Canada’s Privacy Commissioner, Philippe Dufresne, and the UK’s Information Commissioner, John Edwards, have initiated a joint investigation into a data breach at 23andMe, discovered in October 2023.
The investigation will assess the extent of the breach at the genetic testing company and evaluate whether 23andMe had adequate safeguards to protect sensitive information. It will also examine if the company properly notified regulators and affected individuals.
Dufresne’s office will collaborate with privacy authorities in Quebec, British Columbia, and Alberta for the Canadian segment of the investigation. No further comments will be made during the inquiry.
The breach, which affected approximately 6.9 million customers, has raised significant concerns about the potential misuse of genetic information. Dufresne emphasized the importance of protecting personal data against malicious attacks, highlighting the risks of surveillance and discrimination.
23andMe, known for its genetic testing kits that provide insights into health, ethnicity, and biological relationships, initially reported the breach in December.
“Ensuring that personal information is adequately protected against attacks by malicious actors is an important focus for privacy authorities in Canada and around the world,” Dufresne stated in a news release.
