On the Hot Seat of Congress, States

Twenty-eight state attorneys general have filed a lawsuit to block the sale of bankrupt consumer genetics testing firm 23andMe to the highest bidder without the company obtaining explicit consent from each customer for the transfer or their information to a third party.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

Two companies are currently bidding for 23andMe – biotech firm Regeneron Pharmaceuticals and the nonprofit medical research organization TTAM Research Institute, which was founded by Anne Wojcicki, co-founder and former CEO of 23andMe.

While Regeneron entered into a purchase agreement last month to acquire 23andMe for $256 million, the bankruptcy court last week allowed the auction to be reopened.

TTAM Research submitted a bid to buy 23andMe for $305 million. Regeneron can counter with an offer that must be at least $315 million, with each bidder being allowed to make one final competing offer, before a winner is chosen.

The state attorneys general lawsuit on Tuesday was filed as members of the House committee on oversight grilled 23andMe’s founder and former CEO Wojcicki and the company’s interim CEO Joseph Selsavage on the firm’s data privacy and security practices.

That included scrutiny about 23andMe’s 2023 credential-stuffing hack that affected nearly 7 million of the company’s 15 million customers, as well as the variety of consumer privacy and national security concerns about the transfer of the consumers’ sensitive data to a new owner.

Similar to what the states’ are demanding in their lawsuit to block the sale of 23andMe, some committee members also pressured Selsavage – who was named interim CEO in March – and Wojcicki – who was 23andMe’s CEO until the bankruptcy – to specifically provide consumers more control over their sensitive data in an upcoming sale.

Privacy, Security Concerns

So far, 1.9 million people – or about 15% of 23andMe customers – have requested the deletion of their sensitive data since news of the company’s bankruptcy broke in March, Selsavage testified.

But some lawmakers argued that the company is not making it easy for consumers to request their data be deleted. Not only must individuals scroll down several confusing menus in their account settings in order to delete their data, some consumers are facing other obstacles, some lawmaker said.

Rep. Ayanna Pressley, D-Mass., scolded Selsavage and Wojcicki that when some people have tried to log into their 23andMe accounts to delete their data, “they’ve receive error messages, and then the website crashed. That is not ok. Your company is preventing people from deleting their information,” she said.

Pressley quizzed both Selsavage and Wojcicki on whether 23andMe – or Wojcicki if her TTAM company is the determined the winning bidder of 23andMe – would proactively reach out to each of the company’s consumers for their opt-in consent to allow their data being transferred to new owners.

“Will you contact each of your customers seeking consent for 23andMe to continue holding their data? A simple opt in communication that you send out before any bankruptcy sale?” Pressley asked.

“We have sent a notice out to all of our customers via email notifying them of the sale. And a second email is currently going out this week notifying them that a sale is happening,” Selsavage testified.

“We believe our customers have already consented to this transfer of their data through the consents they signed up for when they signed up for the service,” he said.

“Ms Wojcicki – will you amend your bid to a similar consent requirement?” Pressley asked Wojcicki.

Wojcicki answered that she could not comment on her bid for 23andMe in the bankruptcy.

“But in the past, when we did the GSK partnership, we proactively communicated with all customers with that,” she said referring to a multi-year partnership between 23andMe that had enabled the pharmaceutical giant GSK to conduct drug target discovery and other research using the 23andMe database.

Other lawmakers bemoaned that 23andMe – and companies like it that collect and handle certain sensitive consumer health data – fall into a federal regulatory gap.

While HIPAA covers protected health information handled by regulated entities and business associates involved in certain electronic transactions – and the Genetic Information Nondiscrimination Act prohibits discrimination based on genetic information in health insurance and employment – there are gaps in-between that make consumers’ biometric and genetics data especially vulnerable from a regulatory and legal standpoint.

“I think we need some kind of regulatory protection” for consumer health-related data that is not currently covered by HIPAA, GINA or other federal laws, said Rep. David Min, D-Calif.

Margaret Hu, professor of law and director of the digital democracy lab at William & Mary Law School testified that the bankruptcy of 23andMe and the serious data privacy issues it raises underscores an urgent need for Congress to address several critical regulatory and legislative gaps.

“The collection, storage, and analyses of sensitive genetic information and, and its disclosure, can pose a range of national security concerns and risks,” she testified.

“The bankruptcy proceedings of 23andMe demonstrates why these matters are so consequential, especially in the age of artificial intelligence and the future of AI warfare,” she said.

“The 23andMe bankruptcy filing is a wakeup call that our current legal inadequacy amounts to instability in our national security. In the age of AI, data privacy, cybersecurity and AI infrastructure form a tapestry of overlapping systems of technology and law,” Hu testified.

“Congress should act immediately to enact both federal data privacy laws and cybersecurity laws. Next, Congress can take legislative action to enact a federal AI law that anticipates the significant national security threats that can be posed by inadequate AI regulations.”

In the meantime, 23andMe – and its future owners, as well as other companies handling similarly sensitive genetic and health information – need to more proactive in protecting that data against hacks or falling into the hands to certain nation states like China, other lawmakers said.

“It is imperative that 23andMe and other companies like that ensure that there is no legal or illegal way for our foreign adversaries or anyone else to access, manipulate, or abuse Americans’ genetic data to advance nefarious agendas,” said committee chair James Comer, R-Ky.