The Federal Trade Commission said Friday said it is charging a San Francisco-based genetic testing firm, 1Health.io, with failing to protect the privacy and security of DNA data.
The agency said in a statement that the company left sensitive genetic and health data unsecured, deceived consumers about their ability to get their data deleted, and changed its privacy policy retroactively without adequately notifying and obtaining the consent of consumers whose data it had collected.
In addition to paying $75,000, under a proposed settlement, 1Health will be required to strengthen protections for genetic information and instruct third-party contract laboratories to destroy all consumer DNA samples that have been retained for more than 180 days, the FTC said.
The FTC said the company, which changed its name from Vitagene Inc. in October 2020, has sold DNA health test kits and DNA test results, along with information consumers supplied, to consumers as part of product packages that cost $219 to $259.
The reports included personal information about a consumer’s health and genetics, such as their level of risk for developing health problems based on their genotype data.
Company CEO Mehdi Maghsoodnia said in a statement, “In July 2019, we were for the first alerted to the fact that a small number of customer files had been inadvertently stored in a publicly accessible location. There is no evidence these customer files were improperly accessed. In response, the FTC launched an investigation which has now dragged on for nearly four years. This is a case of extraordinary government overreach. Ultimately, we disagree with many of the FTC’s conclusions. But we look forward to finally putting this matter behind us.”
