'You Seem A Bit Naive': Marsha Blackburn Confronts 23andMe CEO Over China's Threat To DNA Data

yesterday

At today's Senate Judiciary Committee hearing, Sen. Marsha Blackburn (R-TN) questioned interim 23andMe CEO Joseph Selsavage.

Transcript

00:00Congratulations for that.

00:02Senator Blackburn.

00:04Thank you, Mr. Chairman.

00:08Mr. Self-Salvage, I want to ask you, let me say this.

00:14We all know that China is hard at work trying to build a virtual you of each and every one of us.

00:21And this is why we need to have a federally preemptive online privacy law, which we do not have.

00:29And whether it's 23andMe and genetic information or whether it is data security, this is something that we need.

00:39But you seem a bit naive to think that you haven't had any breaches or any attacks, cyber attacks.

00:49Our critical infrastructure in this country is hit many times a day.

00:54So what I want you to do, and you can submit this in writing, is to go into detail about how you anonymize and how you mask consumers and their information.

01:10And you can submit that during the QFR period.

01:14But I think it's important that you lay this out so that individuals know what level of protection that they are going to have.

01:25You all may sell, and then there may be an immediate buyer.

01:30You sold to 23andMe.

01:32You thought that would be a longer term relationship.

01:35It's not.

01:36And then there may be three or four subsequent buyers.

01:40So some certainty and some awareness would be a good thing, and I want that in writing.

01:47Senator, thank you for that.

01:49And, you know, I'll take that back to our team as well.

01:53I do want to note that, you know, I am clearly aware that, you know, basically there are many cyber security threats.

02:03And at 23andMe, security and our customers' privacy is top of mind.

02:08And, you know, basically we, you know, at 23andMe, do have cyber security threats from our foreign adversaries and others.

02:18And I will take your concerns back.

02:21I thank you for that clarification, because we deal with that issue repeatedly and the severe threats that exist each and every day.

02:31Okay, Mr. Klein, I want to come to you.

02:35But talking about a privacy standard, there are some states, including my state of Tennessee, who have stepped forward.

02:44And Tennessee in 2023 enacted the Genetic Information Privacy Act.

02:51That requires companies to protect consumer private information and to provide them with the ability to access their data,

03:00to delete their data and their account, and to destroy their biological sample.

03:06However, not all Americans enjoy this protection.

03:10So, in that regard, is the Tennessee law a model for moving forward?

03:17Well, I haven't studied that law closely, Senator, but it certainly sounds appealing to me as a citizen, as a consumer.

03:23I've been following the saga of the general federal privacy law that everyone seems to want for many years now.

03:29And the committee understands better than I do the challenges that have arisen in coming to an agreement on something that everybody seems to want.

03:37I think what the bill that Senator Cornyn and the other members have introduced demonstrates, and the Tennessee bill, is that even as we wait for a general law,

03:46there's possibility of making progress on sector-specific issues.

03:49And in my testimony, I highlighted some of the very good things that the committee and other parts of the Congress has done on this specific threat from hostile foreign actors.

03:57And I do think, to Congress's credit, we've tightened that up considerably in the past few years.

04:03Mr. Selsavage, the Tennessee Attorney General issued a statement after you all filed for bankruptcy,

04:12issued a statement notifying Tennesseans of their right, pardon me, to request a deletion.

04:22So, talk to me about how you were moving forward with these deletion requests.

04:29At 23andMe, any one of our customers at any time can delete their data.

04:35For our customers, it's a simple process.

04:38All they need to do is log into their account at 23andMe, go to their settings, and request their account to be deleted.

04:46That process is automatic.

04:48We do ask for their date of birth, just as an additional verification measure.

04:53And we've complied with those deletion requests and over, you know, through, you know, through the bankruptcy process and prior to that.

05:02And when they delete their account, they are also deleting their biological sample.

05:08Is that correct?

05:10If a customer has consented for us to biobank their saliva sample, we will also delete and destroy that saliva sample upon their request to delete their data.