Genetic testing company 23andMe's bankruptcy has unsettled users and officials, raising crucial concerns about what will happen to the sensitive biometric data collected by the company.
23andMe filed for bankruptcy in March, following declining sales in its genetic testing kits and a large-scale data breach in 2023 that compromised the personal data of 6.9 million users. The company gave users the option to delete their data and claimed it would ensure any company that acquired 23andMe would adopt its privacy policy.
Despite recently announcing biotech company Regeneron would purchase 23andMe, the company pulled back its bid after 23andMe co-founder and former CEO Anne Wojcicki’s nonprofit TTAM Research Institute offered USD305 million.
TTAM Research Institute is expected to acquire 23andMe and continue offering consumers insights into their health information and genetic makeup. Wojcicki said in a statement her nonprofit believes it is "critical that individuals are empowered to have choice and transparency with respect to their genetic data and have the opportunity to continue to learn about their ancestry and health risks as they wish."
The case has raised broader national security and data protection concerns as government officials question the potential misuse of genetic data if sold to foreign entities or provided to companies with inadequate safeguards.
At a U.S. House Committee on Oversight and Government Reform hearing discussing 23andMe's bankruptcy, College of William and Mary Law School Professor Margaret Hu said U.S. legislation, including the Health Insurance Portability Accountably Act, should be updated to meet technology advancement with an "overlapping regime that takes into account strong federal data privacy protections."
Key privacy concerns
The potential transfer of users' genetic profiles has drawn scrutiny from regulators who question if 23andMe can securely transfer sensitive data to a new organization with users' consent. While 23andMe allows consumers to delete their data, regulators, including a bipartisan coalition of 28 attorneys general, argued the company should not be able to sell users' biometric data during the acquisition.
The consumer privacy ombudsman assigned to monitor the bankruptcy's privacy implications, Washington University of St. Louis School of Law Koch Distinguished Professor Neil Richards said in a report that 23andMe should receive affirmative consent from consumers before transferring the data.
Richards' report also states consumers "allegedly had difficulties accessing their accounts, deleting their genetic data, and requesting the destruction of their biological samples," despite the company's data deletion policies.
23andMe Interim CEO and Chief Financial and Accounting Officer Joe Selsavage pushed back against claims the company had not obtained proper consent during a U.S. Senate Committee on the Judiciary hearing. Selsavage noted the company "believes we have already obtained the consent from our customers, and when the customer signed up to the service, they have agreed affirmatively to consent to our privacy and terms of service, which specifically says that we, in the event of a bankruptcy sale, can actually transfer their data."
According to Selsavage, 1.9 million users have deleted their data from the platform.
Although 23andMe says consumers own their data, Cole Schotz P.C. Partner Luis Salazar said, if the terms are included in the organization’s privacy policies, "companies still have the legal right to use it and to even sell it under the right conditions. That doesn't deny that they, the consumers, may still have some kind of ownership interest or right to it."
Genetic data is particularly vulnerable due to its sensitive and identifiable nature. This data is also essential for direct-to-consumer DNA testing companies when selling their assets.
Salazar noted providing consumers with the ability to opt in to sharing their data would significantly lower the value of the company during bankruptcy proceedings. "The data is critical to the value and everyone else involved, from employees to lenders, investors and even consumers," Salazar said. "It's the fundamental basis of what you are basically saying is everyone's expectation, 'let's just erase that, and have people opt in.' That is going to diminish the value of the fundamental asset of this company, to the detriment of a lot of people."
National security implications
Growing tensions between the U.S. and foreign adversaries have highlighted concerns over cyber threats' impact on national security. U.S. Rep. John McGuire, R-Va., claimed "foreign actors should not be allowed to gain access to millions of American sensitive data which can then be weaponized against them through surveillance or even the creation of a bio weapon."
In 2015, 23andMe received an USD115 million investment from WuXi Healthcare Ventures, a company affiliated with the Chinese Communist Party and the Chinese People's Liberation Army. Selsavage assured he was "very confident" 23andMe would not be sold to a company with ties to China or Russia.
University of Texas at Austin Robert S. Strauss Center for International Security and Law Director and Senior Lecturer Adam Klein claimed, if genetic information is provided to China, the data could be used as a means of "tracking and identifying people," including government agents and active-duty military personnel.
Klein noted as the U.S. and China race to lead AI innovation, large datasets with a "genetically diverse population" could be used to train AI models.
Despite concerns about foreign interference, neither TTAM Research Institute nor Regeneron have connections with international governments.
"I think people all around the United States are now concerned with what happens to their very sensitive personal information," U.S. Sen. Ashley Moody, R-Fla., said. "I think this is going to affect everything from data privacy to national security to potential biotech threats. We cannot overstate the threat to this nation and to people individually."
23andMe's bankruptcy is currently pending following lawsuits filed by state attorneys general and ongoing privacy concerns. If the sale is allowed to proceed, TTAM Research Institute will acquire the company along with its database.
Lexie White is a staff writer for the IAPP.
