Millions of people have trusted 23andMe with their most intimate data—but what happens when a company holding 15 million DNA profiles goes bankrupt? In this episode, you’ll hear highlights from bipartisan House and Senate hearings exposing how genetic data can be hacked, shared, retained, and even sold under current U.S. law. Using testimony from lawmakers, legal experts, and 23andMe leaders, this episode uncovers the alarming gaps in federal privacy protections and explains why your genetic information—and even your relatives’—may be far less secure than you think.
Please Support Congressional Dish – Quick Links
- Contribute monthly or a lump sum via PayPal
- Support Congressional Dish via Patreon (donations per episode)
- Send Zelle payments to: Donation@congressionaldish.com
- Send Venmo payments to: @Jennifer-Briney
- Send Cash App payments to: $CongressionalDish or Donation@congressionaldish.com
- Use your bank’s online bill pay function to mail contributions to: 5753 Hwy 85 North, Number 4576, Crestview, FL 32536.
Please make checks payable to Congressional Dish
Thank you for supporting truly independent media!
Contact Your Members of Congress: (202) 224-3121
Audio Sources
23 and You: The Privacy and National Security Implications of the 23andMe Bankruptcy
Senate Judiciary Committee
June 11, 2025
Witnesses:
- Joe Selsavage, Interim CEO, 23andMe, Inc.
- I. Glenn Cohen, Deputy Dean and Professor, Harvard Law School
- Brook Gotberg, Professor of Law, BYU Law School
Clips
1:30 Sen. Chuck Grassley (R-IA):
23andMe collected genetic data from roughly 15 million people, and when it did, it told the consumers that their data would be safe. They said it would be protected under their privacy policy. But now 23andMe is in bankruptcy and is selling off its data — Americans’ genetic data, your data — to the highest bidders, bidders who consumers never consented to giving their information to, bidders who could manipulate and repurpose the genetic data, bidders who could be loyal to or controlled by foreign adversaries. Without any federal law governing genomic data privacy, the only protection for the American consumer was 23andMe’s own privacy policies. Even putting aside whether consumers read or understood the privacy policy, they were required to sign it as is or they couldn’t use the service. And now that 23andMe is in bankruptcy, whichever company buys them can change the privacy policy on a whim, however they see it. That’s why, just yesterday, 27 states sued to block the sale of this data. Though the Bankruptcy Code requires a consumer privacy ombudsman to be appointed when personally identifiable data is being sold in violation of a privacy policy, that simply is not enough. On the one hand, the bankruptcy code doesn’t include genetic data within the definition of these three words: personally identifiable information. So even if a company sold genetic data in violation of their privacy policy, the code doesn’t require an ombudsman to be appointed to protect consumer privacy interest.
10:45 Sen. Dick Durbin (D-IL):
When 23andMe filed for bankruptcy on March 23, a lot of people suddenly became interested in the privacy policy, because buried in the fine print of their privacy policy is the following, listen closely: “if we are involved in a bankruptcy, merger, acquisition, reorganization or sale of assets, your personal information may be accessed, sold or transferred as part of the transaction.”
24:00 I. Glenn Cohen:
The main privacy protection for those customers is just a promise the company has made in its privacy statement not to share personal information voluntarily with insurance companies, employers or public databases or with law enforcement agencies without a valid subpoena, search warrant, or court order. But if you read more closely, the privacy statement provides much less protection than it appears to. Few customers read or understand privacy statements or Terms of Use. 23andMe reserves the right to alter the terms customers have relied on, and moreover, the company explicitly reserves the right to transfer customer personal information in the event of the sale of the company or bankruptcy.
24:35 I. Glenn Cohen:
The company has announced as part of the bankruptcy process, it will “require anyone bidding for 23andMe to agree to comply with our privacy policies and all applicable privacy laws.” Well, that’s all well and good, but even if that becomes a condition of the sale, nothing prohibits Regeneron, TTAM, or another buyer of the data from altering that privacy policy, just as there’s nothing to stop 23andMe from doing so tomorrow. It’s also unclear to me what’s going to happen to the saliva samples, raising additional privacy concerns.
