Jamie Spencer
Company Seeks Buyer as Customers Worry Over Genetic Data
Genetic testing firm 23andMe has filed for Chapter 11 bankruptcy, triggering alarm over the fate of genetic and personal data from its more than 15 million users worldwide. The company cited financial struggles following a data breach class-action settlement, mass layoffs, and the closure of its drug development unit.
“The Company intends to continue operating its business in the ordinary course throughout the sale process,” 23andMe stated, while also claiming there would be no changes to how customer data is stored or protected.
Experts Warn of Major Privacy Gaps
Bioethics and privacy experts are sounding the alarm. Dr. Arthur Caplan of NYU said the company never had strong consent protocols for how data might be handled in a bankruptcy or sale. “What you thought was safe and secure is clearly not,” Caplan said.
Anya Prince, a law professor at the University of Iowa, noted that user data can be transferred in a sale, and that while the new owner must initially comply with 23andMe’s privacy policy, that policy can be changed at any time. This could allow for more permissive data sharing, including with law enforcement, insurers, or employers.
HIPAA Does Not Apply
Harvard’s I. Glenn Cohen emphasized that unlike doctor-patient records, data shared with 23andMe is not protected by HIPAA. This makes it vulnerable in the event of a corporate sale. About 80% of customers have opted in to allow their data to be used in research, and this information could also transfer to a buyer.
Cohen added that the company’s bankruptcy filings require potential buyers to initially honor the current privacy policy, but that doesn’t prevent them from issuing a new one and asking users to agree to it later.
Data Deletion Still an Option
In response to public concern, California Attorney General Rob Bonta issued a guide on how users can delete their accounts, destroy their DNA samples, and revoke data-sharing permissions—especially important for those living in states with genetic privacy laws.
“Some customers may be fine with the risks,” Prince noted. “But for others, especially those who didn’t realize their data could be resold or reused, now is the time to reconsider whether they want to stay in the system.”
