Privacy Ombudsman Endorses Added Consent, Other Safeguards Before Transfer of 23andMe Data
The Consumer Privacy Ombudsman (CPO)'s report on the 23andMe bankruptcy case recommends requiring separate, affirmative consent from consumers for the sale of genetic data before a sale of the company occurs. Neil Richards, appointed CPO on May 6, also recommended posthumous data safeguards and guaranteed duty of loyalty, among other suggestions, in the 211-page document filed Wednesday at the U.S. Bankruptcy Court for Eastern Missouri.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
"An additional important safeguard from a consumer privacy perspective would be to require the winning bidder to make an important substantive promise not to use Company customer data in a way that is inconsistent with the best interests of the data subject," Richards wrote.
Regarding posthumous safeguards, Richards suggested whoever oversees the company's data after a sale should employ clear procedures for how next-of-kin can assume control over and delete genetic data; send emails to accounts that have been inactive for three years; delete accounts of consumers who do not respond after six months; and clarify that research consent does not extend past the death of the customer unless explicitly stated otherwise.
The biotechnology company, which filed for bankruptcy in March, has been under fire recently over concerns about privacy violations and genetic data from a potential sale to a third party (see 2503240046).
On Monday, a group of bipartisan state attorneys general filed a lawsuit against the company and objected to the sale of its data without specific customer consent; other states have since joined the group (see 2503240046).
During a House Oversight Committee meeting on Tuesday, company founder Anne Wojcicki and interim CEO Joe Selsavage defended the 23andMe's privacy practices. The next day, the Senate Judiciary Committee grilled Selsavage about privacy and national security concerns (see 2506110047).