8th Circuit Denies Calif. Appeal Alleging 23andMe Sale Violates Privacy Law
A court denied California's attempt at halting the sale of 23andMe to the nonprofit TTAM Research Institute on Thursday, removing yet another hurdle in the transaction's path.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
The 8th U.S. Circuit Court of Appeals made the ruling in case 25-2361 (on appeal from the district-level case 25-00999), though no explanation was given for the decision. California argued the sale violated the California Genetic Information Privacy Act, which requires consumer consent when genetic data is sold (see 2507110046).
The sale of the company closed on July 11 (see 2507150083), after Bankruptcy Judge Brian Walsh approved the transaction on June 30 (see 2507010052). California Attorney General Rob Bonta (D) filed an appeal on July 11.
A bipartisan group of state AGs initially opposed the sale of 23andMe and its genetic data (see 2506100051 and 2506110047), but a majority ended up supporting the deal when TTAM emerged as the buyer (see 2506180018) and 2506200016).
Foley Hoag lawyers Alison Bauer and Colin Zick said in a Friday blog post that this case revealed that companies should maintain up-to-date privacy policies, track all state requirements and have transparent communication with customers when dealing with sensitive genetic data.
"A central point of contention [from the states] was the transfer of genetic data without the renewed, opt-in consent of existing 23andMe customers," the lawyers said. "23andMe and TTAM contended that because the acquiring entity would honor the existing privacy commitments and maintain the company’s privacy policy, no separate opt-in consent was legally required."
Though many of the states ended up approving the sale specifically to TTAM, "the persistent objections from various state attorneys general serve as a reminder that consumer data privacy, particularly where genetic information is involved, remains a point of intense legal scrutiny," Bauer and Zick said.
"Courts may closely evaluate whether an organization’s privacy policies have explicitly contemplated the scenario of a sale, merger, or bankruptcy," so "clear, early disclosure can help mitigate or defend against future consent objections," the lawyers added. Also, "strong privacy and security commitments, as well as readily accessible data deletion or opt-out procedures, may help avert steep legal challenges," like in instances where regulators "scrutinize a company’s post-transfer safeguards," even if the transaction is permissible under law.
"Many of the objections against 23andMe and the purchaser arose from concerns that customers did not fully comprehend the possibility of data transfers in bankruptcy," the lawyers noted. "Transparency and ongoing updates will help customers make informed decisions about their personal information."