The genetic testing company 23andMe is filing for bankruptcy, raising concerns about the safety of millions of customers’ sensitive data in the absence of clear regulatory safeguards, reports US media outlet NPR.
In a statement issued this week, the California-based biotech firm announced it had entered the federal bankruptcy process with the goal of finding a buyer to address its ongoing money troubles. Co-founder and former CEO Anne Wojcicki, who recently stepped down, had her offer to purchase the company rejected by the board earlier this month. Wojcicki reiterated her desire to purchase the company on X in response to news of the bankruptcy.
23andMe, founded nearly 20 years ago, was valued at US$6 billion when it went public in 2021 but has struggled financially for years as the majority of its more than 15 million customers opted for a one-time DNA test, rather than becoming repeat users. Last November, the company laid off over 200 employees, cutting their staff by around 40 percent.
Beyond its corporate future, the bankruptcy raises concerns that those users’ sensitive data – including their saliva samples and detailed genetic profile – could be at risk. Suzanne Berstein, counsel at the nonprofit Electronic Privacy Information Center, explained to NPR that the clear legal protections governing such data in hospital and research settings simply do not exist for private companies. “The scale of how much highly sensitive data 23andMe has is unique.”
The company’s FAQ about the bankruptcy assures users that the new owner will have to abide by “applicable law.” However, Anya Prince, a University of Iowa law professor who studies health and genetic privacy, outlined two federal laws that relate to the type of sensitive health data held by 23andMe, but noted that neither applies to the company.
[See more: Macao residents urged to sign onto stem cell registries]
At least 11 states have enacted their own laws giving consumers a say in how their genetic data is used, typically allowing users to request their data be deleted, but that leaves much of the US without any clear legal protection.
Customers in one of the more than 40 other countries that 23andMe ships to must rely on domestic laws, like the European Union’s General Data Protection Regulation (GDPR).
Absence of clear regulatory protections doesn’t mean that users are helpless, however. Bernstein advised any concerned 23andMe customers to revoke any permissions they may have given for their genetic data to be used in research, request their saliva sample be destroyed and delete their data – options that the company has said will be available through the bankruptcy proceedings. She also told NPR that users should take this as an opportunity to advocate for “state and federal representatives to pass stronger consumer privacy laws.”
Prince pointed out that many users may not know how their data is already being used. Some 85 percent of 23andMe customers are opted in to research, as Wojcicki noted in her X post, but few likely know that their genetic information has enabled novel drug discovery and 50 programmes with pharmaceutical giant GSK, as well as over 250 scientific publications.
23andMe says that any genetic data shared with researchers is stripped of identifying information, like names and birth dates. “Everybody’s worried about what a new company can do with the data — and that is a concern — but frankly some of the things that people are worried about, 23andMe already can do or already does,” Prince told NPR.
