N.L.'s privacy commissioner urges people to delete data from 23andMe after bankruptcy declared

In the wake of a popular genetic testing company going bankrupt, Newfoundland and Labrador's privacy watchdog is urging people to take action to protect their genetic information — while they still can.

Genetic testing company 23andMe has filed for bankruptcy in the U.S., raising questions about what will happen to the personal genetic information it has amassed.

"They have a treasure trove of, I think, some 30 million people's genetic data, and that is deeply personal. But it's also potentially valuable genetic information of 30 million people," information and privacy commissioner Kerry Hatfield told CBC.

That data could be financially attractive to third parties who might want to buy that information, she said, like an insurance company. No one knows who might buy the data that 23andMe has accumulated and how it could be used, Hatfield added.

The San Francisco-based company was founded in 2006, with clients submitting saliva samples by mail, which would then be analyzed to produce charts of their background and lineage.

On March 23, 23andMe filed for bankruptcy in U.S. federal court and announced on its website "orders and subscriptions will continue as normal, and any purchases or genetic testing kits sent in for processing will be handled without disruption."

Not long before filling for bankruptcy, the company updated its privacy policy, announcing that if 23andMe did go into bankruptcy, then clients' information could be accessed or sold.

In a follow-up statement, it said "any buyer of 23andMe will be required to agree to comply with our privacy policy and with all applicable law with respect to the treatment of customer data."

Take action

Hatfield is encouraging people to go onto the 23andMe website, log in, and delete their information and accounts. In addition, if someone has opted into allowing the company to keep their sample for research, they can also change that setting.

"And just to be super safe, I'm actually saying for people to delete the entire account," she said.

However, Hatfield said that means users will still be relying on the company honouring its privacy policies.

"The laws have not always kept up to ensure these things get done," she said.

Her office wouldn't be able to investigate a private company, said Hatfield, adding that it would be up the Office of the Privacy Commissioner of Canada if they wanted to investigate. However, she said that the office is generally involved in data hacks and breaches.

Download our free CBC News app to sign up for push alerts for CBC Newfoundland and Labrador. Sign up for our daily headlines newsletter here. Click here to visit our landing page.