加州总检察长与23andMe达成600万美元和解 消费者可要求删除基因数据、销毁样本
奥克兰——加州总检察长 Rob Bonta 10月19日宣布，已与 Chrome Holding Co.（即原 23andMe）达成 600 万美元和解。该和解已提交美国密苏里东区破产法院，尚待法院批准。和解了结了加州方面的指控：23andMe 未能保护客户的个人信息与基因数据，导致 2023 年发生数据泄露事件；同时也了结了 Bonta 就破产程序中未经加州人明确同意出售其基因信息与样本一事所提异议遭驳回后的上诉。受影响消费者仍保留要求公司删除其信息、销毁其样本的权利。
Bonta 在声明中说：「23andMe 收集了数百万人的基因数据，却没有尽到保护这些信息安全的义务。企业不能通过申请破产来逃避加州的消费者保护与隐私法律。」他同时表示：「我想提醒加州人，23andMe 的客户可以删除自己的私人基因数据——无论公司归谁所有。」
23andMe 创办于旧金山，是全球第一家、也是规模最大的直面消费者的基因检测公司之一。客户将唾液样本寄送公司进行 DNA 分析，公司保存客户的原始 DNA 序列数据，并据此提供血统、族裔与遗传健康倾向等报告。2023 年的数据泄露波及全球约 690 万名客户。
总检察长办公室在公布和解的同时说明了加州消费者的删除权利：依据加州《基因信息隐私法》，消费者可要求直面消费者的基因检测公司删除或销毁其保存的个人数据。就 23andMe 而言，删除基因数据的步骤为：登录 23andMe 网站账号，进入个人资料的「设置」（Settings），滚动到页面底部的「23andMe Data」栏目并点击「View」；如需留存副本可先下载数据，然后滚动到「Delete Data」栏目，点击「Permanently Delete Data」，再按公司发来的确认邮件中的链接确认请求。若此前选择由公司保存唾液样本与 DNA，可在账号设置的「Preferences」中更改偏好、要求销毁样本；若此前同意将基因数据用于研究，可在设置页的「Research and Product Consents」中撤回同意。
California AG Secures $6 Million Settlement with 23andMe; Consumers Keep Right to Delete Genetic Data
OAKLAND — California Attorney General Rob Bonta announced on October 19 that he has secured a $6 million settlement with Chrome Holding Co., formerly known as 23andMe. The settlement, filed in the U.S. Bankruptcy Court for the Eastern District of Missouri and pending court approval, resolves allegations that the company failed to protect its customers' personal information and genetic data, resulting in a 2023 data breach. It also resolves Bonta's appeal from the denial of his objection, under California law, to the sale of Californians' genetic information and samples in the bankruptcy without their affirmative consent. Affected consumers retain the right to request deletion of their information and destruction of their samples.
"23andMe collected genetic data about millions of people and failed to meet its obligation to keep that information safe. Companies cannot evade California's consumer protection and privacy laws by filing for bankruptcy," Bonta said. "I want to remind Californians that customers of 23andMe can delete their private, genetic data — no matter who owns it."
Founded in San Francisco, 23andMe was the first and one of the largest direct-to-consumer genetic testing companies in the world. Customers mailed in saliva samples for DNA analysis, and the company stored raw DNA sequence data to provide ancestry, ethnicity and genetic health reports. The 2023 breach exposed the data of about 6.9 million customers worldwide.
The Attorney General's Office also outlined Californians' deletion rights under the state's Genetic Information Privacy Act. To delete genetic data from 23andMe, consumers log into their account, go to Settings, scroll to the "23andMe Data" section, click "View," optionally download a copy of their data, then scroll to "Delete Data," click "Permanently Delete Data," and confirm via the link in the company's email. Consumers who previously opted to store a saliva sample can change that preference under "Preferences" in account settings, and research consent can be revoked under "Research and Product Consents."
发布：GSM·美国（发布链接）
图片来源：DNA双螺旋结构示意图（资料图）。公共领域图片，经 Wikimedia Commons 发布。
GSM Global · 本篇英文版 English edition of this story