25:50 I. Glenn Cohen:
And federal law is not currently up to the job. The Health Insurance Portability and Accountability Act, HIPAA, our main health privacy law on the federal level, will not apply to 23andMe because it’s not a covered entity. The Genetic Information Nondiscrimination Act of 2008 protects individuals from genetic discrimination for employment or health insurance, but unlike its equivalent in many of our peer countries, it doesn’t cover life, disability, and long term care insurance. It excludes military personnel and excludes protection for individuals on the basis of conditions that have already manifested in the individual.
1:03:50 Sen. Chris Coons (D-DE):
Professor gut Burg is a prospective buyer in bankruptcy, legally required to follow 23 meets current privacy policy.
Brook Gotberg:
So the privacy policy is a contract, right? So contracts are enforceable as between the two parties. In law school, we like to teach that a contract is a promise to perform or to pay damages. So a company that undertakes a contract, if they don’t perform, would open itself up to a lawsuit for damages. That’s true for 23andMe and it would be true for any subsequent buyer. Whatever the subsequent buyer agreed to do would just be a contract. There would be no enforcement mechanism to force them to comply. They could just choose to breach.
Sen. Chris Coons (D-DE):
Nothing other than damages enforces that contract.
1:34:10 Sen. Josh Hawley (R-MO):
When they go onto your page, they get an opportunity, it says “permanently delete the data.” So they click the button that says, “permanently delete the data”, and then they get a notification that says, your account is no longer accessible. If they can’t access their account anymore, how do they know their data has been deleted?
Joe Selsavage:
Because we send them a notification that their information has been deleted.
Sen. Josh Hawley (R-MO):
You send it once, and how long does that take?
Joe Selsavage:
Our policy states that we will delete their data within 30 days and in most cases it is automatic and happens much [more] quickly.
Sen. Josh Hawley (R-MO):
And when you deleted it, it’s deleted-deleted. It’s gone forever.
Joe Selsavage:
All the genetic data is deleted forever. Yes.
Sen. Josh Hawley (R-MO):
Really? Because that’s not what your privacy statement says in the fine print. Let’s read it. What your statement says is, “we retain personal information for as long as necessary to provide the services and fill the transactions you’ve requested to comply with our legal obligations, resolve disputes, enforce agreements,” etc, etc. And then it goes on, “23andMe and our contracted genotyping laboratory will retain your genetic information even if you choose to delete your account.”
Joe Selsavage:
Senator, you know, 23andMe, it does not retain any genetic information regarding the consumer once they delete their account. We do —
Sen. Josh Hawley (R-MO):
It says right here that you will retain genetic information, including date of birth and sex, even if you choose to delete your account. This is your privacy policy. I’m just quoting from it.
Joe Selsavage:
Senator, you know, to the best of my knowledge, we do not maintain any genetic information.
Sen. Josh Hawley (R-MO):
It says, even if you choose to delete your account, we will retain, we will retain your genetic information, date of birth, and sex, even if you choose to delete your account.
Joe Selsavage:
There is some information that we do retain, but not related to the genetic information, such as name, email address, other —
Sen. Josh Hawley (R-MO):
Ah, so even if you delete the account, you retain their name, you retain their email address, you retain their date of birth, you retain their sex and you retain their genetic information, even if they choose to delete your account. So in other words — don’t talk to your suit behind you, talk to me. He’s not testifying. You are. You do not allow consumers actually to delete permanently their data. And when you said a minute ago to Senator Moody, at all times, consumers have complete control of their data, that’s just not true, is it? By the terms of your own agreement, that just is not true.
Joe Selsavage:
Senator, with all due respect, all of the genetic data is deleted. We are only —
Sen. Josh Hawley (R-MO):
With all due respect, what you are telling me is in direct contravention to what your own policy states. Even if you choose to delete your account, in fact, what you do is you allow your consumers to delete their account settings, but their data isn’t deleted. You still have it. The laboratory still has it. You have their name, you have their date of birth, you have their sex, and now you’re going to sell it. Here’s my point. It’s a pattern. Your consumers actually aren’t in control of anything. You are. You control their data. You control their genetic information. Now you’re about to sell it. You promise them, we won’t ever sell it without your consent, but you’re doing it. You promise them, we’ll allow you to delete it, but you don’t.
Securing Americans’ Genetic Information: Privacy and National Security Concerns Surrounding 23andMe’s Bankruptcy Sale
House Committee on Oversight and Government Reform
June 10, 2025
Watch on YouTube
Witnesses:
- Margaret Hu, Professor of Law, William & Mary Law School
- Joe Selsavage, Interim CEO, 23andMe, Inc.
