The biotech firm named after the 23 pairs of chromosomes in a normal human cell, 23andMe, has filed for bankruptcy and is now searching for a buyer to take over the company.
It has not been a secret that 23andMe has struggled financially for several years, yet the announcement of the bankruptcy filing on March 23 was met with trepidation by many of its more than 15 million customers due to privacy concerns.
In the announcement, Mark Jensen, the chair of 23andMe’s Special Committee of the Board of Directors, stressed that company leaders evaluated several “strategic alternatives’’ that would benefit the company in bankruptcy. “We have determined that a court-supervised sale process is the best path forward to maximize the value of the business,” Jensen said.
While the company has also stressed that any new owner would be required to adhere to “applicable law” governing the use of user data, privacy experts have questioned how far the current laws go. For example, while Americans’ medical information gathered by their doctors and insurers is protected by federal law, there is no specific federal law designed for direct-to-consumer companies like 23andMe to stop genetic information from being shared.
This point was stressed by Suzanne Bernstein, counsel at the nonprofit Electronic Privacy Information Center, who discussed the issue with National Public Radio. Up until now, large amounts of personal data, located in places like hospitals or research centers, could be governed by “meaningful safeguards.’’ However, this is not the case with 23andMe, according to Bernstein.
“The scale of how much highly sensitive data 23andMe has is unique,” she said.
Failing to Handle Sensitive Data
When someone signs up for 23andMe, the registration process includes the customer visiting the company’s website and giving consent to share their “de-identified individual-level data” with approved outside researchers. What “de-identified” means is that data directly identifying a person is stripped, including name, date of birth, and address.
Once the consent is completed, 23andMe is granted permission to share the customer’s age, ethnicity, and other information they have entered into the website or mobile app, along with particular interactions with the platform (for example, research surveys and specific data in the biological sample provided). However, the person’s identifying information, like their name, is not included.
While the bankruptcy announcement noted that the company hopes the new owner “shares in its commitment to customer data privacy,” 23andMe’s track record when it comes to data privacy has been less than stellar.
In 2023, the company suffered a major data breach that affected millions of people and spurred a class-action lawsuit. The breach included information from customers who had submitted DNA samples as well as their relatives, whose personal information was stored in the company’s Family Tree feature.
The lawsuit, filed in San Francisco in January 2024, alleged the company failed to protect the privacy of its customers. It also accused 23andMe of neglecting to notify certain users that data from people with Chinese or Ashkenazi Jewish heritage appeared to be targeted in the breach.
In September 2024, the lawsuit was settled with 23andMe agreeing to pay $30 million.
However, with the filing of Chapter 11, it is unknown how soon all the claimants will receive their portion of the settlement. As explained on the 23andMe website, “any ongoing litigation is automatically stayed due to the bankruptcy filing. Known impacted parties will be updated as the process moves forward.”
Attorney Generals Weighing In
Although there is a lack of federal laws focused on how companies like 23andMe protect their customers’ information, at the state level, places like Montana, Tennessee, Texas, Virginia, Arizona, California, Kentucky, Maryland, Utah, and Wyoming do have genetic privacy laws in place.
And when the bankruptcy and the potential sale were announced in March, along with privacy advocates expressing concern, several top lawmakers in various states began urging 23andMe customers to take action to protect their data and to do so right away. This included Attorney General Anthony G. Brown of Maryland, Attorney General Jonathan Skrmetti of Tennessee, and Attorney General Rob Bonta of California, the home state for 23andMe.
Bonta released a consumer alert on March 21, encouraging his fellow Californians to “consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material” the company may have.
While stressing to residents they are allowed to “direct the deletion” of their genetic data through the Genetic Information Privacy Act (GIPA) and California Consumer Privacy Act (CCPA), Bonta also posted the instructions on how individuals can delete the data on the 23andMe platform.
Here are those instructions:
- Log in to your 23andMe account on their website.
- Go to the “Settings” section of your profile.
- Scroll to a section labeled “23andMe Data” at the bottom of the page.
- Click “View” next to “23andMe Data”
- Download your data: If you want a copy of your genetic data for personal storage, choose the option to download it to your device before proceeding.
- Scroll to the “Delete Data” section.
- Click “Permanently Delete Data.”
- Confirm your request: You’ll receive an email from 23andMe; follow the link in the email to confirm your deletion request.
If a customer has a problem accessing their account or deleting their data, they should visit the company’s customer care site for support.
Future of 23andMe
In the March 23 announcement concerning the bankruptcy, there was also the news that Anne Wojcicki, one of the company’s co-founders, stepped down as chief executive officer, and that earlier in March the board had declined to accept an offer she had made to become sole owner of 23andMe.
On the morning of March 24, Wojcicki posted an announcement on social media, sharing her dismay at her company’s bankruptcy. She also shared her intent to bid on the company again, while continuing to “advocate for customers to have choice and transparency with respect to their personal data, regardless of platform.”
“If I am fortunate enough to secure the company’s assets through the restructuring process, I remain committed to our long-term vision of being a global leader in genetics and establishing genetics as a fundamental part of healthcare ecosystems worldwide,” Wojcicki said.
Source: www.legalexaminer.com – All rights belong to the original publisher.
Stay Updated: Stay Updated with CUOS Media – News, Articles, Stories & More!
