MW 23andMe wants to sell its most valuable asset. Will your private DNA data be safe?

By James Rogers

'There is nothing specific in bankruptcy law that automatically protects the data of 23andMe's consumers in this situation,' law professor says

The bankruptcy of 23andMe Holding Co. has thrust the issue of data privacy firmly into the spotlight as the DNA testing company looks to sell its most valuable asset: a vast trove of customers' genetic data.

Since its founding in 2006, 23andMe $(ME)$ has racked up more than 15 million customers. But earlier this week, the struggling company initiated voluntary Chapter 11 proceedings at the U.S. Bankruptcy Court for the Eastern District of Missouri, with the goal of facilitating a sale.

In a statement, 23andMe said that it was committed to continuing to safeguard customer data and to being transparent about the management of user data, even though it may not have any legal obligation to do so.

"Data privacy will be an important consideration in any potential transaction," said Mark Jensen, chair and member of the Special Committee of 23andMe's Board of Directors.

Understandably, users are wondering how this will all play out through a sale of assets.

"There is nothing specific in bankruptcy law that automatically protects the data of 23andMe's consumers in this situation," Ana Santos Rutschman, law professor and faculty director of the Health Innovation Lab at Villanova University, told MarketWatch via email. "The Bankruptcy Code only says that companies cannot sell identifiable personal information unless the sale is enabled by that company's privacy policy."

What any buyers plan to do with that trove of data is the major open question and concern for some legal experts on genetic privacy.

Related: 23andMe files for bankruptcy. Here's what may be next for the DNA-kit company.

Santos Rutschman noted that there are a few states with privacy laws that allow customers to request that the company delete their data. "That is also 23andMe's policy, so that is an option for their customers, but it won't be automatic," she added. "Federal privacy laws (the ones that apply to hospitals, insurance companies and the like) don't apply to 23andMe, so in terms of legal protections this is basically it."

A number of attorneys general have already issued alerts to consumers amid 23andMe's struggles. Last week, California Attorney General Rob Bonta reminded Californians of their right to direct 23andMe to delete their genetic data under the Genetic Information Privacy Act (GIPA) and the California Consumer Privacy Act $(CCPA.UK)$.

Earlier this week, New York State Attorney General Letitia James similarly urged New Yorkers to take action to safeguard their data, reminding customers that they have a right to delete their genetic data and destroy DNA samples.

Related: 'I'm tired of being the product': Why I'd never use 23andMe or any other DNA testing service

The state of Indiana has been particularly proactive, with Attorney General Todd Rokita saying that Hoosiers should consider deleting their 23andMe accounts to protect their personal information.

Indiana has been investigating 23andMe since late 2023 following a data breach that year, as the state explained in a statement filed with the bankruptcy court this week. Citing the speed with which bankruptcy cases progress, the state said it was filing the statement "out of an abundance of caution and to put all parties on notice of the regulatory issues that will need to be addressed in any sale or transfer of the Debtors' business or assets."

The Indiana Attorney General's office has not yet responded to a request for comment from MarketWatch.

Attention is also focused on the potential role of an ombudsman - an appointed official tasked at protecting customers' privacy - in a sale of 23andMe's data, an issue that emerged during the first bankruptcy hearing in St. Louis this week.

Bloomberg reported that a lawyer with the U.S. Trustee's Office, which oversees the administration of bankruptcy cases, has said that a privacy ombudsman is necessary. However, a lawyer for 23andMe argued that this was unnecessary because of the company's privacy policies, according to Bloomberg.

The U.S. Trustee's Office has not yet responded to a request for comment from MarketWatch.

Related: Why you should delete your 23andMe account. Here's the worst that could happen if your DNA data is exposed.

Vilanova's Santos Rutschman said that a privacy ombudsman could play an important role.

"They represent the customer's privacy interests here," she told MarketWatch. "It's not just for show, they have the power to investigate what's happening (particularly what the privacy policy says and what the company is doing) and they can suggest that appropriate steps be taken to bolster privacy."

This, the professor explained, could be among mitigation measures that a court may require during the bankruptcy process, such as the deletion of a specific set of information from a specific database. "The court will take their opinion into account," she said.

"That being said, there has been some criticism of the ombudsman figure in other cases, especially because there's only a very small number of professionals working in this area, and also because many of them produce reports that are very standardized - leading some people to question their usefulness," Santos Rutschman added.

Requests for data deletion should be viewed within the broader context of 23andMe's business, according to Santos Rutschman.

"Even for customers that request that their data be deleted, that doesn't mean that the samples they have provided and (at least) some of the associated data that the company has collected will completely disappear: Much of it has already been transferred by 23andMe to other companies that are using it for research and development," she said. "Lastly: 23andMe's policy (which these consumers have agreed to) also states that the company will retain some data (even if de-identified)."

Related: 23andMe says there's 'substantial doubt' it can stay in business

23andMe has not yet responded to a request for comment on this story.

Andrew Keshner contributed to this report.

-James Rogers

This content was created by MarketWatch, which is operated by Dow Jones & Co. MarketWatch is published independently from Dow Jones Newswires and The Wall Street Journal.

(END) Dow Jones Newswires

March 27, 2025 15:54 ET (19:54 GMT)

Copyright (c) 2025 Dow Jones & Company, Inc.