Many of 23 and Me’s former customers are asking to have their data and samples deleted or destroyed out of concern that they may be sold during the company’s looming collapse and likely bankruptcy (as of Oct 2024). 23 and Me isn’t making it easy, and one argument they have for retaining data is that medical record retention laws require them to. Below I look at their specific claims and offer a possible way to refute them.
While it’s almost impossible to protect yourself from the predatory market for private data, one can try, especially for things like genetic data, which may be used to limit your future access to healthcare or insurance. This week, the genetic testing company 23 and Me offers an example of how hard getting personal data deleted can be. To be clear 23 and Me as a company isn’t and may never have done anything wrong in any legal sense. What they have done is collected the genetic information of millions of people and then stumbled towards bankruptcy. 23 and Me’s hoard of genetic data is likely their most valuable asset – and it will be sold if it can be.
Customers concerned that their personal genetic information could be sold might think they can demand that information deleted under laws like the GDPR or California Consumer Privacy Act and may have the impression that it’s fairly a simple process where 23 and Me will have to honor your request. It seems like they won’t. At least not completely.
Instead, you may eventually get an email that promises to delete some of your data and then adds this:
“23andMe and our third party genotyping laboratory will retain Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations, including the U.S. Federal Clinical Laboratory Improvement Amendments of 1988 (CLIA), California Business and Professional Code Section 1265, and College of American Pathologists (CAP) accreditation requirements.”
Dying tech behemoths that deal in data are by their nature untrustworthy, but they also tend to be able to afford lawyers. So let’s take a look at 23 and Me’s explanation, it might have some truth to it.
23 and Me are saying that they will retain the genetic information, date of birth, and sex as required under various laws – basically they’re getting rid of all your data except for the part that matters … they have to keep that for important legal reasons. So what laws are involved here and what do they say?
The first law cited is the US Clinical Laboratory Improvement Amendments of 1988. While 23 and Me does not cite the specific code sections involved, and CLIA is a substantial document, my guess is that they are using the retention requirements for test data as the basis of their claim. These, after removing some subsections for to save space are:
USC Title 42 (Public Health), Chapter IV, Subchapter G, Section J, § 493.1105 Standard: Retention requirements.
(a) The laboratory must retain its records and, as applicable, slides, blocks, and tissues as follows:
(1) Test requisitions and authorizations. Retain records of test requisitions and test authorizations, including the patient’s chart or medical record if used as the test requisition or authorization, for at least 2 years.
[…]
(6) Test reports. Retain or be able to retrieve a copy of the original report (including final, preliminary, and corrected reports) at least 2 years after the date of reporting. In addition, retain the following:
[…]
(ii) Pathology test reports for at least 10 years after the date of reporting.
(7) Slide, block, and tissue retention —
(i) Slides.
(A) Retain cytology slide preparations for at least 5 years from the date of examination (see § 493.1274(f) for proficiency testing exception).
(B) Retain histopathology slides for at least 10 years from the date of examination.
(ii) Blocks. Retain pathology specimen blocks for at least 2 years from the date of examination.
(iii) Tissue. Preserve remnants of tissue for pathology examination until a diagnosis is made on the specimen.
I won’t go through this line by line, but it’s simple: the law requires medical laboratories to retain some testing data and materials for various lengths of time, often 2 years, but as long as 10 years for some kinds of test. This will be a theme we return to in the other regulations 23 and Me cites, such as this, the next item on their list:
California Code, Business and Professions Code – BPC § 1265
(2)(A) Notwithstanding any other provision of law, owners and laboratory directors of all clinical laboratories, including those laboratories that cease operations, shall preserve medical records and laboratory records, as defined in this section, for three years from the date of testing, examination, or purchase, unless a longer retention period is required pursuant to any other provision of law, and shall maintain an ability to provide those records when requested by the department or any duly authorized representative of the department.
Once again I think this is the subsection 23 and Me might be referring to and it says that medical laboratories have to retain customer medical records and lab testing data to comply with California’s regulations. They have to keep it for three years unless some other law says they need to keep it longer.
Finally, there’s professional requirements from the College of American Pathologists. These are also laboratory record retention requirements, and I won’t reproduce them here, because they amount to “[M]eet or exceed the regulatory requirements specified in the Clinical Laboratory Improvement Amendments of 1988 (CLIA 88).”
An attractively formatted list of the recommendations can be found on the CAP website.
So, 23 and Me argues that it gets to keep your genetic data because the law requires it … and it does … assuming 23 and Me is a medical laboratory and that data isn’t too old. Ironically 23 and Me has been able to avoid regulations like HIPAA because it is not a healthcare provider, but now 23 and Me is hiding behind health care regulations to protect its assets. Yet, 23 and Me offers a plausible argument, except that the regulations aren’t as far reaching as they might like, because the laws only require data retention for a limited time, and only from medical laboratories.
To me this raises a couple questions.
First, is 23 and Me a medical laboratory?
The email doesn’t make this claim and instead says that both “23andMe” and their “third party genotyping laboratory” are required to keep the data. Even accepting the argument that laboratory regulation requires a lab to keep the customer … I mean patient … data here, the email seems to say two entities are doing so the 23 and Me Holding Co. (or something like that, it’s complex) and some laboratory that they may or may not own. Obviously a holding company, data brokerage, or direct-mail genealogy company shouldn’t be able to hide behind the licensing requirements of a medical laboratory.
Second, how long have they been holding the data?
23 and Me is going bankrupt, largely because most of its customers used it once, found out their ancestry was 2-12% from somewhere unexpected and then forgot about it. I suspect the majority of customers did so more than 3 years ago, and many of them more than 10 years ago. While there are a couple categories of patient data that the CAP guidelines say should be retained for longer periods (such as data from forensic autopsies) it’s reasonable to argue that the CLIA and California retention requirements shouldn’t apply to you if you sent your sample in to 23 and me before 2020.
If I were to respond to 23 and Me’s email I’d say something along these lines.
“Thank you for providing your reasons for retaining my medical, genetic, and personal information despite my request to delete or destroy them. I recognize 23 and Me’s commitment to comply with appropriate laws, but do not believe that the statutes cited apply in this matter.
It is unclear to me that the company “23 and Me” is a medical laboratory within the meaning of any statute or accreditation process. The listed patient data retention laws and guidelines would only apply to the extent that it is such a laboratory. However, even if 23 and Me or its subsidiaries fall under medical laboratory regulation, my tests and associated personal information were submitted [in “year” or “prior to 2015”] and it is my belief that they are no longer subject to retention requirements under the regulations noted in your above correspondence.
As we are in agreement that there is no legal reason to retain my personal information beyond these inapplicable regulatory requirements, please delete or destroy all testing data, samples, and other personal information 23 and Me currently holds per my previous request.
I don’t know if this response will work so adding “govern yourself accordingly” would be excessive. 23 and Me were vague on the details in their email, so it’s not impossible they’re being being entirely forthright. 23 and Me may really have laboratory licensing requirements for some subset of its customer data that prevent it from deleting it. On the other hand their claims seem pretty suspect and 23 and Me has strong incentives to retain customer genetic data.
If you’re trying to get 23 and Me to delete your genetic testing information then I wish you luck, it’s likely to be a struggle, but when companies cite a list of statutes justifying themselves don’t give up, it’s usually not too complex and if enough people complain some regulator may notice and decide to do something, or the company may relent.
Leave a Reply