the fine] is welcome, it doesn't help individuals." For anyone thinking about using one of the many genetic testing companies that have sprung up since 23andMe was founded in 2006, Mr Lawrence Archer has cautionary advice. "Handing over your genetic data is a really big step, and it's something that [...] people have hitherto been encouraged to take quite lightly," he said. "There's no hard and fast rule like you should or you shouldn't do it, but it's something that you should think really carefully about. "It can be a quite permanent step that's very difficult to undo. It's not something that should be done lightly."
CTV News
4 days ago
- Business
- CTV News
Massive 23andMe data breach focus of joint investigation by Canada and U.K.
Privacy Commissioner of Canada Philippe Dufresne leaves after a news conference at the National Press Theatre in Ottawa on Thursday, Feb. 29, 2024. (THE CANADIAN PRESS/Justin Tang) Canada and the U.K. are set to announce the results of a joint investigation into a global data breach at genetic testing company 23andMe. Canada's privacy commissioner Philippe Dufresne and U.K. information commissioner John Edwards are scheduled to reveal their findings at a news conference in Ottawa on Tuesday morning. In September, 23andMe agreed to pay US$30 million to settle a lawsuit after hackers accessed the personal data of nearly seven million customers and posted their information for sale on the dark web. The 2023 attack appeared to specifically target customers with Chinese and Ashkenazi Jewish ancestry. The joint investigation by privacy authorities in Canada and the U.K. was launched in June 2024 to examine the scope of the breach and 23andMe's response. 'In the wrong hands, an individual's genetic information could be misused for surveillance or discrimination,' Dufresne said in a news release when the investigation was announced. 'Ensuring that personal information is adequately protected against attacks by malicious actors is an important focus for privacy authorities in Canada and around the world.' 23andMe filed for bankruptcy in March. On June 13, it was announced that a non-profit led by 23andMe co-founder Anne Wojcicki would purchase the troubled company for US$305 million. Founded in 2006, 23andMe claims to have more than 15 million customers worldwide. The business was centred around at-home DNA testing kits that use saliva samples to provide genetic insights about health risks and ancestry. The California-based company went public in 2021, but never made a profit. 23andMe saliva collection kit A 23andMe saliva collection kit is shown on March 25, 2025, in Oakland, Calif. (AP Photo/Barbara Ortutay) With files from Reuters and CNN
