23andMe bankruptcy fallout: AG’s office says protect your data
John Rogers
Business Journal
The Utah Department of Commerce’s Division of Consumer Protection (DCP) and the office of the Utah Attorney General are cautioning Utahns regarding the recent bankruptcy filing by 23andMe, a direct-to-consumer genetic testing company based in Lehi.
“Utah residents should be aware of their rights and the protections afforded to their genetic data under the Utah Consumer Privacy Act (UCPA) and the Genetic Information Privacy Act (GIPA),” the two agencies said in a joint release. “Since this data is incredibly personal and sensitive, it’s important to understand your rights under Utah’s privacy laws, including how to delete your genetic data from 23andMe.”
The genetic testing firm’s parent company, 23andMe Holding Co., has won permission from a judge to try to sell information about customers’ medical and ancestry-related data — a cache that is considered the most valuable asset in the bankruptcy case — and has become a source of privacy and safety concerns amid the company’s collapse.
Shares in the company surged on the news of the judge’s ruling, jumping as much as 158 percent as investors speculated that the bankruptcy could bring in enough cash to pay them something once all of 23andMe’s debts are paid. Under bankruptcy rules, any sale would need to bring in more than the company owes creditors — at least $214 million, according to court records — before anything could be paid to shareholders.
Under the 23andMe’s sale plans, the company set quickly arriving deadlines for potential bidders, including May 7 when definitive offers are due, and a final hearing in early June. But U.S. Bankruptcy Judge Brian C. Walsh required the company to slow the overall pace by two weeks, in part to accommodate his schedule and in part to give creditors a chance to weigh in before the court makes a final decision on a buyer.
“My reaction to the timeline is that it’s pretty tight,” Walsh said at the company’s first bankruptcy hearing, held in St. Louis. At his request, the company agreed to push back the final court hearing for the possible sale of assets from June 2 to June 17.
Walsh’s ruling didn’t resolve concerns raised by the looming auction of the sensitive data or complaints from shareholders about the months 23andMe spent trying to find a buyer before filing for court protection early in March.
The company has said the Chapter 11 reorganization doesn’t change how it stores or protects personal data and that any buyer will be required to comply with applicable laws with regard to the treatment of such information. The company allows customers to delete the genetic details and other information in their account and to have their saliva, blood or other bodily tissues removed from the company’s “biobank,” according to the court.
The news release from Utah’s consumer protection organizations outlined Utah consumers’ rights under UCPA and GIPA, including the right to rescind access or to request 23andMe to delete a consumer’s account and genetic data.
“In light of the company’s financial difficulties and the potential risks to your sensitive information, you may want to consider this,” the agencies’ release said.
Consumers can also request the destruction of their genetic samples. If customers who previously submitted biological test samples to 23andMe wish to ensure that they are no longer stored or used, they have the right to make this request.
The release from DCP and the attorney general’s office goes on to detail how to accomplish these tasks, including step-by-step procedures for accessing and deleting a 23andMe account. These instructions can be accessed at the DCP website, https://dcp.utah.gov/.
The release also said that a consumer can opt out of the company’s sale of personal data as part of the bankruptcy procedures and gives instructions for doing so.