23andMe’s Co-Founder to Buy Company; Makes Privacy Pledge

23andMe’s co-founder and former CEO Anne Wojcicki’s new company – TTAM Research Institute – is the winner in a final round of auction bids to purchase the bankrupt consumer genomics testing firm. As part of TTAM’s bid, the nonprofit startup pledged to implement additional privacy and security protections of 23andMe’s customers’ sensitive data.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

23andMe said late Friday that it had entered into a definitive agreement with TTAM for the sale of substantially all of the company’s assets, including the Personal Genome Service and Research Services business lines, as well as the company’s telehealth business Lemonaid Health, for a purchase price of $305 million.

TTAM’s bid beat out a $256 million bid last month by biotech firm Regeneron Pharmaceuticals. The bankruptcy court agreed to reopen the bidding after TTAM made an offer to buy 23andMe for $305 million. At the conclusion of the final round of bidding on Friday, TTAM was selected as the winning bidder and Regeneron was selected as the backup bidder, 23andMe said.

23andMe’s bankruptcy and planned sale has faced close scrutiny and criticism by lawmakers, regulators and others.

Members of the House committee on oversight last week grilled Wojcicki and 23andMe’s interim CEO Joseph Selsavage over the company’s data privacy practices, its 2023 credential stuffing hack that affected nearly 7 million customers, and the firm’s future protection of consumers’ genomic data as assets are transferred to a new owner (see: Sale of 23andMe: On The Hot Seat of Congress, States).

On the same day as the Congressional hearing, 28 state attorneys general filed a lawsuit to block the sale of bankrupt consumer genetics testing firm 23andMe to the highest bidder without the company obtaining explicit consent from each customer for the transfer of their information to a third party.

Also, in a June 11 report, a consumer privacy ombudsman who was appointed in 23andMe’s bankruptcy case to assist the court in its consideration of the proposed sale of 23andMe’s customers’ personally identifiable information, recommended that 23andMe “obtain separate, affirmative consent from its customers in order to sell their data.”

As an alternative to that recommendation, the winning bidder could instead “obtain separate, affirmative consent from customers prior to using customers’ data,” the report said. “This consent could be obtained the next time a user logs into their account, through a mandated outreach by email to solicit such consent.”

As part of its winning bid for 23andMe, TTAM committed to comply with 23andMe’s existing privacy policies and applicable law, including processing all customer personal data according to the consents, privacy policies and statements, terms of service, and notices currently in effect at 23andMe – and have security controls in place designed to protect that data.

Additionally, TTAM in its bid committed to implement “additional consumer protections and privacy safeguards to enhance protections for customer data and privacy.” That includes:

• Honoring 23andMe’s existing policies that allow individuals to delete their account and genetic data and opt-out of research in perpetuity;
• Notifying all customers at least two business days before the sale closing with details on TTAM’s role, its commitment to privacy choices, and instructions on how to delete data or opt out of research;
• TTAM agreeing to not sell or transfer genetic data in connection with a subsequent bankruptcy or change of control “unless the recipient is a qualified domestic entity” that adopts TTAM’s privacy policies and complies with all laws;
• Establishing within 90 days of the closing a consumer privacy advisory board;
• Implementing privacy procedures, notify customers of material changes, mitigate data breaches and prepare annual reports to be made available to attorneys general upon request;
• Offer customers two years of free identity theft monitoring;
• Continue 23andMe’s policy of allowing de-identified data to be used for scientific and biomedical research to research scholars at academic universities and other nonprofits, and refuse donations from individuals or companies in specified countries.

Selsavage, at last week’s House committee hearing, testified that since 23andMe filed for bankruptcy protection in March, about 1.9 million people – or about 15% of 23andMe’s 15 million customers – had requested the deletion of their sensitive data.

The proposed sale of 23andMe to TTAM is subject to approval by the bankruptcy court and customary closing conditions. A court hearing to consider approval of the transaction is scheduled for Tuesday, and if approved, is expected to close in the coming weeks, 23andMe said.

Neither 23andMe nor TTAM immediately responded to Information Security Media Group’s requests for additional details and comment on the proposed sale and TTAM’s data privacy promises.

Some privacy experts said 23andMe’s planned sale to a company led by 23andMe co-founder should provide some level of comfort in knowing that the data is going to a company whose leadership has experience with very sensitive data sets.

“However, consumers should not lower their guard,” said attorney Andrew Crawford, senior policy counsel of the privacy and data project at advocacy group Center for Democracy & Technology.

Crawford said TTAM should commit to all the privacy safeguards recommended in the report by the consumer privacy ombudsman, Neil Richards, a well-known privacy scholar tasked by the bankruptcy court to examine privacy implications related to the sale of 23andMe’s data.

Key recommendations are that consumers receive notice about their data being sold and ensuring that each consumer has the ability to delete his or her own data, Crawford said.

“While it is good to hear TTAM commit to comply with 23andMe’s consumer privacy policies, that’s no guarantee that TTAM won’t change those terms in the future,” Crawford said. “It is still up to each 23andMe customer to make sure they are comfortable with TTAM practices and data uses now and moving forward.”

TTAM’s pledge to give consumers notice of two business days if their data is about to be sold is not enough advance notice, Crawford said.

“People may be on vacation, work travel or just not check their email for a few days. If TTAM is serious about privacy and giving customers a real choice, they should give folks far more time.”