Irish consumers should be concerned about 23andMe entering bankruptcy, according to a data protection expert, even if they never used the genetic testing service.
Yesterday, the US firm secured bankruptcy protection - and will now seek a sale under the supervision of a US court.
Once valued at $6 billion, the company struggled in the face of falling demand in recent years. It is now likely to sell for less than $50m.
Its most attractive asset is its database of roughly 15 million users' DNA samples, which will soon come under ownership of a completely different company.
Daragh O'Brien, CEO of data consultancy firm Castlebridge, says this should be a concern to people here.
"Not only people who use the tests but anyone who's related to them - or might, in the future be related to them by blood, because it's genetic data," Mr O'Brien said.
"One of the key issues here is that, when 23andMe is sold to whoever buys them - there is no guarantee that any of the privacy protections that the proport to have will carry over under the new contract and you've no idea what will happen to your data at that point," he said.
"The data they have is quite sensitive, potentially, and it can identify relationships between people and can identify the likelihood of having different medical conditions," he added.
We need your consent to load this rte-player contentWe use rte-player to manage extra content that can set cookies on your device and collect data about your activity. Please review their details and accept them to load the content.Manage Preferences
The European Union does place obligations on firms in how they handle user data - including its GDPR framework - which 23andMe would have had to comply with in order to sell products in the region.
However the fact that it is ultimately a US company, and this is a US bankruptcy process, will create doubts around how much protection those rules will offer.
"GDPR does apply to them and they would have a European nominated representative," said Mr O'Brien.
"The difficulty is that, as we try and excercise our rights at this point against 23andMe it could get complicated - because they're going to have a tsunami of deletion requests... and if they don't act or respond on that, European regulators will have to enforce against them," he stated.
That is particularly challenging in the current climate, he said.
"It's all tied up in the EU-US Transatlantic Data Privacy Framework - that's basically an agreement between the European Union and the US around mutual enforcement of data protection rules to allow the transfer of data," he said.
"The fundamentals of that agreement have been undermined by the Trump administration, and the Trump administration has been quite hostile in recent weeks to the concept of European regulation on US companies," he said.
"So the practical challenges of actually enforcing against 23andMe, or any successor, if data isn't handled correctly, in line with EU law, are potentially significant."
Users can seek to delete the data 23andMe holds, but their terms and conditions also mean that there is a chance any such attempts will be blocked.
"You can go to 23andMe and delete your data," Mr O'Brien said. "The issue there is 23andMe's privacy policies are quite clear that there are circumstances where they won't delete your data - or they will retain certain data - for various legal obligations".
"One of those legal obligations now, it might be argued, might be not reducing the value of the asset they have - which is the data," he added.
