Two days before 23andMe revealed that hackers accessed the personal and genetic data of nearly 7 million customers, the genetic testing giant updated its terms of service. According to lawyers who specialize in representing data breach victims and the arbitration process, the changes are an attempt to make it more difficult for breach victims to come together to file a legal claim against the company.
Three lawyers interviewed by TechCrunch addressed the changes 23andMe Terms of Service with their customers ‘cynical’, ‘self-serving’ and ‘desperately trying’ to protect and prevent customers from exercising their legal rights following the massive breach of customer data.
All the lawyers agreed that the new changes are designed so that clients forgo the ability to jointly arbitrate claims — a process also known as mass arbitration the arbitration swarms — vs. 23andMe.
“These are some of the most pernicious and cynical attempts I’ve seen to “we’ve already made it difficult for you to get to court. Now we’re going to make it even more difficult for you to get to arbitration,” Doug McNamara, a partner at law firm Cohen Milsten, told TechCrunch in a phone call. “It screams a desperate attempt to discourage and prevent people from suing them, which if you’ve done nothing wrong, why should you?”
Contact us
Do you have more information about the 23andMe incident? We would love to hear from you. Lorenzo Franceschi-Bicchierai can be reached securely on Signal at +1 917 257 1382 or via Telegram, Keybase and Wire @lorenzofb or email at lorenzo@techcrunch.com. You can also contact TechCrunch via SecureDrop.
In his previous terms of service23andMe already included a clause forcing customers to go through arbitration instead of “jury trials or class actions.”
Arbitration is essentially an alternative legal system for resolving disputes. Unlike a lawsuit, Arbitration is a private proceeding this — in theory — is faster and cheaper. But Critics say the forced arbitration process is skewed in favor of the companiesand Research shows that customers often don’t know that they have waived their constitutional right to sue when they accepted a company’s terms of service.
The email that 23andMe sent to its customers about the Terms of Service is changing. Image Credits: TechCrunch
The new terms of service effectively bar 23andMe customers from joining forces in this mandatory arbitration process, according to lawyers TechCrunch spoke with. The lawyers pointed to a new section of the terms that refers to an initial period in which customers must first speak with 23andMe before filing for arbitration:
The initial dispute resolution period must include a conference between you and us to attempt to informally resolve any Dispute in good faith. You will appear in person at the conference by telephone or video conference. if you are represented by an attorney, your attorney may attend the conference, but you will also attend the conference. The conference will be individualized so that a separate conference is held each time one of the parties initiates a Dispute, even if the same law firm or group of law firms represents multiple users in similar cases, unless all parties agree. multiple persons initiating a Dispute may not participate in the same conference unless all parties agree.
In other words, according to the lawyers, 23andMe wants to avoid mass arbitration, a process that has already cost the companies millions of dollars.
In 2022, a judge ruled that Uber had to pay $92 million in fees to the American Arbitration Association as a result of a mass arbitration petition against the ride-sharing company for alleged discrimination against black-owned restaurants in its food delivery service, Uber Eats. Recent years, DoorDash and Amazon have had to deal with mass arbitration claims rather than individual ones. Amazon has abandoned arbitration altogether after lawyers filed more than 75,000 arbitration claims on behalf of Echo users who claimed the devices recorded them without permission.
“Is it better for the consumer? No. Is it better for 23andMe? Yes. It makes it much less likely that they will face a massive arbitration and have to spend a lot of money to deal with these claims,” said McNamara, who described 23andMe’s strategy as an attempt to weaken its customers’ legal position. “It’s almost like, ‘Let’s play ball.’ But I can pick the umpires, I can pick the pitch, I can pick the number of innings, I can pick the pitches you’re allowed to throw, I can pick your batter and make it so that you can’t really hire anyone from the good batters to go to the plate for you.’
Julia Duncan, the senior director of government affairs for the American Justice Association, told TechCrunch that the other downside to individual arbitration is that it’s a confidential process, so consumers can’t learn from other people’s cases.
“It’s much easier to bury customer claims one by one than to deal with millions of customers who have banded together to try to seek accountability from the same company. It’s all about corporate leverage and power and the power to keep things secret,” said Duncan, which has spoken out against forced arbitrationhe said in a phone call.
Duncan also said that arbitration is generally more favorable to companies.
“For most consumers and workers, forced arbitration and mass forced arbitration equates to corporate immunity. These systems are rigged, inherently biased and run in secret,” Duncan said.
23andMe spokesman Andy Kill said in an email that “recent revisions to our terms of service provide more detail and clarity regarding the arbitration process.” Kill added that the company “has made changes that make arbitration more efficient for customers when multiple similar claims are filed and provide more opportunities to resolve disputes without customers incurring the costs of litigation or arbitration.” Kill did not respond to a follow-up asking what the changes were that make arbitration more efficient for clients.
The company also made a change that now requires customers to try to negotiate a dispute for 60 days before even submitting a request for arbitration.
“They’re hoping that some people, who are very upset when they initially hear that their genetic data has been stolen, will drop out within that 60-day window and never follow through and file for forced arbitration,” Duncan said. “They hope to make forced arbitration so burdensome and so difficult that most consumers don’t use it at all. And then they get away without ever being held accountable.”
23andMe gave customers 30 days to reject the new terms of service. Confusingly, in the new terms of service, 23andMe wrote that customers who want to do so should email arbitrationoptout@23andme.com, but in the email sent to customers, the company wrote that the address to be used it is legal@23andme.com.
Two 23andMe customers told TechCrunch that they emailed the company asking to opt out of the recent terms of service changes, but have yet to hear back.
Duncan said that even though the terms of service exclude class action lawsuits, victims should file them because “the way 23andMe changed the forced arbitration provisions to make them even more burdensome for consumers should definitely to be assessed in a court of law.’
Jules D’Alessandro, a Rhode Island-based attorney, also said that if he were a victim, he would “jump into a class action or mass arbitration and let 23andMe try to convince a judge that I agreed to limit my participation in an individual suit. »
And victims are already doing just that.
On November 13, a woman in Illinois filed a class action lawsuit vs. 23andMe. In the past week, two law firms in Canada have also filed class action lawsuits together on behalf of the Canadian victims of the breach. Sage Nematollahi, one of the lawyers working on the case, said Global News that “thousands” of victims have already approached the company to join the lawsuit.
