Photo credit: arstechnica.com
The legal proceedings surrounding 23andMe’s bankruptcy have raised significant concerns regarding the privacy and security of genetic data held by the company. Chairman of the Federal Trade Commission (FTC), Andrew Ferguson, is closely monitoring this situation, emphasizing the importance of maintaining commitments made to consumers regarding their sensitive information. His comments were conveyed in a letter addressed to representatives of the U.S. Trustee Program, which is responsible for overseeing bankruptcy administrations.
In his communication, Ferguson highlighted the need for utmost vigilance regarding the potential sale of 23andMe, which holds a wealth of personal data from millions of users, including genetic information, DNA samples, health records, ancestry details, and more. He stated, “The FTC is keenly aware of the implications this situation holds for the personal data of American consumers who have utilized the Company’s genetic testing and telehealth services.”
The recent announcement by 23andMe about their bankruptcy has spurred a wave of anxiety among its user base, which encompasses around 15 million individuals. In response to these developments, the company reassured its users that “any buyer of 23andMe will be required to comply with our privacy policy and with all applicable law regarding customer data management.” Despite this, many users have opted to delete their data, though technical difficulties reportedly hindered this process due to increased traffic seeking to access the site.
Adding to the concerns surrounding the company is the revelation that hackers obtained ancestry data from approximately 6.9 million users, which was confirmed by 23andMe in December 2023. This incident raises further questions about the company’s ability to protect users’ sensitive information.
The bankruptcy case is currently being overseen by the U.S. Bankruptcy Court for the Eastern District of Missouri.
FTC Reiterates the Importance of Consumer Protections
In his letter, Ferguson reinforced the necessity for 23andMe to honor its commitments regarding data privacy. He referenced provisions under Section 363(b)(1) of the Bankruptcy Code, which he argues mandates that promises made to consumers in relation to their personal data must be upheld, especially in a bankruptcy context. “This ensures that any sale or transfer of 23andMe users’ personal information and biological samples will adhere to the assurances the Company has made concerning privacy and data security, which users relied upon when providing their information,” Ferguson wrote. He also emphasized that any potential purchaser must explicitly agree to comply with the company’s established privacy policies and legal standards, including any future amendments to those policies.
Source
arstechnica.com