During Tuesday’s House Oversight Committee hearing, Rep. Ayanna Pressley (D-MA) questioned Anne Wojcicki, Founder and Board Member of 23andMe, Inc., about de-identified genetic data.
Category
🗞
NewsTranscript
00:00from Massachusetts. Ms. Wojcicki, you claimed that 23andMe is all about
00:10consumer empowerment, but most people ended up actually exploited, not knowing
00:15that they signed up to have their genetic data auctioned off to the
00:18highest bidder. We're not just talking about email addresses, we're talking
00:21about names, birth dates, genetic lineages, literal DNA, data that
00:27implicates entire families, not just the person who gave the sample.
00:32Ms. Wojcicki, can genetic data, even if de-identified, be linked back to
00:38individuals?
00:39Ms. I appreciate that question. Could genetic data be linked back to
00:47individuals? You would, you can link back. Your DNA is your DNA. If I have a way of
00:57matching it to something that potentially connects to you, then you could
01:00potentially identify.
01:01Ms. So the answer is yes. The answer is yes. The genetic data, even if
01:08de-identified, can be linked back to individuals, just the science.
01:12Ms. Well, to, no, DNA, if I had your sample, essentially if I know what your picture
01:19looks like and I see another picture, I can connect those. But just having your DNA
01:24alone, if I just went to the subway and I swabbed it and I looked at samples, I would
01:30not be able to identify who was there.
01:32Ms. I don't have much of it. There's a lot of ground I need to cover here.
01:36And so I want a more direct question here. So I'm going to go to Ms. Hu. Is de-identified
01:41genetic data truly anonymous or can it be traced back to individuals? Ms. Hu.
01:47Ms. Thank you so much, Congresswoman. I'm not a scientific expert on that exactly, but there has been
01:54research on the limits of de-identification and also the risks of re-identification.
01:59Ms. All right. Fair enough. Yes. It absolutely can. With just a few pieces of additional information,
02:05like zip codes, gender, or 23ME's find your relative feature, it becomes easy to re-identify
02:13people and to expose their personal health information. 23ME's privacy agreement talks about anonymous
02:20data, but DNA can never truly be anonymous. That is the point. Now, Ms. Wojcicki, you said a limited
02:27number of customers were compromised by the data breach, but the truth of the matter is that out of
02:32the 15 million people who trusted this company, half of them, 7 million, had their data exposed. So that's not
02:43inconsequential. It's deeply consequential. And now that same data can be sold off to a for-profit
02:50pharmaceutical company so you can understand why people are rushing to delete their accounts. But the
02:55thing is, when people have tried to log in and delete their data, they received error messages and then the
03:00website crashed. That is not okay. Your company is preventing people from deleting their information.
03:09Mr. Sel Savage, it's time to put people first. Will you contact each of your customers seeking
03:16consent for 23ME to continue holding their data? Yes or no?
03:20A simple opt-in communication that you send out before any bankruptcy sale. I want to really
03:26underscore that. Congresswoman, we first have sent a notice out to all of our customers via email
03:32via email, notifying them of the sale, and that we, a second email is currently going out this week,
03:39notifying that their sale is happening. Mr. Sel Savage, reclaiming my time. Please just answer the question
03:43yes or no. Okay? Will you commit to contacting each of your customers seeking consent for 23ME to continue
03:50holding their data? This should be a simple opt-in communication that you send out before any bankruptcy sale.
03:58Yes or no? Congresswoman, it's not that simple. We believe we've already received that since then.
04:03Why not? These people are deserving of this, you know, these assurances and this insurance.
04:07They're, they're already, they've been violated in so many ways here.
04:11Ms. Wojcicki, will you amend your bid to commit to a similar consent requirement then?
04:17I don't believe I can talk extensively about my bankruptcy, about the, the bid, but I can say in the past,
04:23for example, when we did the GSK partnership, we proactively communicated with all customers with that link.
04:29I know that. I know that. I know that. I know that. It's not good enough. It's not good enough. It is just not good enough.
04:37People trusted you with their more personal information. Show them you respect them.
04:42They do not need your apologies anymore. And they don't need your sympathy. What they need is legal protection.
04:49So if you're not able to protect the 15 million people and their families who trusted you, this company should not exist.
04:57The breach of data, the breach of civil liberties, the confusion this has caused for millions, it might just be time to give it up.
05:04I yield back.
05:09Chair, no recognizing.