{"id":1973,"date":"2025-09-23T20:23:00","date_gmt":"2025-09-24T02:23:00","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/?p=1973"},"modified":"2025-09-30T16:50:21","modified_gmt":"2025-09-30T22:50:21","slug":"2-3-million-fine-for-23andme-a-warning-on-weak-authentication-june-2025","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/2025\/09\/23\/2-3-million-fine-for-23andme-a-warning-on-weak-authentication-june-2025\/","title":{"rendered":"\u00a32.3 Million Fine for 23andMe: A Warning on Weak Authentication \u2013 June 2025"},"content":{"rendered":"\n

When most people think of data breaches, they imagine stolen credit cards or leaked emails. But in 2023, DNA testing giant 23andMe<\/strong> exposed something far more intimate: its customers\u2019 genetic information. Fast forward to June 2025, and UK regulators fined the company \u00a32.3 million<\/strong> for failing to protect sensitive genetic data. This included family trees, health reports, and ancestry details belonging to more than 150,000 British residents<\/strong> [1], [4].<\/p>\n\n\n\n

This blog will explore three key issues:<\/p>\n\n\n\n

    \n
  1. Jurisdiction and accountability<\/strong> – how countries can fine companies under data protection laws, regardless of where those companies are headquartered.<\/li>\n\n\n\n
  2. The legitimacy of the fines<\/strong> – why penalties like these are not only allowed but necessary, especially when dealing with data as permanent and personal as DNA.<\/li>\n\n\n\n
  3. Data deletion and prevention<\/strong> – whether it\u2019s truly possible to erase genetic data once shared, and what both companies and individuals can do to better safeguard their accounts against credential-stuffing and weak authentication practices.<\/li>\n<\/ol>\n\n\n\n

    Jurisdiction and Accountability: Why the UK Could Fine, but the US and Canada Could Not<\/strong><\/p>\n\n\n\n

    Although 23andMe is a US-based company, its operations in the UK fall under UK data protection laws (GDPR)<\/strong>, giving the Information Commissioner\u2019s Office (ICO)<\/strong> the authority to fine them. In contrast, the US lacks equivalent federal protection for consumer genetic data. The Health Insurance Portability and Accountability Act (HIPAA<\/strong>) only cover healthcare providers and insurers, not direct-to-consumer DNA companies [3].<\/p>\n\n\n\n

    This creates a sharp divide, while a hospital\u2019s mishandling of genetic data could trigger strict penalties under health law, a consumer genetics company like 23andMe is governed by weaker consumer protection system. These laws do not provide the same enforcement power, leaving regulators with limited ability to impose meaningful fines, even when the compromised data is as sensitive and irreversible as DNA.<\/p>\n\n\n\n

    As Harvard law scholar I. Glenn Cohen explains, when customers share their DNA with a company like 23andMe, \u201cyou are treated by the law essentially as a consumer, not as the patient\u201d [3]. In practice, this means that genetic testing customers do not benefit from the same rights and protections that medical patients receive. The result is a significant regulatory gap, US authorities cannot impose fines even for breaches of highly personal genetic information.<\/p>\n\n\n\n

    Canada faces similar challenges. While its privacy commissioner investigated the breach alongside the ICO, Canadian law (PIPEDA)<\/strong> currently does not allow for monetary penalties [2].<\/p>\n\n\n\n

    PIPEDA vs. GDPR vs. HIPAA: Analysis<\/strong><\/p>\n\n\n\n

    Table 1: Extracted from Digital Samba: How Much Overlap Is There Between GDPR in the EU, HIPAA in the US & PIPEDA in Canada? [7]<\/p>\n\n\n\n

    Aspect<\/strong><\/td>GDPR<\/strong><\/td>HIPAA<\/strong><\/td>PIPEDA<\/strong><\/td><\/tr>
    Jurisdiction<\/strong><\/strong><\/td>EU Member States<\/td>United States<\/td>Canada<\/td><\/tr>
    Applicability <\/strong><\/td>Any organization handling EU data.<\/td>Healthcare providers and plans.<\/td>Private sector organizations.<\/td><\/tr>
    Type of data covered<\/strong><\/strong><\/td>Personal data (names, contacts, financial info, etc.)<\/td>Healthcare data (PHI, records, insurance, payments)<\/td>Personal info (contacts, financial, employment, etc.)<\/td><\/tr>
    Data transfer abroad<\/strong><\/td>Allowed to countries with adequate protection; otherwise SCCs\/BCRs needed<\/td>No direct rules; PHI transfers require BAAs<\/td>Requires consent and disclosure of risks for foreign transfers<\/td><\/tr>
    Personally Identifiable Information (PII) encryption at rest & transit <\/strong><\/strong><\/td> Required<\/td>Requires appropriate safeguards to protect PHI.<\/td>Not explicitly required<\/td><\/tr>
    Controlled access to sensitive data<\/strong><\/td>Mandates controlled access to personal data, especially sensitive data. Requires strict authentication, authorization, and monitoring measures. <\/td>Requires controlled access to protected health information (PHI). Enforces role-based access control through Business Associate Agreements (BAAs). <\/td>Does not specify any specific controls but mandates appropriate security safeguards.  Organizations should control access to sensitive personal information and restrict it to authorized personnel.<\/td><\/tr>
    Data breach notifications <\/strong><\/strong><\/td>72 hours.<\/td>Within 60 days.<\/td>Within a reasonable time frame. <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Why This Fine Was Warranted<\/strong><\/p>\n\n\n\n

    The \u00a32.3m fine against 23andMe is more than a symbolic gesture, it serves as a clear message that companies profiting from sensitive personal data must be held accountable. Genetic information is especially vulnerable because it exposes health risks, ethnic background, and family ties. And unlike a password or credit card, DNA cannot be reset or replaced once it has been compromised [1]. By failing to implement standard security measures, 23andMe exposed millions of customers to identity risks, genetic discrimination, and potential misuse of their most personal data. Regulators were right to act decisively, and the fine was both allowed and warranted.<\/p>\n\n\n\n

    Data Deletion and Prevention: Can You Ever Really Erase DNA?<\/strong><\/p>\n\n\n\n

    In response to the breach, many customers rushed to delete their accounts. But here\u2019s the uncomfortable truth: deleting your data may not fully erase it. While 23andMe allows users to request account deletion through its privacy portal, genetic privacy experts have warned that remnants of anonymized data often remain [3]. And anonymization is not foolproof. Cross-referencing with other datasets can sometimes re-identify individuals.<\/p>\n\n\n\n

    California\u2019s Attorney General has urged residents to delete their data and genetic samples after the company\u2019s financial struggles but acknowledged that deletion might not mean a complete clean slate [3]. For example, users can request full erasure via 23andMe\u2019s privacy portal, but the company warns that some data may still be retained due to legal obligations[3].<\/p>\n\n\n\n

    The Real Cost of Weak Authentication<\/strong><\/p>\n\n\n\n

    The breach itself was made possible by credential stuffing<\/strong>, a common hacking method. Attackers used stolen username and password pairs from unrelated breaches, betting that users had recycled passwords<\/strong> across accounts. This was a topic we explored on a simpler level on day 2 of the course in regard to password hashing and the \u2018reversing\u2019 of a password hash. However, the specific method used by hackers leveraged automated tools to test these logins against 23andMe\u2019s systems until thousands of accounts were compromised [5].<\/p>\n\n\n\n

    As a result, the ICO found that 23andMe failed to enforce even the most basic protections, such as:<\/p>\n\n\n\n