CNIL Advises on Deletion of Personal Data from 23andMe

Genetic testing companies collect a great deal of data contained in people's genomes, including ethnic origin, physical characteristics such as eye color, and data on a person's state of health or predisposition to certain diseases, CNIL said. They also gather identity data and contact details such as names and emails. Additional data is sometimes collected via questionnaires on people's marital relationships, life events such as deaths and marriage, food tastes, and health data.

The biggest concerns about the conduct of genetic tests are the confidentiality of the data and control of its dissemination. That risk increases as genetic data may affect people who haven't been tested but who share the genes of the person who has, and who have neither consented to nor been informed of the testing.

Genetic testing in France is highly supervised, CNIL said. Such tests can only be carried out in the context of a judicial investigation for medical care or for research purposes. Except in very specific situations, individual consent is needed.

Numerous laws and codes strictly supervise genetic analysis and prohibit "recreational" genetic tests, even with a user's consent. Buying a genetic test on the internet is punishable by a fine. Carrying out a genetic test outside medical and scientific fields is also barred, and is subject to fines and one year in prison.

The regulator listed several actions people can take to ensure their data is deleted. These include permanently deleting their data from the 23andMe website; permanently deleting all records from the website (thus deleting their account); requesting the destruction of their saliva samples; and withdrawing their consent to the use and sharing of their data for research.

Democratic and Republican state AGs and the U.K. Information Commissioner's Office have also issued warnings about the situation (see 2503240046).