The article says they are just using de-identified, summary data, what's the problem?
It's incredibly difficult to truly de-identify data and it's incredibly easy to re-identify it. Making data truly anonymous usually also neuters the data for any kind of predictive models.
23andMe is selling either straight up raw data (which is totally allowed under the investment terms) or tightly grouped 'summary' data which can be trivially re-identified. If they were selling actually anonymous data it would be worth nothing because it would yield no predictions.
Disclaimer: I work in ML/predictive analytics. 'anonymous data' is a marketing term for trivially reidentifiable data. If the data is truly anonymous then its predictive power tends towards 0 as does its market price. You don't think GSK dropped 300 mil on mostly useless data do you?
Trying to keep genetic identity anonymous is security through obscurity. You have shed thousands of skin cells in the time it took for you to read this. If people want your DNA it's trivial to collect -- and will only get easier and more common.
A better use of our time is to address the ramifications of public DNA and prevent it from being misused.
Now compare the cost of hacking into a database to the cost of obtaining millions of genomes by physically taking genetic material and then sequencing it. Then consider that your DNA is yours for the rest of your life.
Simply because data can be obtained by some means does not make protecting that data useless.
As the value of DNA increases, people will collect it. Restaurants, washrooms, your employer, airlines, Uber etc. all could have trivially easy access to your DNA if they choose to.
Just because there is 'trivial' access to certain attributes of people doesn't mean that it's legal to capture those attributes, and even if you do capture them, they're worthless on the legal market. E.g. see SF ban on facial recognition.
And that's only if such legal barriers are even constructed which I'm not sure they will be. Look how the privacy battle has turned out thus far.
Why, after the consistent abuses and lack of accountability across the corporate sphere, would you place any faith in a business's claim that they're just leaving what probably already amounts to billions of dollars of value on the table when there is effectively no penalty for covertly extracting said value at the cost of customer privacy?
Why, after a decade+ of security breaches and poor data handling practices, would you trust a financially motivated, publicly traded company to properly anonimize data?
[1] https://www.telegraph.co.uk/news/2018/04/27/golden-state-kil...
[2] https://www.latimes.com/california/story/2019-11-24/law-enfo...
[3] https://www.usatoday.com/story/tech/nation-now/2018/04/27/an...
https://www.nytimes.com/2019/07/23/health/data-privacy-prote...