What Does it Mean for Data Privacy?

Genetics testing firm 23andMe has filed for Chapter 11 bankruptcy protection and says it is looking to sell the company. But what does that potentially mean for the firm’s trove of highly sensitive health and ancestry information pertaining to millions of consumers?

See Also: Enterprise Browser Supporting Healthcare, Cyber Resilience

California-based 23andMe Holding Co. in its bankruptcy filing in a Missouri federal court on Sunday said it has 277.42 million assets and $214.7 million in debts.

In a statement announcing the bankruptcy, 23andMe said it is seeking authorization from the court to commence a process to sell substantially all of its assets.

“If approved by the court, the company, with the assistance of an independent investment banker, would actively solicit qualified bids over a 45-day process. If multiple qualified bids are submitted during the court-supervised sale process, the company plans to conduct an auction to maximize the value of its assets,” the company said.

“Any buyer will be required to comply with applicable law with respect to the treatment of customer data and any transaction will be subject to customary regulatory approvals, including, as applicable, approvals under the Hart-Scott-Rodino Act and the Committee on Foreign Investment in the United States.”

Some experts are questioning the security and privacy of the company’s data as the bankruptcy and sale process evolves.

“23and Me says that it intends to continue to protect the privacy and security of individual’s information. However, that may be made more difficult by the business demands of its bankruptcy,” said privacy attorney David Holtzman of the consulting firm HITprivacy LLC. “There is also a risk that the information could be sold or transferred to a new company which might want to use it for new purposes.”

Deleting Data

Upon the 23andMe’s public announcement of filing for Chapter 11 bankruptcy, California Attorney General Rob Bonta issued an alert reminding California consumers of their right to delete data they provided to 23andMe.

“Californians are being alerted of their right to direct the deletion of their genetic data under the Genetic Information Privacy Act and California Consumer Protection Act,” Bonta said. “Californians who want to invoke these rights can do so by going to 23andMe’s website.”

The alert provided step-by-step instructions for how consumers can direct 23andMe to delete their data, as well as steps they can take to request the company to destroy any of their saliva samples being stored by the firm. The AG also instructed consumers about how they can revoke their consent for their genetic and sample data being used for research.

“Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company,” Bonta said.

In general, consumers in some other states also are afforded these kinds of data deletion rights, said privacy attorney Adam Greene of the law firm Davis Wright Tremaine.

“This is a right that consumers only will have if they are in states that have enacted privacy laws providing deletion rights. While the number of states with such laws is growing, it still is less than half of the country.

But looking at 23andMe’s online privacy policy, “it appears that they are offering deletion rights to all consumers, regardless of the consumer’s state of residence,” he said.

23andMe has had privacy and security challenges in the past. In October 2023, the company confirmed a credential-stuffing incident involving information scraped off the profiles of 23andMe users who opted in to using the company’s DNA Relatives feature. DNA Relatives connects 23andMe users with genetic distant relatives – or other 23andMe users who share bits of DNA (see: 23andMe Investigation Apparent Credential-Stuffing Hack).

The company said the intruder was able to access about 14,000 user accounts, less than 1% of the company’s existing 14 million 23andMe customers.

But threat actors claimed on the dark web to have stolen “20 million pieces of code” from 23andMe. According to media reports, the leaked data that was put up for sale pertained to 23andMe users with certain DNA ancestry backgrounds, including 1 million lines of code about people with Ashkenazi Jewish DNA ancestry (see: 23andMe Says Hackers Stole Ancestry Data of 6.9M Users).

“The DNA data individuals may have provided to 23andMe is extremely valuable in the hands of a data broker or insurer,” Holtzman said.

“It could be used to discern your relatives and ancestry and reveal clues about diseases you have or could be predisposed to. Consumers who submitted DNA to 23andMe should carefully consider their choices for having their data deleted while the company still controls the data,” he said.

That data breach resulted in dozens of proposed class action lawsuits filed against 23andMe. Under a proposed $30 million settlement of about 40 consolidated class action lawsuits announced last fall, 23andMe agreed to make cash payments to millions of individuals whose sensitive information was compromised.

23andMe in a statement to Information Security Media Groups last September said the company expected that roughly $25 million of the settlement and related legal expenses will be covered by its cyber insurance policy (see: 23andMe to Pay $30M for Credential Stuffing Hack Settlement).

As for the company’s protection of data during the bankruptcy and potential sales processes, 23andMe reiterated to ISMG what it said in its public statement about there being “no changes” to the way the company stores, manages or secures customer data. 23andMe did not immediately respond to ISMG’s request for further details about those privacy and security protections.

Although 23andMe’s statement says data privacy will be an important consideration in any potential transaction, Greene said it is difficult to say how they will weigh privacy against maximizing shareholder value. “It may fall to regulators to ensure that any purchaser maintains the same level of privacy protections and enforces 23andMe’s prior public statements,” he said.

The Federal Trade Commission previously has made clear that a buyer of a business and its collected personal information must abide by the seller’s prior privacy policies unless consumers affirmatively consent to new privacy policies, Greene said. “Accordingly, any purchaser of 23andMe’s business will need to carefully consider whether 23andMe’s prior privacy promises fit with the buyer’s intended use of the data.”