Attendees purchase DNA kits at the 23andMe booth at the RootsTech annual genealogical event in Salt Lake City, Utah, in February, 2019.GEORGE FREY/Reuters

Vass Bednar is a contributing columnist for The Globe and Mail and host of the podcast Lately. She is the executive director of McMaster University’s master of public policy program and co-author of The Big Fix.

Over the weekend, 23andMe – a once-hyped consumer genetics company – filed for Chapter 11 bankruptcy in the United States. California issued a consumer alert, and a flurry of how-to guides on deleting your data-flooded social media feeds.

But what good are any of the actions individual consumers can take? The firm already sells access to anonymized genetic datasets for drug discovery. At its best, this kind of data-sharing can accelerate medical breakthroughs. But without clear rules, those benefits risk being privatized, hoarded by the companies, while the risks are socialized, borne by the public.

Then there is the spectre of “genetic discrimination,” which occurs when someone is treated differently because of their genes or a perceived predisposition to a condition. We already have examples of how this can go wrong. A 2018 Kaiser Health News report detailed how a woman who tested positive for a BRCA1 gene mutation (linked to breast cancer) was denied life insurance, despite being cancer-free. A 2019 New York Times investigation reported on applicants being penalized after voluntarily sharing genetic test results from 23andMe with insurers.

This is despite the United States having protections in this space through the Genetic Information Nondiscrimination Act (GINA), which is supported by additional protections in some states, such as California, Florida, Massachusetts, and Vermont as well as provisions in the Health Insurance Portability and Accountability Act that protect genetic test results handled by health-care providers or insurers.

In Canada, our Genetic Non-Discrimination Act makes it a criminal offence to require someone to undergo a genetic test or to disclose results to access goods or services. In 2020, the Supreme Court of Canada ruled that the federal government had the authority to criminalize the misuse of genetic test results, emphasizing that the law’s purpose was to protect autonomy and prevent discrimination.

But as evident in how genetic discrimination persists, these laws against it are underused, underenforced, and don’t address a bigger issue: genetic profiling at the group level. The real risk isn’t just privacy breaches, it’s systemic harm. Genetic data can be used to profile, exclude, or exploit entire groups. Combined with personal and economic data, large-scale genomic datasets create massive bargaining power for corporations and new opportunities for them to practice discrimination. The bankruptcy of 23andMe could pave the path to this.

While it’s not yet clear who might seek to acquire 23andMe’s information, it’s not hard to guess: Pharmaceutical companies might want to prioritize drug development and pricing based on genetic profiles tied to profitability – rather than public health needs. Big Tech companies might integrate genetic data into predictive health scoring, enabling discrimination by employers who use algorithmic assessments. If a surveillance-oriented company like Palantir acquired genetic datasets, there would be risk of genetic profiling, disproportionately flagging certain populations for enhanced scrutiny. Insurance providers, already known to penalize for genetic predispositions, could scale up this practice, inflating premiums or denying coverage for entire communities.

As a result, we may need new legislative tools to complement the Genetic Non-Discrimination Act and existing human rights laws; ones that are responsive to the AI age and explicitly bar discrimination by insurers, lenders, and employers against entire groups. Consent-based frameworks like the Personal Information Protection and Electronic Documents Act fall short: insurers can too easily argue that individuals “agree” to data use without understanding the broader risks. Canadians shouldn’t bear the burden of anticipating the societal impacts of commercial use of aggregate genomic data.

Another possible policy action was a popular pitch in the 2010s: a publicly administered data trust. This idea was floated to manage sensitive health and genomic information in the public interest. A data trust could allow for scientific and medical research while protecting against exploitative or discriminatory uses. It could be overseen by a tribunal that evaluates private-sector access requests and sets terms for commercial use.

The idea isn’t totally theoretical. Models like the UK Biobank or the (ultimately abandoned) Sidewalk Labs data trust proposal in Toronto offer glimpses of what public-interest data governance could look like, and how hard it is to get right.

What’s clear in the wake of 23andMe’s collapse is that we need to stop treating genetic privacy as a personal issue and start seeing it as a public governance challenge.

The company’s bankruptcy is a reminder that we are failing to regulate the accumulation of sensitive data as a form of power. As Prime Minister Mark Carney noted in his leadership acceptance speech, the alternative to well-regulated markets is the quiet privatization of public goods. If our genomes are shaping the future of health care, we deserve to participate in that future on fair terms. That means safeguarding not just individual rights, but our collective genetic inheritance; as citizens, not just consumers. No one wants their DNA used to inflate insurance premiums, shape dating algorithms, or trigger ads for supplements they never asked for.

Without thoughtful governance – where policy is debated in Parliament, not on Bay Street – we risk more than just personal dignity and autonomy. We’re cementing a new kind of inequality: hereditary, data-driven, and quietly irreversible.