Senators Grill 23andMe; Detractors Object to Genetic Data Sale at Bankruptcy Court
Senators raised national security concerns and urged bankrupt 23andMe to obtain specific consent from customers before it sells their personal data during a Judiciary Committee hearing Wednesday. Meanwhile, on Tuesday, several groups objected to the company's bankruptcy sale in the U.S. Bankruptcy Court for Eastern Missouri.
Sign up for a free preview to unlock the rest of this article
23andMe declared bankruptcy in March and is in the process of a court-supervised sale. However, detractors say details about the state of customers' data are thin and have objected to a sale.
During the hearing, Sen. Josh Hawley, R-Mo., grilled 23andMe interim CEO Joe Selsavage about the company’s privacy policies, essentially accusing the executive and his company of violating the law.
"Nothing is worse than taking the personally identifiable information of American consumers, keeping it and lying to them about it, while you make a huge profit off of it," Hawley said to Selsavage. "It's unbelievable to me. It's absolutely unbelievable.”
Senators Dick Durbin, D-Ill., and Adam Schiff, D-Calif., questioned why the biotech company hadn't gained affirmative consent from consumers on the sale of their data.
“I can take that suggestion back to our team,” said Selsavage, though he said 23andMe believes it obtained affirmative consent through customer sign-up and consent to the company’s privacy policy.
Lawmakers broached national security implications of the sale, noting foreign adversaries, such as China, might gain access to 23andMe data. Selsavage said to the best of his knowledge, there have been no data breaches.
“You seem a bit naive to think that you haven't had any breaches or any … cyber-attacks,” said Sen. Marsha Blackburn, R-Tenn. “Our critical infrastructure in this country is hit many times a day.”
Senators mentioned the issue of 23andMe customers attempting to delete their data before the company is sold. Sen. Amy Klobuchar, D-Minn., said some customers ran into technical issues attempting to delete their data. In addition, she asked about the backlog of deletion requests. However, Selsavage said there is no backlog, and the company is current on all deletion requests.
Despite this, 23andMe customer David Neal filed a motion for intervention on Tuesday, alleging he attempted to delete his personal data from the company's files at the end of March. Neal claims a technical malfunction blocked him from doing so.
Meanwhile, at the bankruptcy court, Texas filed an objection to the sale late Tuesday. That followed a joint objection from a bipartisan coalition of 28 states Monday (see 2506100051). Texas' complaint alleges 23andMe would violate state law if it moves consumers' data without obtaining specific consent.
"A consumer’s click-through acceptance of the Debtors’ terms of service and/or privacy policies upon signing up for services does not meet the consent requirements as defined by the [Direct-To-Consumer] Genetic Testing Act or the [Texas Data Privacy and Security Act]," the objection said.
“As such, Texas requests the Court deny the Motion for Sale as proposed, and in the alternative, require the Debtors and/or any approved Purchaser to obtain express, separate, affirmative consent to the sale from Texas customers prior to the sale closing."
On Wednesday, Alaska filed a notice that it had joined the objection brought by California on Monday, also citing violation of state law as a reason that the sale of 23andMe should be stopped.
"Under Alaska law, it is illegal and, if done knowingly, a crime, for a person to analyze DNA samples, retain DNA samples, or disclose DNA test results without the informed written consent of the person whose genes the DNA reflects or their legal guardian or authorized representative," the state's complaint said. "23andMe has never received informed consent from Alaskans that would allow it to disclose their genetic testing results."
A group of intellectual property, health law and bioethics scholars filed an objection to the sale as well on Tuesday, asking the court to mandate a commitment from whoever buys 23andMe to continue the “policy of royalty-free licensing of Research Consented Data to all legitimate academic researchers.” Their concern was that a biopharmaceutical company may view the data “as a proprietary research tool reserved for its internal use.”
Healthcare company Labcorp, IT firm Telus and system software outfit Workday, which have contracts to provide services to 23andMe, also submitted objections to the bankruptcy proceedings, alleging amounts listed in the Cure Notices are incorrect.