'You have a right to ask them to delete;' Consumer Protection Division advises Utahns to review 23andMe data

SALT LAKE CITY — Popular genetic testing company 23andMe is now for sale after financial troubles. A sample of saliva has unlocked answers on family history, medical information and more for so many. Now, the company has filed for bankruptcy. That means the genetic and sensitive information of millions could soon be controlled by a new owner. Leaders at Utah's Division of Consumer Protection said it's time to go back into your settings and evaluate what genetics you're comfortable sharing. "A lot of the individuals, and particularly citizens of the state of Utah, have their information stored with 23andMe," division director Katie Hass said. Hass said private information could be at risk depending on who buys the company. Right now, the company is offering people the opportunity to delete their data. "I think time is of the essence here," Hass said. " I don't know how these bankruptcy proceedings will play out. I think it's super important that people take note of this and act quickly to destroy or delete depending on what they want to do and what they're comfortable with." Past and present 23andMe users can request to have their test samples and genetic information deleted. Hass' team listed a step-by-step process for permanently deleting data from the website. "You should get a confirmation that it's been destroyed or deleted, but it might be that something turns up down the road," Hass said. She said to be sure to check for and save confirmation emails. "If they make a mistake and they haven't deleted your information or destroyed your genetic information, we may have a legal recourse against the company on your behalf," Hass said. She said genetic data is protected by state law. "The state passed the Utah Consumer Privacy Act. So with other companies, not just 23andMe, we have a law on the books that we work with the attorney general's office to enforce. Complaints can come to the Division of Consumer Protection." She said if consumers have suspicions their information wasn't deleted, they can report it to the division. "Once you put that request in there is a 45-day opportunity they have to delete or cure or correct anything that they need to in the processing," Hass said. "You may not get an instant response. It only becomes something that we're going to really look into. If it's been 45 days and you don't have confirmation about what they've done with your information." She said what someone chooses to do with their data depends on their risk tolerance. "Your genetic information is some of your most sensitive information, and it's tied to you personally," Hass said. "This isn't data that they may have aggregated and anonymized and it might be out there, but where it's tied directly to you, this is information that you might not want getting out there, particularly if you have more sensitive medical conditions or other information about yourself that you don't want to be shared." There are other genetic testing companies consumers can choose to use, like Ancestry. Hass said it's important to understand any company's policy on data protection. "I think it's great for people who want to learn about their ancestry," she said. "I don't want to discourage that in any way. What I would say is read what you can and cannot do with your sample once it's gone, and once you've got the information you want from the company, whether or not they need to retain your genetic sample and have that tied to you is questionable." She recommends people have conversations with their loved ones who have used 23andMe, so they can understand the situation and make an informed decision.

Related stories: 23andMe files for Chapter 11 bankruptcy as co-founder and CEO Wojcicki resigns

Related topics