By BECKY RUTHERFORD
Los Alamos

Spit in a tube, send it in the mail, and find out all about your genetics and ancestry, that was the premise of biotech company 23 and Me, but the company has found itself in dire straits and facing bankruptcy. What does this mean for the genetic data entrusted to the company by its customers?

With the impending bankruptcy of the company, they are looking to find a buyer. But what happens to user data once the purchase goes through? Any purchaser would have to abide by “applicable law” governing the use of user data, but data privacy experts say there isn’t much on the books to protect user data. HIPAA likely wouldn’t apply, and other genetic protections are slim and vaguely defined.

The company will remain in business through the bankruptcy proceedings, how can customers protect their data? If you are concerned about the possible sale of your genetic data (and you should be) then you can login to the site and delete your data.

Go to settings:

23 and me settings. Select 23 and me data ‘View”

23 and me data. Download any data you wish to save and delete the rest, do not delete until you have finished downloading your data:

Delete your data

You can also opt to have your genetic material destroyed by going to “Research and product consents” and revoking permission for your genetic material to be used in research projects.

Why would this change of ownership be concerning for your data security? The privacy policy says the company has to follow the existing privacy policy, which sounds good, but the existing privacy policy says it can be changed at any time. A new company could purchase them and change the privacy policy to whatever they want.

Rather than leaving the security of your genetic data up to whoever purchases 23 and Me, you might prefer to be proactive and just download what you want and then delete your data. Stay safe online, be aware of potential changes to data privacy, and safeguard your health data.