23andMe under investigation for potential data breach

A joint investigation into a data breach at DNA testing company 23andMe has been launched by the UK and Canada data protection watchdogs. The Information Commissioner’s Office (ICO) and the Office of the Privacy Commissioner of Canada (OPC) announced the investigation into the October 2023 incident. 23andMe is a US-based genetics company that analyses its customers’ DNA through home saliva collection kits to provide insights on factors such as health and ancestry. According to the company’s website, it has sold more than 12 million DNA testing kits since 2006. The UK and Canadian data protection regulators said they will combine their expertise and resources to jointly conduct the investigation. This data breach had an international impact, and we look forward to collaborating with our Canadian counterparts to ensure the personal information of people in the UK is protected. The ICO said: “23andMe is a custodian of highly sensitive personal information, including genetic information which does not change over time. “It can reveal information about an individual and their family members, including about their health, ethnicity, and biological relationships. “This makes public trust in these services essential.” UK Information Commissioner John Edwards said: “People need to trust that any organisation handling their most sensitive personal information has the appropriate security and safeguards in place. “This data breach had an international impact, and we look forward to collaborating with our Canadian counterparts to ensure the personal information of people in the UK is protected.” Privacy Commissioner of Canada Philippe Dufresne said: “In the wrong hands, an individual’s genetic information could be misused for surveillance or discrimination. “Ensuring that personal information is adequately protected against attacks by malicious actors is an important focus for privacy authorities in Canada and around the world.” In a statement, 23andMe said: “23andMe acknowledges the joint investigation announced by the Privacy Commissioner of Canada and the UK Information Commissioner today.