23andMe accused of having ‘fire sale’ of customer DNA data

DNA testing provider 23andMe’s tentative plan to sell customers’ genetic data to third-party pharmaceutical companies violates state laws and leverages the procedural complexity of the litigation to harm plaintiffs, attorneys at Edelson PC told a federal judge on Friday.

There is no clarity on which companies will have access to this data, “and that’s what is scary about it,” Edelson partner J. Eli Wade-Scott said in a phone call. His firm sued the San Francisco company, whose stock value has plummeted in recent months, over a data breach that allegedly exposed the personal information of hundreds of thousands of people with Ashkenazi Jewish and Chinese ancestry.

The company issued a statement Friday that said: “23andMe gives customers the choice to participate in research that could help prevent or cure diseases. Participation in research is voluntary. We believe customers should decide if they want to share their data, and if so how that data is shared. Our Research program is overseen by a third-party Institutional Review Board (IRB), the gold standard for ethical oversight in the type of research we conduct.”

More thanr 30 lawsuits have been filed against 23andMe in connection with the security breach. Its attorneys at Greenberg Traurig LLP filed a motion to consolidate the cases before the Judicial Panel on Multidistrict Litigation in December. Melvin et al. v. 23andMe Inc., 3:24-cv-00487-SK (N.D. Cal., filed Jan. 26, 2024).

In a February interview with Wired, 23andMe CEO Anne Wojcicki talked about the company’s new goal of mining genetic data and partnering with pharmaceutical companies for drug research and development. The company had an exclusive agreement with GlaxoKlineSmith that ended last year.

Asked whether 23andMe customers knew about their data being used by drug companies, Wojcicki said that “most people want to see improvements in their lives” and that the company needed to “partner with others to really accelerate in a number of different disease areas.”

An opposition motion was filed with the court Friday by Edelson managing partner Rafey S. Balabanian, expressing concern about 23andMe’s “apparent attempt to solve its public financial woes with a fire sale of user data.”

On the phone call, Wade-Scott said the plaintiffs should know who will buy their genetic data and how 23andMe will vet the partners to make sure that they are legitimate organizations. “Even if Pfizer wants it, there are still many things we would be concerned about,” he said.

Edelson PC sent a letter to counsel at Greenberg Traurig on Wednesday explaining that 23andMe’s plan potentially violated several state laws, including the California Unfair Competition Law and the California Genetic Privacy Act. The letter included several questions such as which threat detection or mitigation tools the defendant had implemented since last year’s data breach.

23andMe wrongly believes that the plaintiff’s counsel has fallen asleep at the wheel, said Wade-Scott. “No company that is facing a lawsuit for historic privacy harm would be so bold as to turn around and say, “We’re going to sell this,’ if it thought it had serious opposition,” the attorney added. He said Friday’s motion makes clear that Edelson PC will fight this plan, adding that it was the only plaintiff’s firm that did not attend the mediation session in January and did not agree to extend case deadlines.

“They’re going out of their way to say, ‘Look, no one else is complaining about this,’ and are moving forward with a plan outside of court that is totally horrifying,” said Wade-Scott.