A litigation boutique based in Oakland, California, representing plaintiffs and defendants in complex civil litigation.
Los Angeles Times Quotes Jo Levy on Privacy Concerns Stemming from 23andMe Bankruptcy
Jo Levy, a partner at The Norton Law Firm, was quoted in an article in the Los Angeles Times titled “‘People Should Be Worried’: 23andMe Bankruptcy Could Expose Customers’ Genetic Data.” The article, published March 29, discusses the bankruptcy filing of the at-home DNA testing company and what will become of the genetic information provided by 15 million customers.
Levy, who has particular experience with web scraping and privacy issues, says for customers based in California, direct-to-consumer businesses that collect and analyze genetic data are regulated by a 2022 law known as the Genetic Information Privacy Act (GIPA), as well as the California Consumer Privacy Act (CCPA). GIPA and CCPA provide consumers with rights to request access to, download and delete their genetic and sensitive personal information.
Yet, Levy says, even these laws have limits. One important limitation to GIPA is that it excludes “de-identified” data from the scope of genetic data that must be deleted upon customer request. De-identified data is not the same as fully anonymized data. While de-identified data removes personally identifiable information that could be used to link the data to a particular individual, it generally leaves open the possibility that someone could use third party sources to re-identify the individuals attached to the data. To protect California consumers from re-identification, GIPA places conditions on its exclusion of de-identified data.
Levy says that if a third party acquires 23andMe, consumers have no guarantee that their de-identified data will not be sold or shared, and their personal identities reattached. However, she tells the Los Angeles Times that consumers should not panic about the fate of their data.
“The fact that they filed for bankruptcy doesn’t mean that tomorrow some nefarious company is going to purchase the data,” Levy says. “There could be many reasons why people would want to maintain their accounts and I would caution people not to overreact.”
The full article can be read at the Los Angeles Times (subscription required).