Will Your DNA Data be Sold Soon?

15 million people trusted 23andMe with their DNA data. Their privacy policy says how they will use your data. Sort of. After all, lawyers wrote it.

23andMe is, to be polite, having a bit of a financial challenge. The stock is about to be delisted. It shut down its in-house drug development unit last month. Last week, the entire board of directors quit, minus the CEO.

The CEO, Anne Wojcicki, one of the co-founders, said she would consider selling the company. Given the company is in the toilet, why would anyone buy it?

OH! Right! They have DNA for 15 million customers.

But, you say, not so fast. What about their privacy policy? It says the privacy policy will apply in case of a sale. It specifically says:

If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction and this Privacy Statement will apply to your Personal Information as transferred to the new entity.

First, no one reads the policy and next, what actual choice do you have? Nothing meaningful. You can refuse to give them your DNA. That is not really choice.

Well lets say that it is sold. What can the buyer do with the data.

Again, to be polite, the privacy policy is, lets say, flexible.

Here is the complete list of allowable uses:

• Provide our Services, including to develop, operate, improve, maintain, and safeguard our Services, including developing new product tools and features
• Analyze and measure trends and usage of the Services
• Communicate with you, including customer support, or to share information about our Services or other offers or information we think may be relevant to you
• Personalize, contextualize and market our Services to you
• Provide cross-context behavioral or targeted advertising (learn more in our Cookie Policy and Cookie Choices page)
• Enhance the safety, integrity, and security of our Services, including prevention of fraud and other unauthorized or illegal activities on our Services
• Verify your identity and administer your User Account
• Enforce, investigate, and report conduct violating our Terms of Service or other policies
• Conduct surveys or polls, and obtain testimonials or stories about you
• Comply with our legal, licensing, and regulatory obligations
• Conduct 23andMe Research, if you choose to participate

Some of those are benign like complying with their legal obligations.

Other are, not so much.

What does “provide our services” mean? What if the new owner provides slightly or significantly different services, but with some overlap?

The government could come after them, but even if they did, it is unclear that they could put the genie back in the bottle and what are you going to get for damages – fifty cents?

Something to consider when you share your data.

If this raises business questions, please contact us. Credit: Professor Dan Solove, GWU School of Law

by