- Anne Wojcicki, Board Member, 23andMe, Inc.
Clips
17:40 Rep. James Comer (R-KY):
23andMe is a direct-to-consumer genetic testing company in possession of personal genetic data of millions of Americans. On March 23, 2025 the company voluntarily filed for Chapter 11 bankruptcy, leaving open the question of who will purchase 23andMe and who may gain access to the sensitive information of customers and their family members. On May 19, 2025 Regeneron Pharmaceuticals, a biotechnology company based in York, announced it had entered into an asset purchase agreement to acquire 23andMe. On June 4, 2025 the court decided to reopen the auction for 23andMe to allow for final bids from Regeneron, TTAM Research. And let me note that TTAM was founded by 23andMe co-founder and former CEO, Ms. Anne Wojcicki.
19:05 Rep. James Comer (R-KY):
23andMe has a record of engaging with foreign adversaries, namely the Chinese Communist Party. In 2015, the company received $115 million in funding from investors, including WuXi Healthcare Ventures, which was then a corporate venture arm of WuXi app tech, a company with ties to the CCP and Chinese People’s Liberation Army. At the time, the investment valued 23andMe at $1.1 billion. According to 23andMe, this partnership was terminated, but questions remain about the potential for the future owner of the company to partner with bad foreign actors.
22:55 Rep. Stephen Lynch (D-MA):
While health care providers and insurance companies must follow federal laws like the Health Insurance Portability and Accountability Act, or HIPAA, which protects patients’ sensitive data from unauthorized sharing, direct to consumer companies like 23andMe operate with minimal oversight and regulation. The lengthy and opaque Terms of Service and privacy policies that customers are required to agree to typically allow for their data to be sold during a sale or bankruptcy, and that is precisely the situation that millions of the company’s customers find themselves in today.
28:20 Rep. James Comer (R-KY):
First of all, Anne Wojcicki is a co-founder, board member, and former CEO of 23andMe. Before co-founding 23andMe, Ms. Wojcicki worked at various hedge funds and investment companies as a health care analyst. She founded 23andMe in 2006. Ms. Wojcicki served as CEO of 23andMe for almost 20 years. Her service as CEO voluntarily came to an end on March 23, 2025.
28:45 Rep. James Comer (R-KY):
Joe Selsavage is the current interim CEO of 23andMe as of March 23, 2025. He began working for 23andMe in November 2021 after the company was acquired by Lemonaid Health. He served as 23andMe’s Chief Financial Officer as he has over 25 years of accounting and finance experience. He formerly worked as a consultant and Chief Financial Officer for various companies. 23andMe’s board chose Mr. Selsavage to serve as interim CEO after Ms. Wojcicki’s voluntarily resignation and 23andMe’s simultaneous bankruptcy announcement on March 23.
29:25 Rep. James Comer (R-KY):
Dr. Margaret Hu is the Professor of Law and Director of Digital Democracy Lab at William and Mary Law School. She previously served as Special Policy Council in the Civil Rights Division of the US Department Justice.
30:35 Anne Wojcicki:
My name is Anne Wojcicki. I co-founded 23andMe nearly two decades ago with the mission of helping people access, understand, and benefit from the human genome.
30:45 Anne Wojcicki:
My personal mission is to have a meaningful impact on the world. It has been my life’s passion to understand the human genome and DNA, the code of life.
31:25 Anne Wojcicki:
Speaker, during my time as CEO, privacy was central to every decision we made, from product development to research initiatives. Customers had choice and transparency about what information they saw and how they consented for their data to be used. Customers were required to give explicit consent before their anonymized data was used for any research purpose, and over 80% of our customers made the choice to opt in. We never provided information to any third party without the customer’s explicit consent.
