But what if 23andme or Genentech starts selling people's data to health and life insurance firms? And maybe employers will want that data, just as they want credit reports etc.

There ought to be meaningful privacy protection, in my opinion.