Disclosure: 23andme has stored my genetic information since they first started offering genotyping, and I requested data deletion recently although some of my family members haven't and likely won't. Also interviewed and was offered a role at 23andme on their infra team (circa 2010), but declined.
I am not concerned about my genetic data being sold. I am not worried about it being public, it is, through Harvard's Personal Genome Project [1]. If you are going to harm me, you are likely going to use a method far easier than that which would require you have access to my genotyping data. There is also enough overlap with close genetic matches (2nd-4th cousin with hundreds of matches) that if my data is stored despite my deletion request, it would not change the risk assessment. It will take just a bit more legwork to tie a sequence of my DNA to me [2].
Hence my questions to better understand what OP is attempting to defend against. You can't propose mitigations or other recourse (legal and regulatory, primarily, in this case) if you don't know the risk you're attempting to manage, or the threat you're attempting to defend against.
