DOJ Backs 23andMe Privacy Ombudsman in Response to FTC

The department issued the statement on behalf of the U.S. Trustee Program, a DOJ bankruptcy watchdog that argued in federal court on March 26 for the appointment of a privacy ombudsman.

FTC Chairman Andrew Ferguson on Monday told the U.S. Trustee office he believes 23andMe can sell users’ genetic data in its sale, but the buyer must honor the company’s original privacy terms and users’ right to delete (see 2503310057). He didn’t weigh in on the possibility of appointing a neutral party to make data-handling recommendations to the U.S. Bankruptcy Court for the Eastern District of Missouri.

“As previously expressed through counsel in bankruptcy court on March 26, the U.S. Trustee Program believes that a neutral party is necessary to protect consumers in the sale process,” DOJ said Monday. “As the watchdog of the bankruptcy system, the Program is closely monitoring this case and will act consistent with its statutory responsibilities to enforce the Bankruptcy Code’s requirements.”

The FTC declined to comment Tuesday.

23andMe issued a statement in support of Ferguson’s letter: The chairman “recognizes our commitment to protect customer data, including our stated commitment to continuing our privacy and security programs and requiring that any buyer of the company or our assets ‘expressly agree to be bound by and adhere to the terms of 23andMe's privacy policies and applicable law, including as to any changes it subsequently makes to those policies.’”

The company previously told the bankruptcy court a privacy ombudsman is unnecessary given extensive protections included in its existing privacy policies. U.S. Bankruptcy Judge Brian Walsh didn’t take a position on a potential neutral party. Carole Ryczek, an attorney with the U.S. Trustee Program, suggested the department appoint an ombudsman.

The value of the company in a sale will largely hinge on the ability for the buyer to leverage the genetic data the company has collected from some 15 million users around the world. Both Democratic and Republican state attorneys general have recommended users exercise their right to delete data via state privacy laws.

There’s a fundamental conflict here between consumer privacy interests and the company’s goal of maximizing value in the sale, said Reed Freeman, co-chair of the ArentFox privacy and data security group: If 23andMe’s privacy commitments aren’t kept, the FTC or state regulators could sue. “The target would be the bankrupt company, not the purchaser of the estate,” he said. “This issue has come up several times before, and it’s time for Congress to provide clarity on whether privacy interests can affect the value of a bankruptcy estate or not.”

Privacy attorney Abigail Dubiniecki outlined some possible scenarios if the court were to appoint an ombudsman. She said the neutral party could condition the sale on customer consent for transferring the data. Another option is to require the buyer to adhere to specific privacy policies after the sale, she said.