Ayanna Pressley Asks 23andMe Founder: Can De-Identified Genetic Data Be Linked Back To Individuals?

Forbes Breaking News

During Tuesday’s House Oversight Committee hearing, Rep. Ayanna Pressley (D-MA) questioned Anne Wojcicki, Founder and Board Member of 23andMe, Inc., about de-identified genetic data.

Transcript

00:00from Massachusetts. Ms. Wojcicki, you claimed that 23andMe is all about

00:10consumer empowerment, but most people ended up actually exploited, not knowing

00:15that they signed up to have their genetic data auctioned off to the

00:18highest bidder. We're not just talking about email addresses, we're talking

00:21about names, birth dates, genetic lineages, literal DNA, data that

00:27implicates entire families, not just the person who gave the sample.

00:32Ms. Wojcicki, can genetic data, even if de-identified, be linked back to

00:38individuals?

00:39Ms. I appreciate that question. Could genetic data be linked back to

00:47individuals? You would, you can link back. Your DNA is your DNA. If I have a way of

00:57matching it to something that potentially connects to you, then you could

01:00potentially identify.

01:01Ms. So the answer is yes. The answer is yes. The genetic data, even if

01:08de-identified, can be linked back to individuals, just the science.

01:12Ms. Well, to, no, DNA, if I had your sample, essentially if I know what your picture

01:19looks like and I see another picture, I can connect those. But just having your DNA

01:24alone, if I just went to the subway and I swabbed it and I looked at samples, I would

01:30not be able to identify who was there.

01:32Ms. I don't have much of it. There's a lot of ground I need to cover here.

01:36And so I want a more direct question here. So I'm going to go to Ms. Hu. Is de-identified

01:41genetic data truly anonymous or can it be traced back to individuals? Ms. Hu.

01:47Ms. Thank you so much, Congresswoman. I'm not a scientific expert on that exactly, but there has been

01:54research on the limits of de-identification and also the risks of re-identification.

01:59Ms. All right. Fair enough. Yes. It absolutely can. With just a few pieces of additional information,

02:05like zip codes, gender, or 23ME's find your relative feature, it becomes easy to re-identify

02:13people and to expose their personal health information. 23ME's privacy agreement talks about anonymous

02:20data, but DNA can never truly be anonymous. That is the point. Now, Ms. Wojcicki, you said a limited

02:27number of customers were compromised by the data breach, but the truth of the matter is that out of

02:32the 15 million people who trusted this company, half of them, 7 million, had their data exposed. So that's not

02:43inconsequential. It's deeply consequential. And now that same data can be sold off to a for-profit

02:50pharmaceutical company so you can understand why people are rushing to delete their accounts. But the

02:55thing is, when people have tried to log in and delete their data, they received error messages and then the

03:00website crashed. That is not okay. Your company is preventing people from deleting their information.

03:09Mr. Sel Savage, it's time to put people first. Will you contact each of your customers seeking

03:16consent for 23ME to continue holding their data? Yes or no?

03:20A simple opt-in communication that you send out before any bankruptcy sale. I want to really

03:26underscore that. Congresswoman, we first have sent a notice out to all of our customers via email

03:32via email, notifying them of the sale, and that we, a second email is currently going out this week,

03:39notifying that their sale is happening. Mr. Sel Savage, reclaiming my time. Please just answer the question

03:43yes or no. Okay? Will you commit to contacting each of your customers seeking consent for 23ME to continue

03:50holding their data? This should be a simple opt-in communication that you send out before any bankruptcy sale.

03:58Yes or no? Congresswoman, it's not that simple. We believe we've already received that since then.

04:03Why not? These people are deserving of this, you know, these assurances and this insurance.

04:07They're, they're already, they've been violated in so many ways here.

04:11Ms. Wojcicki, will you amend your bid to commit to a similar consent requirement then?

04:17I don't believe I can talk extensively about my bankruptcy, about the, the bid, but I can say in the past,

04:23for example, when we did the GSK partnership, we proactively communicated with all customers with that link.

04:29I know that. I know that. I know that. I know that. It's not good enough. It's not good enough. It is just not good enough.

04:37People trusted you with their more personal information. Show them you respect them.

04:42They do not need your apologies anymore. And they don't need your sympathy. What they need is legal protection.

04:49So if you're not able to protect the 15 million people and their families who trusted you, this company should not exist.

04:57The breach of data, the breach of civil liberties, the confusion this has caused for millions, it might just be time to give it up.

05:04I yield back.

05:09Chair, no recognizing.

Category

Transcript

Recommended