32:40 Anne Wojcicki:
Over 15 million customers have learned about their ancestry, found relatives and potentially life saving health information. For example, over a million customers learned they carried a genetic variant associated with blood clotting risk, allowing them to seek care to prevent potentially fatal clots. Customers also gained information about sickle cell disease, chronic kidney disease, type two diabetes and coronary artery disease. In many cases, these reports were life saving. Hearing from customers about how their genetic information changed their lives is what drives me every single day. One recent email from a customer read, “Hi Anne, I just wanted to share my story with you, because I was diagnosed with breast cancer on June 24, 2024 at the age of 33. I had no symptoms at all, and the doctors felt no lumps. It was all because of 23andme that I even got a mammogram. And because of that, we have caught it at an early stage. And although the upcoming months will be hard, it could have been so much worse. A few years ago, I did 23andme and we did the health version, and it showed that I had the BRCA1 gene mutation. I have no family history that we know about, so I was not on track to get a mammogram until I was 40. I just wanted to send this testimony and say thank you. I am so indebted to you for making me aware of this, and I truly feel like because this was caught early, my life is saved, and I owe you that from me, my family, my friends and my one year old daughter. Thank you for saving our lives.
35:45 Anne Wojcicki:
As I believe you know, I am currently pursuing an acquisition of the company as an independent bidder during the bankruptcy proceedings.
36:25Joe Selsavage:*
My name is Joseph Selsavage, and I am the Interim Chief Executive Officer of 23andMe, a mission-driven organization founded on a simple yet transformative belief that individuals have the right to access, understand, and benefit from their own genetic information.
37:20 Joe Selsavage:
Founded in 2006, 23andMe is a personal genomics and biotechnology company that pioneered direct-to-consumer genetic testing. We are named after the 23 pairs of chromosomes in every human cell. Our mission has always been to empower customers by providing access to information about their personal genetics based on the latest science so that they can make informed decisions about their healthcare journey.
37:50 Joe Selsavage:
Our services allow customers to gain DNA insights about their genetic risk for dozens of conditions like type 2 diabetes, Alzheimer’s disease, and certain cancers. They can also learn about their carrier status for inherited conditions like cystic fibrosis or Tay-Sachs disease or wellness factors like lactose intolerance or deep sleep tendencies. 23andMe customers have consistently reported taking positive health actions after learning about their genetics through 23andMe services. 82% of our customers with an actionable genetic results were previously unaware of their health risks.
38:35 Joe Selsavage:
Customers who register for our services also have the option to for their data to be shared for research purposes, and over 80% of our customers have chosen to consent to research. Consent is a central tenet of 23andMe’s research program. We have separate research consents beyond our consent to processing sensitive data, a privacy statement and terms of service that customers must review and agree to separately if they want to participate in our research program, we remove all identifying information before any genetic data is shared with any third party, and any customer who affirmatively consents to participate in our research program can easily opt out at any time through their account settings, and always have been able to do so. Customers are also free to delete their accounts and information at any time.
39:35 Joe Selsavage:
Customers who affirmed of their consent contribute to more than 230 studies on topics that range from Parkinson’s disease to lupus to asthma and more. We collaborate with advocacy organizations, universities, and biotech companies to bring customer opportunities to participate in research. Since 2010, 23andMe has published 293 papers that help advance scientific research in a wide range of fields.
40:05 Joe Selsavage:
Due to circumstances that I discuss in more detail in my written testimony, 23andMe is currently conducting a sales process supervised by a United States Bankruptcy Court. That process has been a success to date. We have two remaining bidders, both American enterprises, that will conduct a final round of bidding later this week, before the sale to the sale to the winning bidder is presented for the approval by the court.
41:35 Margaret Hu:
I am Margaret Hu, Davison M. Douglas Professor of Law and Director of the Digital Democracy Lab at William and Mary Law School in Williamsburg, Virginia.
45:50 Margaret Hu:
In the intelligence context, the national security risks and misuses and abuses of genetic data by foreign adversaries may include potential biological warfare risks, blackmail, and increased surveillance, among other potential threats. The Pentagon has previously warned military personnel that DNA kits could pose a risk to national security. Other harms could potentially include abusing genetic data for isolating and discriminatory targeting and potentially analyzing genetic data and aggregating biometric data and biographical data for the purposes of cognitive warfare.
47:35 Rep. James Comer (R-KY):
Okay, so what type of information did 23 me obtain from the sample?
Anne Wojcicki:
It was about 600,000 specific markers in your genome. So markers that are known to vary between humans, known as snips.
Rep. James Comer (R-KY):
Okay, so are the samples tested for, they’re obviously tested for genetic markers, correct?
Anne Wojcicki:
Correct, correct. So 600,000 genetic markers.
