[NEW YORK] Millions of Americans who sent their saliva to 23andMe in the hopes of finding lost relatives or identifying health risks buried in their DNA now face seeing their genetic information sold to the highest bidder as part of the company’s bankruptcy, setting up a test of existing legal safeguards around privacy and safety.
23andMe has proposed a May 14 auction for the sale of its assets, which include the genetic data of more than 15 million customers. Founded in 2006, 23andMe said in court papers that the data represents “one of the world’s largest crowdsourced platforms for genetic research”.
The auction shines a light on an aspect of corporate restructuring that receives relatively little notice from the general public until moments like this: customer data is a valuable asset that often changes hands in Chapter 11. That includes patient information from bankrupt hospitals or nursing homes as well as customer data from failed retail chains.
And while existing bankruptcy law contains measures to protect sensitive information of failed companies such as 23andMe, the prospect of key genetic information being sold feeds into long-simmering unease around privacy and safety in the industry.
23andMe’s bankruptcy prompted a flood of social media messages from users worried about what this means for their personal information and that of their families. Those concerns were fuelled in part by a 2023 data breach that compromised the information of roughly seven million 23andMe customers.
Consumer alerts
A 23andMe spokesperson said that customers can delete data within their account and do not need to contact customer care to do so. In a note to customers, the company said the bankruptcy filing does not change how they store or protect personal data and any buyer will be required to comply with applicable laws with regard to the treatment of such information.
BT in your inbox
Start and end each day with the latest news stories and analyses delivered straight to your inbox.
“Our users’ privacy and data are important considerations in any transaction, and we remain committed to our users’ privacy and to being transparent with our customers about how their data is managed,” the company said.
California and Connecticut’s top law enforcement officers issued consumer alerts on Monday (Mar 24), providing instructions on how 23andMe customers can delete their genetic information. Some customers said in social media posts that the company’s website and application were running slower than usual as users sought to delete their data.
“We are watching this bankruptcy filing closely and expect to be actively engaged to ensure sensitive records are protected and 23andMe is held accountable,” Connecticut attorney general William Tong said.
In a court filing outlining the proposed May auction, 23andMe said bidders must state in writing that they comply with the company’s privacy practices, “which do not restrict the transfer of personally identifiable information of the debtors’ customers in connection with a bankruptcy, merger, acquisition, reorganisation, or sale of assets”.
Although the scale of 23andMe’s genetic data is likely unique, customer data is regularly sold in bankruptcy. Those transactions can cause tension between a company’s obligation in bankruptcy to sell its assets for as much as possible, while at the same time ensuring that customers’ privacy is not jeopardised.
Additional protections
Congress in 2005 added protections to the bankruptcy code that permit the US Department of Justice to seek the appointment of a consumer privacy ombudsman who provides independent oversight of customers’ privacy interests during a Chapter 11 sale.
Such ombudsman are “explicitly charged by the bankruptcy code with responsibility to protect personal identifier info” and should object to any sale or transfer of customer data that does not include the best possible safeguards including opt-out provisions like the one provided in California, said Keith Lundin, a retired bankruptcy judge.
“I had hospital cases like that where the ombudsman did not trust the buyers and demanded additional conditions on the continued operation of the debtor,” Lundin said.
23andMe has filed customary motions seeking court approval to run a sale process for its assets and tap as much as US$35 million in Chapter 11 financing. The company in court papers listed US$277.4 million in assets and US$214.7 million in liabilities. BLOOMBERG
