> At the meeting, a senior FDA representative indicated the agency has approved over 99 percent of expanded access requests submitted via single patient or emergency INDs since 2009, suggesting the regulatory agency is not a major barrier to expanded access. As such, provided the access request is reasonably related to the potential benefits of the drug, the biopharmaceutical company is almost solely responsible for the decision and liability regarding whether to grant expanded access to an individual.
http://healthaffairs.org/blog/2014/07/31/individual-patient-...
This was not a case of over regulation. It was pretty simple, and the FDA tried repeatedly to work with 23 and Me to bring them into compliance, but the company basically ignored the FDA's requests for meetings and information. They have nobody to blame but themselves, and what happened was good for consumers.
Fortunately sources like snpedia.com still exist for those wanting to use their 23andme data to do their own exploring without an intermediary, should they choose.
What the FDA prevented was a company profiting from selling a diagnostic service that wasn't proven.