B.C.’s Office of the Information and Privacy Commissioner (OIPC) says British Columbians' genetic data could be sold as part of bankruptcy proceedings.
Commissioner Michael Harvey issued a warning along with steps people can take to protect their data after the bankruptcy filing of 23andMe, a genetic services company, in the United States on March 23.
“Genetic information is some of the most sensitive personal information we can share,” said Commissioner Harvey. “In many ways, it is the very biological essence of who we are. When we talk about protecting it, it’s not only our own privacy that is at stake, but also those of our biological relatives with whom we share our genetic makeup. That means that we need to take extra caution when determining how this personal information is collected, used, disclosed and stored. If people are concerned about their data, one first step that people can take is to explore their rights to manage it.”
Harvey’s office said the company holds the personal information of an estimated 15 million people worldwide, including many people in British Columbia.
The office said 23andMe has issued a statement on its bankruptcy filing, which includes claims about how customer data may be treated both while still in the custody of the company and if sold as part of bankruptcy proceedings.
Harvey's Ontario counterparts have also issued a warning.
Still, the office said, if 23andMe users in B.C. have concerns about what will happen to their samples and data, there are a number of options for how they can manage consent for their information.
“For example, users can adjust their settings to choose whether or not they wish to participate in research and share their data, or participate in biobanking. There is also the option to delete account and genetic data on the 23andMe platform. This option is in the account settings under '23andMe Data, Permanently Delete Data.' Users can select options to delete both their account and their genetic data.”
The OIPC also offered several other courses of action.
Requests to destroy physical DNA samples and additional queries can be sent through the 23andMe customer service portal.
The OIPC also offers a guidance document: direct-to-consumer genetic testing and privacy.
