When we send in a saliva sample for a DNA test, we’re entrusting the company with extremely sensitive information. Today, as 23andMe goes through a major financial crisis, the question arises: what happens to our personal DNA data once a private company goes bankrupt?
The 23andMe business model
Created in 2006, 23andMe has democratized access to home genetic testing. Its business model? Sell DNA analysis kits, then capitalize on these profiles in pharmaceutical studies and partnerships. The day the company announced massive layoffs and a slumping valuation, millions of genetic profiles became an intangible… and potentially litigious asset.
A golden database
- Around 14 million DNA profiles collected.
- Around 7 million items of data compromised in a recent leak.
- Marketing value estimated in hundreds of millions of dollars for genomic research or targeted insurance.
Crisis of confidence and data leaks
In 2023, 23andMe revealed a major data leak: almost 7 million profiles exposed. This incident triggered a serious crisis of user confidence. How can users be trusted when a DNA database, more intimate than a simple customer file, is accessible to malicious third parties?
“Our DNA data can reveal not only high-risk diseases, but also hidden family links”. – Specialized observer
Legal and ethical risks
Data resale: opportunity or drift?
Once bankrupt, genomic assets can be sold like any other asset. Interesting profiles for buyers include high-risk groups, Alzheimer’s research and so on. But what if an insurer or pharmaceutical fund buys the data? Insurance or genetic discrimination abuses become a real possibility.
What about initial consent?
Many users have agreed to their data being used “for research purposes”. But is this consent still valid if there is a change of ownership? And how can we be sure that the buyer respects the same ethical commitments?
The fate of personal data in the event of liquidation
Data is one of the “intangible assets” in a liquidation. Like a patent or software, it can be sold to the highest bidder. This raises the fundamental question: can the resale of DNA data after bankruptcy be prevented?
- Current safeguards against such resale are weak.
- The European GDPR imposes strict safeguards, but does not prohibit the transfer of assets including data.
- In the United States, the framework is even lighter: the Health Privacy Act does not cover private genetic networks.
Legal comparison: RGPD vs. US law
| Key point | RGPD (EU) | USA |
|---|---|---|
| DNA data qualification | Sensitive data → explicit consent and right to erasure |
Health data subject to HIPAA, but not private DNA data |
| Resale possible | Authorization possible if explicit clause in contract |
Little regulation → possible |
| Bankruptcy transfers | Guarantee of proper treatment after sale | No uniform standards |
Digital sovereignty issues
Our DNA data represent part of our biological identity. The fact that it is held by American companies raises concerns about sovereignty. We are witnessing the emergence of European projects for public biobanks, designed to store the DNA profiles of citizens for the benefit of research, rather than funds or multinationals.
Inspiring examples
– The [Clear BCA France] project (public biobank for genomics).
– Academic initiatives integrated into an ethical, non-commercial contract.
– More transparent private alternatives such as Quick DNA, which make confidentiality a priority.
What can you do personally?
- Please read the Terms and Conditions carefully before sending a DNA kit.
- Know where your data is stored and under which jurisdiction.
- Demand the right to delete your AGNI data.
- Give preference to public players or associations governed by the RGPD.
Private vs. public laboratory partnerships: the way forward
Sharing between public and private entities can be fruitful if framed by solid guarantees. The aim is to preserve trust by protecting citizens. Mechanisms could be inspired by health research, where data is often pooled under controlled conditions (ethics committee, depersonalization, general interest research).
To better understand the European legal framework surrounding genetic data, you can consult the CNIL’s official fact sheet on sensitive data, which includes a clear definition of genetic data.
FAQ
1. Can the resale of DNA data be prevented if 23andMe goes bankrupt?
No: as the law stands, this data is an asset transferred to the buyer. The RGPD imposes compliant processing, but does not block resale.
2. Are the RGPD guarantees sufficient?
Partially: they provide a framework for processing, but not for transfer after bankruptcy. User consent and CNIL control are helpful, but not always sufficient.
3. What’s the difference between public and private DNA testing?
Public tests (university research) are supervised by ethics committees, anonymous and non-commercial. Private players often seek financial rewards.
4. How do I know if my data can be resold?
Check the company’s T&Cs, especially the sections on “transferability” or “transfer of assets”. Insist on your right to erasure if you wish to limit the risks.
5. Does the RGPD really cover our DNA data?
Yes: DNA is a special category of data requiring explicit consent for any processing. But this framework does not exclude the sale of existing databases.
Preserving our DNA data: a major collective challenge
Our personal DNA data is a biological treasure: invaluable for research, but extremely vulnerable when it passes through bankrupt private companies. As citizens, we need to be vigilant about UGC, demand our rights and support public initiatives to ensure that our genes remain in ethical and responsible hands. Want to go further? Join the debate on citizen biobanks and follow the progress made in Europe!