Rep. James Comer (R-KY):
What’s the purpose of testing the samples for genetic markers? Can you explain that?
Anne Wojcicki:
Yeah, the purpose for it was really twofold. It’s people have the opportunity to learn about their ancestry, where they’re from in the world, potentially areas that they did not know about. They have the opportunity to connect with family members, potentially, for instance, adoptees who are looking to identify biological siblings or parents.
Rep. James Comer (R-KY):
Right. Out of curiosity, is this optional for consumers?
Anne Wojcicki:
It’s completely optional because we realized there was a number of people who do not want to find additional family members and that they did not want to be identified. So it’s an explicit consent where we ask people specifically, do you want to find close family members or distant, and you have the ability at any time to toggle in or to toggle out of that. It’s very easy to do.
Rep. James Comer (R-KY):
So did 23andme also track genetic markers over time in order to conduct long term health studies?
Anne Wojcicki:
We did. So we also specifically tested on markers that are known to be predispositions for health conditions. So in my testimony, for example, I talked about the BRCA1. We specifically identified that there were a number of people who were not able to get their BRCA results because of the barriers that the insurance industry or the societies have put up. So we found, actually, about 20% to 30% of our customers were learning that they had potentially like, a really detrimental genetic variant that put them at very high breast cancer risk, and they couldn’t otherwise get that information.
49:50 Rep. James Comer (R-KY):
Where did the data information from DNA swabs go once testing was complete?
Anne Wojcicki:
So we worked with LabCorp. LabCorp had been our partner for 18 years or so, so it went to LabCorp. They have a office in LA as well as in North Carolina.
Rep. James Comer (R-KY):
So did the data get uploaded to a database?
Anne Wojcicki:
Yeah. So they would then send us data files. And we also upload it into, we work with Amazon, AWS, all on US servers.
Rep. James Comer (R-KY):
How was the data protected?
Anne Wojcicki:
It was encrypted from end to end. We had all kinds of ways that, again, the team thought about how it was going to be encrypted how it was sent. It also, I should be super clear, had no identifiable information when it was sent to LabCorp or when we received it.
Rep. James Comer (R-KY):
How long does the data stay in that database? How long? Forever?
Anne Wojcicki:
At the 23andMe database?
Rep. James Comer (R-KY):
Or anywhere. How long does the data stay in the database?
Anne Wojcicki:
As long as a customer wants. They have that opportunity to delete their data at any time.
51:00 Rep. James Comer (R-KY):
So where did the physical the saliva sample go after testing is complete?
Anne Wojcicki:
The physical saliva sample would go to LabCorp. And customers had the ability to say, do I want my saliva sample stored or not stored? And the reason why they might want it stored is, for example, we were offering in the future, potentially you would want to upgrade. You’d potentially want to get a different type of test, or if there were additional services. So we offered bio banking —
Rep. James Comer (R-KY):
If it wasn’t stored, what happened?
Anne Wojcicki:
It was discarded.
Rep. James Comer (R-KY):
It was discarded?
Anne Wojcicki:
Correct.
Rep. James Comer (R-KY):
You’re sure?
Anne Wojcicki:
We are sure.
1:02:35 Rep. Paul Gosar (R-AZ):
Hackers got nearly 7 million people’s data from 23andMe. The firm blamed users in a very dumb move. I wanted to put this to the record. Could you address this?
1:03:00 Anne Wojcicki:
It was a credential stuffing. So it was not actually a breach of our systems. It was credential stuffing. And what that actually means is that the threat actor found old addresses, email addresses and passwords on the dark web, and they ran them against 23andMe, and they found a number of customers where they actually could enter into their accounts. So it was specific. It was a credential stuffing incident, and through that, they were able to actually get access to their account. Since then, we’ve made pretty substantial changes. So in response, we immediately wanted to learn from this, so we forced all of our customers to reset their password. So every single customer had to go and reset their password. And then secondly, we had double factor authentication, which was mandated. And we had actually had two factor authentication for a while, but it was not mandated because it was not industry standard.
1:12:00 Rep. Virginia Foxx (R-NC)
Mr. Selsavage, besides the 15 million individuals who have their genetic data stored with the company, family members, by virtue of having a similar genetic makeup to those who took the test, are also potentially at risk if 23andMe genetic data is exposed or used for nefarious purposes. Is that correct?
