Data Breaches, Self-Realization, and Non-Economic Damages: Lessons from 23andMe

23andMe's genetic testing service was hacked, compromising sensitive, private genetic, health, ethnic and location information of seven million people. Beyond the potential financial losses similar to those seen in data breaches of financial institutions, the loss of control of this private information compromised the individual's right to self-realization-the process by which people interact with the world around them by choosing when and how to reveal sensitive information about themselves. In a legal system reluctant to award damages for non-economic losses, we argue that loss of control of private information itself should be compensable. We analyze the psychological, social, physical and other risks inherent in loss of control of private information and advance a legal theory for its protection.