The genetic testing company 23andMe has recently been the target of a data breach. The business uses the customer’s genetic data to create customized reports that include details on the customer’s ancestry composition, genetic health risks, and carrier status for specific inherited conditions (Carballo et al., 2024). The 23andMe data breach happened over five months, from late April 2023 to September 2023 (Carballo et al., 2024).
Nearly 7 million customer profiles were accessed by hackers, revealing private genetic data (Carballo et al., 2024). The hacker’s dissemination and sale of specially curated lists of genetic data on the dark web, particularly targeting individuals of Ashkenazi Jewish and Chinese descent, raises significant ethical concerns surrounding privacy, consent, and the potential exploitation of sensitive personal information.
Legally speaking, the incident raises serious doubt about whether privacy and data protection laws have been complied with. Businesses such as 23andMe operate in a regulatory environment that requires the protection of sensitive personal data. According to the lawsuit, 23andMe is accused of negligence for failing to stop the breach and promptly notify affected customers (Carballo et al., 2024).
The 23andMe data breach also reveals serious ethical failings, with the ethical foundation of trust at the center of this problem. Clients trust 23andMe with the most personal genetic data, yet 23andMe betrays that trust by failing to take appropriate security measures for this data, thereby jeopardizing the very basis of its customer relationship.
The hack also raised broader privacy concerns, as technological developments have enabled companies to obtain unprecedented access to personal data. Namely, the 23andMe hack has prompted experts to speak out about the lack of robust ethical frameworks for collecting, storing, and disseminating private information (Carballo et al., 2024). In the future, companies need to give equal weight to legal and ethical requirements to guarantee the responsible and fair use of data in a world that is growing more interconnected by the day.
Reference
Carballo, R., Schmall, E., & Tumin, R. (2024). 23andMe breach targeted Jewish and Chinese customers, lawsuit says. The New York Times.