Joe Selsavage:
You know, if a customer at 23andMe chooses to allow their data to be shared, such as a DNA relatives feature at 23andme you know, people can access, relatives and family members can see that additional data. Yes.
1:19:15 Margaret Hu:
I do believe that we need an overlapping regime that takes into account both strong federal data privacy protections that now need to update laws such as HIPAA that do not cover these types of new biotech services and wearables and other types of apps. New health data is being generated that is not covered under our existing health data protection laws, and we are increasingly faced with cybersecurity laws and data privacy laws at the state level that are now stepping in to fill the gap that is being left by Congress, but especially with AI warfare on the horizon, it’s absolutely critical, and I agree with you. This is a bipartisan issue.
1:23:00 Rep. Gary Palmer (R-AL):
When 23andMe publicly announced it was filing for bankruptcy, roughly how many users reached out to 23andMe to delete their account and their data altogether?
Anne Wojcicki:
I was not part of the company at that time.
Rep. Gary Palmer (R-AL):
Mr. Selsavage, can you answer that?
Joe Selsavage:
Yes, I can. From the time we actually announced bankruptcy until today, approximately 1.9 million customers have requested.
Rep. Gary Palmer (R-AL):
What percentage?
Joe Selsavage:
Roughly 15%.
1:30:00 Margaret Hu:
Because of an absence of congressional legislation, we are asking these corporations to come in and fill that gap. And so we’re asking of companies like 23andMe, you need to have the best data privacy, the best cybersecurity possible. But what about federal law that then mandates that, instead of looking to industry standards?
1:34:30 Rep. Glenn Grothman (R-WI)
Mr. Selsavage, if I had used this company’s services in the past, where is my data kept right now?
Joe Selsavage:
This data is stored on Amazon Web Services in secure encrypted database files.
Rep. Glenn Grothman (R-WI)
And can we assume that my data will be there after I die? It will, right now, under the current law, be there forever?
Joe Selsavage:
Your data is there, but you always have the right to delete your data at any time, and your beneficiaries and executors of your will or trust will also have the right to delete that data in the future.
1:36:00 Joe Selsavage:
Regeneron and TTAM Research Institute, both of the bidders, under the current bankruptcy rules for the bidding process for the company have both agreed to maintain the privacy policies and consents of the company of 23andMe in the future.
Rep. Glenn Grothman (R-WI)
So by that, you mean they’re not going to change anything. They’re saying they’re not going to change anything.
Joe Selsavage:
Not only did they say they’re not going to change anything, they also agreed to that in their contract, which is an asset purchase agreement, in writing.
1:41:10 Margaret Hu:
I think that part of the concern is the way in which law enforcement or others can access this for investigatory purposes, basically doing a work around, around the Fourth Amendment protections, if it can be purchased, if it can be repackaged, sold, borrowed. And I think that this is the kind of data that can then end up in a way that is used against an individual without the types of constitutional protections and criminal procedure rights that they have become accustomed to.
1:45:15 Rep. Scott Perry (R-PA):
So in this context, as I read about you, bankruptcy doesn’t necessarily mean the end of 23andMe. As a matter of fact, it seems like it means like it’s going to continue under some other structure. Is that about right? It’s not going away. It’s just going to continue, whether you buy it or whether Regeneron [buys it]. 23andme is not going and the data is going to be around, it sounds like. Am I correct about that?
Anne Wojcicki:
That is the correct hopeful outcome, yes.
Rep. Scott Perry (R-PA):
So is 23andme precluded by law from selling all or some of the data or partnering with somebody that could do that? Are they precluded by law? And I’m asking the question because I don’t know. Is your company, or the one that you started and want to have again, is it precluded by any law from using that data or partnering with somebody that could use the data any way they want? Or is there any law that stops you from doing that?
Anne Wojcicki:
I think that’s a great question. I’m not an expert in all the different laws. I would like to highlight there was another genetics company that just went through chapter 11, that was successfully just sold.
Rep. Scott Perry (R-PA):
But you don’t know of a law that precludes. Should there be?
1:50:50 Rep. Suhas Subramanyam (D-VA):
Can the company that is receives this data through a sale in bankruptcy then sell the data to another company?
