What the Fall of 23andMe Means for Personalised Genetic Testing Companies

American direct-to-consumer (DTC) genetic testing company 23andMe filed for bankruptcy last week, sending shock waves among supporters of personalised genetic testing. The fall of 23andMe is significant for many reasons, including its implications for India.

The revolution in genomic testing began well before the unveiling of the human genome sequencing results in 2000. Around 1990, two independent groups developed microarray technology to analyse whole genomes on solid surfaces. With DNA microarray technology, scientists gained the ability to examine individual whole genomes, identify nucleotide-level differences, and designate some of the genetic variations as potentially disease-causing.

Many saw an opportunity – using microarrays and later next-generation sequencing – to predict ancestry and provide individual risk assessment for certain diseases. While tracing ancestry and constructing genetic genealogies using DNA markers was innocuous, predicting risks for future diseases turned out to be far more complex and controversial.

Against this backdrop, companies like 23andMe emerged. While 23andMe became the most well-known player in this space, it was not the first to popularise consumer genetic testing. That distinction belongs to deCODE genetics in Iceland. With its product deCODEme, it pioneered personal genomics services and, by leveraging Iceland’s meticulously maintained genealogy and medical registry, sought to link genetic variants with disease risks.

DTC genetic testing companies use customers’ DNA, isolated from saliva or cheek swabs, to provide ancestry and genealogical information. Had 23andMe stopped there, it might have remained a successful DTC genetic testing business. However, it went further – offering potential health risk assessments based on individuals’ genetic makeup.

The key issue with 23andMe and similar companies lies in the lack of sufficient clinical utility of their tests. Long before 23andMe, deCODEme (whose parent company was later acquired by Amgen) faced similar challenges. Scientists realised that predicting health risks from genetic data – especially for common and complex diseases – is far from straightforward. These diseases are multifactorial, with genetic contributions accounting for only part of the overall risk. Despite this, some companies continued to provide risk scores for certain diseases.

With 23andMe filing for bankruptcy, the story of DTC genetic testing has come full circle. The company, with a database of nearly 15 million customers, holds one of the largest genetic repositories. It even entered an agreement to share customers’ genetic information with pharmaceutical giant GSK for drug target discovery.

The obstacles for DTC genetic testing companies are not just related to clinical utility of their disease risk assessment tests or potential use of genetics in drug target discovery but lack of regulation related to data privacy and how the companies deal with personal genetic data.

Unlike healthcare companies, DTC genetic testing companies are not covered under the Health Insurance Portability and Accountability Act (HIPAA) in the US, making ground for personal genetic data misuse. The trouble for the 23andMe began in 2023 when a data breach compromised half of its database, exposing sensitive genetic information to anonymous actors.

Concerns about genetic surveillance are real, as health insurance companies and future employers may misuse genetic data to deny coverage or job opportunities based on predispositions. Unlike credit card theft, which can be remedied with a new card, genetic data is permanent – once accessed, it cannot be changed. This makes breaches especially alarming. 

What does the future hold for Indian DTC genetic testing companies? With little to no consumer privacy protection, companies in this space make a wide range of claims beyond potential disease risk assessment, including predictions about suitable life partners, sports aptitude and optimal nutritional choices.

The most reckless among them advocate for career testing and screening minors for genetic predispositions – practices that should be completely prohibited or, at the very least, strictly regulated by qualified geneticists and medical professionals. Additionally, many of these companies operate without oversight on how they collect, store and share genetic data.

India currently lacks strong regulations to protect consumers from false claims made by such companies. While the Digital Personal Data Protection (DPDP) Act of 2023 is cross-sectoral, it does not include specific provisions to safeguard genetic data from misuse by DTC testing companies.

Many companies misrepresent the accuracy of genetic tests in predicting common and complex diseases. While these tests may seem harmless, they can have serious consequences for consumers. It may be time for the Indian government to implement stricter guidelines under the proposed Digital Information Security in Healthcare Act (DISHA), which has been pending approval since 2017.

Binay Panda is a Professor at the Jawaharlal Nehru University, New Delhi

The Wire is now on WhatsApp. Follow our channel for sharp analysis and opinions on the latest developments.