I obviously don't understand the specifics, but if they are later owned by someone else, is that new someone considered a third party?

For instance, doesn't this mean that a hypothetical future 23andMe drowning in debit could be acquired by a company who could use the data for all sorts of terrible things without ever technically selling it to a third party?