Regeneron Pharmaceuticals has purchased genetic testing company 23andMe for $256 million. The sale also includes 23andMe’s customer genetic data, and the genetic testing firm will continue its consumer genome services as usual. However, the process is currently subject to bankruptcy court and regulatory approvals.
Regeneron’s interest in 23andMe is rather obvious. The company already provides personalised medical services and holds its own genetic data of nearly three million customers. 23andMe’s additional 15 million customers significantly expand Regeneron’s genetic data pool, and will likely aid in the company’s operations of inventing, developing, and monetising life-transforming drugs.
However, this raises the question of customer data misuse. While genetic data is far more sensitive than medical records protected under HIPAA, 23andMe’s genetic data is mostly covered under consumer data protection and privacy laws, a far cry from HIPAA’s robust data protection laws.
Regeneron’s announcement of the sale claims that the company is prepared to “detail the intended use of customer data and the privacy programs and security controls in place for review by a court-appointed, independent Customer Privacy Ombudsman and other interested parties.”
For now, customers still have the option of permanently deleting their genetic data from 23andMe’s servers. If you’ve opted to have your saliva sample and DNA stored by 23andMe, the option to destroy it also also currently open. Finally, customers can also revoke permissions to have their genetic data be used for research.
23andMe going bankrupt was always bad news for customer data. The company has also suffered a data breach in 2023, leaking sensitive data of nearly 4 million people.
However, Regeneron’s purchase of the company will put US politicians at ease over their fears of this genetic testing data falling into the hands of foreign adversaries. There’s still a chance that data from the 2023 breach might fall into the wrong hands, but at the moment Regeneron does seem intent on protecting it, albeit likely for its own interests.
In the News: UK legal aid data until 2015 stolen; Millions at risk