Joe Selsavage:
Two potential companies that are acquiring 23andMe as potential bidders, are adopting and stepping into the shoes of the company and adopting the privacy policies and consents of —
Rep. Suhas Subramanyam (D-VA):
But they could sell it to a company that then sells it to another third party, who then sells it to another third party, and then you end up with a situation where the genetic data is out there and multiple companies own my genetic data and the millions of people’s genetic data. Is that correct?
Joe Selsavage:
Congressman, with all due respect, I’m not a legal expert in this, but you know, basically the potential acquirers of 23andMe are adopting the privacy policies and consents of 23andMe where it does allow for the sale of the assets of the company.
Rep. Suhas Subramanyam (D-VA):
So yes, the answer to my question is yes. So then if, let’s say, a healthcare company bought the data, Professor Hu, couldn’t the healthcare company then look at your genetic data and raise your premiums because they see some bad genetics in there, for instance? Can we have a healthcare system that now has all your genetic information and then we’ll adjust premiums based on what they think is risk for them?
Margaret Hu:
Yeah, thank you so much, Congressman, for that question. I do think that genetic data is particularly sensitive because of those types of risks. That the way in which you do have intern companies and other corporations trying to link up genetic predispositions even, for example, you know, financial literacy and accountability, so not just for insurance issues, perhaps even other types of issues could be open to abuse
Rep. Suhas Subramanyam (D-VA):
And then couldn’t a foreign actor either hack into the data or even acquire the data as well and then use that, posing a national security threat?
Margaret Hu:
Yeah, absolutely. I think that part of what was deeply concerning, I understand about the issue of credential stuffing as the source of the cyber attack, or the risk this and the prior breach. But nonetheless, what we did see was a hacker named Gollum post the DNA, particularly of the Chinese and Jewish ancestry on the dark web.
1:57:15 Rep. Summer Lee (D-PA):
23andMe’s current privacy policy states that when faced with law enforcement requests, the company will “only comply with court order, subpoenas, search warrants or other requests that we determine are legally valid.” Mr. Selsavage, that last part is a bit concerning. What exactly do you mean by other requests that are legally valid, and what other request is going to get 23andMe to give over information to police.
Joe Selsavage:
Let me first say that 23andMe, to date, has not given any information over to law enforcement. We have a transparency page on our website which shows the requests that we’ve received from law enforcement. It’s a small number and those that we’ve complied with, and you’ll see that it is zero that we’ve complied with.
2:29:05 Rep. Dave Min (D-CA):
If I was really interested in the genetic data of Chairman Comer, could I buy Chairman Comer’s data if he was a client of your service?
Joe Selsavage:
No, you could not.
Rep. Dave Min (D-CA):
Why not?
Joe Selsavage:
Because we don’t have the right to share.
Rep. Dave Min (D-CA):
Because you don’t own it, right? You don’t own the rights to that. Could you sell the homes of your customers? Could you sell any other assets they owned? The answer is no, because you don’t own that, right? So you don’t own people’s genetic or health information. So I guess I’m really just wondering, why you think you can sell this data at an individual level to a third party company that’s coming. I know you’re talking about protections on that data, but I’m just wondering, I’m not a customer of yours, but for those who are including my constituents, why are you selling their genetic data when you don’t own it?
Joe Selsavage:
You know, you know the terms of service and the agreements —
Rep. Dave Min (D-CA):
I looked at your terms of service, yeah.
Joe Selsavage:
— mention that we can, basically, in an event of a sale of the company, or bankruptcy of the company, that the data can be transferred to the new company.
2:31:00 Joe Selsavage:
We believe our customers have already consented to the transfer of their data through the consents that they signed up for when they signed up for the service.
2:49:55 Rep. Andy Biggs (R-AZ)
Who owns the genetic information at 23andMe? Ms. Wojcicki?
Anne Wojcicki:
What we have said in the past, is that you, the individual always owns their genetic information.
Rep. Andy Biggs (R-AZ)
Okay, so I’m gonna leave it right there. The owner, you’ve said, is basically the person who submitted their genetic information. Mr. Selsavage?
Joe Selsavage:
The owner of the genetic information is the customer at 23andMe.
Rep. Andy Biggs (R-AZ)
Do you agree with that, Professor Hu?
Margaret Hu:
In their terms, they say that they can sell.
Music
Tired of Being Lied To by David Ippolito
