23andMe customers delete their data and thus overburden IT

Following the insolvency of the genetic analysis company 23andMe, customers want to have their data deleted. But that doesn't seem to be so easy.

The company, which recently filed for bankruptcy, has over twelve million customers. They have sent in a saliva sample for the company to analyze their genetic material. Many are worried about what will happen to their data after the sale of 23andMe, and in whose hands it will end up.

They therefore want to delete their data. However, 23andMe's systems appear to be overwhelmed by this. According to the BBC, the company is having difficulties fulfilling deletion requests.

Problems logging in

Two customers from the USA told the BBC that they had difficulties logging into their account. They had to try to log in several times. One of them was asked to use two-factor authentication. However, she only received the verification code hours later.

The company stated that it had now solved the problems caused by the increased data traffic. If users had problems accessing their account or deleting their data, they could contact customer service, a 23andMe spokesperson told the BBC.

One customer said she had to wait two hours before she could speak to an advisor. Both US customers were able to delete their data, but are skeptical that this actually happened.

One said she was worried that 23andMe would keep the data. The other fears that her data will be sold when the company is sold, for example to a health insurance company, even if the company's current data protection rules rule this out.

23andMe retains data despite deletion

Their concerns are not unjustified: Even after an account is deleted, 23andMe retains some genetic data, along with the individual's date of birth and gender, in order to comply with legal obligations, as the company explains.

When it became known that the company would be filing for bankruptcy protection, California Attorney General Rob Bonta pointed out that citizens of his state have the right to have their data deleted. This also applies to customers from Europe, as 23andMe is subject to the General Data Protection Regulation (GDPR). They can also request that the genetic material in the company's possession be destroyed.

It is planned that 23andMe will be auctioned off on May 14. Bonta also fears that the company's genetic material will then fall into foreign hands. It would not be the first time: in 2023, it became known that cyber criminals had gained access to 23andMe's systems and copied customer data. This was later offered for sale on the darknet.

(wpl)