23andMe GSK Pharma Data Deal: Genetic Data Shared with Drug Giant

23andMe entered a $300 million partnership with pharmaceutical giant GlaxoSmithKline, sharing aggregated genetic data from millions of customers to aid drug development. While 23andMe stated the data was shared in aggregate form without individual identifiers, privacy experts questioned whether genetic data can ever be truly anonymized given its uniquely identifying nature. The partnership meant that customers who submitted DNA for ancestry and health reports unknowingly contributed to pharmaceutical research and drug target identification. 23andMe's consent framework allowed data sharing through broad terms in its privacy policy rather than specific consent for pharmaceutical partnerships. Critics argued that many customers who spit in a tube for fun ancestry results did not meaningfully consent to their genetic data being used for commercial drug development. The deal demonstrated how consumer genetic testing companies monetize DNA databases as a secondary revenue stream, creating financial incentives to collect and retain as much genetic data as possible.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.