23andMe just updated its ‘dispute resolution’ rules as fallout from a serious data breach continues

On the heels of a hack that saw the data of roughly half of its users impacted, DNA testing service 23andme has changed the dispute resolution and arbitration section of its terms of service.

The company, in a note to customers sent Monday, says it “streamlined arbitration proceedings where multiple similar claims are filed,” and that the new procedures are meant to “encourage a prompt resolution of any disputes.” The changes to the terms of service were made the day before the company revealed that as many as 6.9 million users were impacted by the October hack, via a filing with the Securities and Exchange Commission (SEC).

The changed terms continue to require the use of an arbitrator on an individual basis to resolve disputes “in certain circumstances.”

Exceptions to the rule include disputes about intellectual property and trade secrets, those argued in small claims court, and provisional remedies, such as temporary restraining orders and garnishment.

The terms seemingly prohibit customers from taking part in a class action lawsuit or a jury trial against 23andMe, something the updated language is much more clear about.

“To the fullest extent allowed by applicable law, you and we agree that each party may bring disputes against the other party only in an individual capacity and not as a class action or collective action or class arbitration,” the most recent version of the terms reads.

23andMe subscribers have been given 30 days to review the new terms of service. If they choose not to agree to them and notify the company within that period, 23andMe says users will remain subject to the previous terms. Failure to notify the company via email will be seen as acceptance, it said.

Natalie Ram, an associate professor of law at the University of Maryland Francis King Carey School of Law, is a leading scholar on the intersection of genetic privacy and the law, but is not a class arbitration expert. She notes that many companies change their terms of service as the end of the year draws near. And many are adopting a mandatory arbitration clause in their terms of service.

“Arbitration is much, much less expensive for [both parties] than a civil litigation process,” she tells Fast Company. “Civil litigation is a very expensive process.”

Additionally, she notes, arbitration proceedings are closed to the public, unlike a courtroom battle. That could save the company from public embarrassment.

Companies like 23andMe, she says, are not only the caretakers of people’s genetic data; they’re also an online service provider, which means they can change the terms of service any time—and those terms are often written in a way that is inaccessible to people who are not legal experts. That can be problematic.

What’s unusual with 23andMe’s note to users is the option to not accept the new terms, says Jessica Roberts, a professor at the University of Houston Law Center.

“Many companies, including 23andMe, reserve the right to unilaterally change their terms of service. In other words, they can change their terms completely on their own with no input from their customers,” she says. “Companies rarely let consumers opt out of new terms, and consumers may not even know that a change happened in the first place.”

23andMe did not respond to Fast Company’s request for comment about the terms of service changes.

In the months since the intrusion was revealed, the company told the SEC, “multiple class action claims have been filed against the Company in federal and state court in California and state court in Illinois, as well as in British Columbia and Ontario, Canada.”

Additionally, the filing adds, “the Company is also assessing its response to notices filed by consumers under the California Consumer Privacy Act and to inquiries from various governmental officials and agencies. The full scope of the costs and related impacts of this incident and related litigation, including, without limitation, the availability of insurance to offset some of these costs, cannot be estimated at this time.”

https://www.fastcompany.com/90993240/23andme-hacked-terms-of-service-arbitration-update-data-breach?partner=rss&utm_source=rss&utm_medium=feed&utm_campaign=rss+fastcompany&utm_content=rss