Court Approves 23andMe Sale to TTAM Research Institute

A federal bankruptcy court this week gave the green light for TTAM Research Institute – a new company launched by 23andMe’s co-founder and former CEO Anne Wojcicki – to buy 23andMe. As part of TTAM’s $305 million bid, it promised to uphold the consumer genetics testing firm’s current privacy policies and implement additional data safeguards.

See Also: Flip the Security Model for Regulated Data Protection

Under the deal, TTAM will acquire all the assets of the health and ancestry testing company, including 23andMe’s Personal Genome Service and Research Services business lines, and its Lemonaid telehealth business. The sale is expected to close in coming weeks.

“TTAM is committed to adhering to 23andMe’s existing privacy policies in perpetuity and is adopting additional consumer protections and privacy safeguards to enhance protections for customer data and privacy,” 23andMe said in statement Monday.

23andMe’s current policies include allowing consumers to permanently delete their data. That’s a step that many regulators and privacy experts have been advising consumers to take. 23andMe filed for bankruptcy last month, testifying in a Congressional hearing that nearly 2 million of the company’s 15 million customers had deleted their accounts.

Besides agreeing to honor 23andMe’s existing privacy policies, TTAM pledged to take additional steps to protect consumers’ data (see: 23andMe’s Co-Founder to Buy Company, Makes Privacy Pledge).

Those policies include:

• Providing advance notification to customers of the pending deal;
• Promising not to sell or transfer genetic data in connection with a subsequent bankruptcy or change of control unless the recipient is a qualified domestic entity that adopts TTAM’s privacy policies and complies with all laws;
• Establishing a consumer privacy advisory board within 90 days of the closing;
• Implementing privacy procedures, notifying customers of material changes, mitigating data breaches and preparing annual reports to be made available to attorneys general upon request;
• Offering customers two years of free identity theft monitoring;
• Continuing 23andMe’s policy of allowing de-identified data to be used for scientific and biomedical research for scholars at academic universities and other nonprofits, and refusing donations from individuals or companies in specified countries.

23andMe and TTAM did not respond immediately to Information Security Media Group’s requests for additional details about TTAM’s enhanced privacy and security plans for 23andMe moving forward.

Prior to 23andMe accepting TTAM’s bid, biotech firm Regeneron Pharmaceuticals had planned to acquire 23andMe for $256 million (see: What Does Regeneron’s Purchase of 23andMe Mean for Privacy?).

In June, the U.K. Information Commissioner’s Office and the Office of the Privacy Commissioner of Canada imposed a 2.31 million pound fine on 23andMe for “serious” privacy violations tied to the company’s 2023 hack and data leak that affected nearly 7 million customers (see: ICO Imposes 2.31 Million Pound Fine on 23andMe).