SUNNYVALE, CALIFORNIA - FEBRUARY 01: A sign is posted in front of the 23andMe headquarters on February 01, 2024 in Sunnyvale, California. Genetic testing company 23andMe, once valued at $6 billion, is facing the possibility of delisting from NASDAQ as the company navigates numerous class action lawsuits (Photo by Justin Sullivan/Getty Images)
A bankruptcy judge has approved the sale of the financially troubled genetics company 23andMe to a nonprofit organization led by one of its co-founders, effectively averting the controversial transfer of its extensive DNA database to a third party. The decision, made by Judge Brian Walsh of the U.S. Bankruptcy Court in the Eastern District of Missouri, comes after significant public outcry and legal challenges regarding the potential sale of sensitive genetic data.
The initial announcement in May that New York-based Regeneron Pharmaceuticals had won an auction to acquire 23andMe for $256 million sparked widespread concern. The prospect of millions of individuals’ genetic information being sold to the highest bidder raised alarms about privacy and data security. Despite Regeneron’s assurances to uphold 23andMe’s privacy policies, more than two dozen states filed lawsuits to halt the transaction.
The Nonprofit Solution
Following the legal challenges, the bidding process was reopened, and the TTAM Research Institute emerged as the new buyer with a successful bid of $305 million. Founded in May by Anne Wojcicki, a co-founder and former CEO of 23andMe, TTAM aims to acquire the company’s assets and utilize the DNA data for medical research purposes. According to 23andMe, approximately 80% of its over 15 million customers have consented to their data being used for research.
The acronym TTAM is a nod to “twenty-three and me,” and the institute has pledged to enhance privacy policies while maintaining the ability for customers to delete their data at will, as previously allowed by 23andMe.
Legal and Ethical Implications
Judge Walsh’s ruling highlighted that the sale of customer data is “only in a technical sense,” addressing concerns that genetic information is a unique form of property. The lawsuit filed by the states aimed to ensure that consumers retain full control over their genetic data, which is inherently personal and immutable.
“It’s going to be under the same privacy policies, the same cybersecurity protections, same management as it was before,” said Justin Leonard, a lawyer representing Oregon in the lawsuit.
However, not all states are satisfied with the outcome. California, Kentucky, Tennessee, Texas, and Utah remain opposed to the sale and have until midnight on July 7 to seek a stay and appeal the decision.
Data Security Concerns
The legal battle has underscored the risks associated with transferring consumers’ DNA data to third parties, particularly in the wake of a significant data breach in 2023. During this breach, hackers accessed the genetic information of millions of 23andMe customers, heightening concerns about data security.
For customers like Kyle, who discovered his Ashkenazi Jewish heritage through 23andMe, the potential risks of data exposure are particularly concerning. Following the announcement of the sale to Regeneron, Kyle chose to delete his family’s genetic data, citing historical concerns within the Jewish community about the misuse of such information.
“I think historically there is a concern amongst the Jewish community for people knowing who we are, where we live and our genealogy. And if that information gets into the wrong hands it’s very dangerous,” Kyle explained.
Future Implications and Legal Considerations
Judge Walsh acknowledged the complexities of selling genetic data, describing it as a “scary proposition.” However, he noted that lawmakers have not prohibited such sales, and an “absolute prohibition” could lead to missed opportunities, though he did not specify what those opportunities might entail.
Last year, 23andMe reached a settlement in a data breach lawsuit without admitting wrongdoing. The funds from the sale to TTAM Research Institute may be sufficient to compensate all of the company’s creditors, including customers affected by the breach.
The case sheds light on the lack of comprehensive laws safeguarding genetic privacy and raises questions about the legal status of DNA data. Laura Coordes, a bankruptcy expert at Arizona State University’s law school, emphasized the need for legislative action to strengthen data privacy protections.
“My hope is that the issues that this case raises and the attention that it’s gotten will in turn spur some meaningful thought about data privacy protections, and those protections in a bankruptcy,” Coordes stated.
As the legal proceedings continue, the outcome of this case may prompt further discussions on how to balance innovation in genetic research with the protection of individual privacy rights. The decision to sell 23andMe to a nonprofit led by its founder represents a significant step in addressing these concerns, but the debate over genetic data privacy is far from over.
