Despite my curiosity, for privacy reasons I made the decision to not use 23andMe. (Basically - feels like information an insurer will inevitably want to use against me.) My wife did, however, and over the years our kids did too, for various reasons (an interest in genealogy, a kid with celiacs looking to trace the genetic component, etc).
Recently I was very surprised to look at the app on my wife's phone and see that they have a shadow account for me with a lot of details filled in, due to my wife/kids/siblings/cousins having used the service. I should not be suprised -- this is how they caught the golden state killer, after all.
That sounds like a GDPR breach to me, you should report it to the ICO (if you’re in the UK, not sure what the EU equivalent is).
They should not hold data on any UK or EU citizen without the citizen’s consent.