There is no way to know what a buyer will want to do with the reams of genetic information it has collected. Customers, meanwhile, still have no way to change their underlying genetic data.
What I meant is that “this Privacy Statement will apply to your Personal Information as transferred to the new entity”, so by itself the sale of assets is not a reason to exclude any data from anything stated there.
I am deleting my account as soon as I get transferred all the data, but what happens when I request the deletion is still valid whether or not they sold the assets.
Thanks for the link. We may be slightly speaking past each other. On one hand, the link you sent is of course, correct. I had read that before and is not that I did not believe that the GDPR would include it, more so on not fully trusting 23andMe to comply.
What you may be overlooking is that in the real world, possible buyers will have access to data as part of any Due Diligence terms, whether they purchase or not. In a perfect world it should not change things but in practice it can, or does. Apparently, that bit I quoted earlier was a very recent update to their T&Cs, as they are protecting themselves for any future lawsuits. Also, I just do not trust 23andMe to have your best interest at heart and to fully comply with privacy issues at the current time, either due to willful BS or mistake. It might just not be a priority. The whole thing could collapse tomorrow, but they are still full on taking people’s money. Any promise of compliance are just words at this point. I have known enough large companies collapse to see this as no different. GDPR or not. On a privacy concern, is not as if they asked everyone who is blood related for any consent, either.
This was releseased not to long ago, so the USA Feds are not really confident, either:
But on paper, I agree that Europeans seem to have sturdier protections. Albeit Americans may have more legal options. Cheers and hope they fully delete your data without any BS.
I take the (you may call it Stoic) decision not to think about what I cannot affect.
23andMe is not a good company, it is tied to Google etc. and they are sloppy with security.
I am not even trying to justify myself not taking my data away from there earlier, that is my fault, and I have been stupid and lazy.
That said, their Privacy Statement is quite clear about what should happen and none of the exception listed there apply, also because genetic data is anyway Art. 9 data.
I will act at the best of my possibilities and not concern myself more than needed with how bad of an actor anyone may be in the US (it is a bit overwhelming as an exercise, especially nowadays).
What I meant is that “this Privacy Statement will apply to your Personal Information as transferred to the new entity”, so by itself the sale of assets is not a reason to exclude any data from anything stated there.
I am deleting my account as soon as I get transferred all the data, but what happens when I request the deletion is still valid whether or not they sold the assets.
And genetic data of any kind is absolutely covered by GDPR: https://gdpr-info.eu/recitals/no-34/
Thanks for the link. We may be slightly speaking past each other. On one hand, the link you sent is of course, correct. I had read that before and is not that I did not believe that the GDPR would include it, more so on not fully trusting 23andMe to comply.
What you may be overlooking is that in the real world, possible buyers will have access to data as part of any Due Diligence terms, whether they purchase or not. In a perfect world it should not change things but in practice it can, or does. Apparently, that bit I quoted earlier was a very recent update to their T&Cs, as they are protecting themselves for any future lawsuits. Also, I just do not trust 23andMe to have your best interest at heart and to fully comply with privacy issues at the current time, either due to willful BS or mistake. It might just not be a priority. The whole thing could collapse tomorrow, but they are still full on taking people’s money. Any promise of compliance are just words at this point. I have known enough large companies collapse to see this as no different. GDPR or not. On a privacy concern, is not as if they asked everyone who is blood related for any consent, either.
This was releseased not to long ago, so the USA Feds are not really confident, either:
oag.ca.gov/news/press-releases/attorney-general-bonta-urgently-issues-consumer-alert-23andme-customers
ag.ny.gov/press-release/2025/attorney-general-james-urges-23andme-customers-contact-company-delete
But on paper, I agree that Europeans seem to have sturdier protections. Albeit Americans may have more legal options. Cheers and hope they fully delete your data without any BS.
I take the (you may call it Stoic) decision not to think about what I cannot affect. 23andMe is not a good company, it is tied to Google etc. and they are sloppy with security. I am not even trying to justify myself not taking my data away from there earlier, that is my fault, and I have been stupid and lazy.
That said, their Privacy Statement is quite clear about what should happen and none of the exception listed there apply, also because genetic data is anyway Art. 9 data.
I will act at the best of my possibilities and not concern myself more than needed with how bad of an actor anyone may be in the US (it is a bit overwhelming as an exercise, especially nowadays).
Fair take.