23andMe, Facing Cyber Lawsuits, Changes Terms Of Service

The genetic testing company 23andMe has changed its terms of service after hackers stole personal information from 6.9 million users. The new terms offer two options, arbitration or small claims court proceedings. They preclude class actions.

Customers must notify the company that they disagree with the new terms within 30 days of being notified or are locked in automatically.

Axios reports that it is unclear whether the change is an attempt to retroactively shield the company from suits concerning the recent breach, which was announced in October. Two Canadian law firms have already proposed class-action lawsuits against 23andMe in the Supreme Court of British Columbia.

In its initial announcement, the company said hackers had accessed the personal data of about half of its customers getting into 14,000 unsecured online accounts.

Those accounts were linked to the user’s DNA relatives through a feature offered by the company, so hackers were able to access the personal data of other customers.

The full extent of the breach wasn’t revealed for two months. The attackers published one million or more data points about users with Ashkenazi Jewish heritage, and information concerning more than 300,000 ethnic Chinese users.

A spokesperson for the company said it didn’t make the terms of service change to limit its customers’ rights to seek relief in court, but to speed up the resolution.

The spokesperson said customers can reject mandatory arbitration by not agreeing with the terms. She didn’t address whether the company was trying to shield itself from lawsuits stemming from the breach.

Nancy Kim, a Chicago-Kent College of Law professor, told Axios that if 23andMe was making the change to avoid legal fallout it probably wouldn’t work.