Privacy Questions Remain in 23andMe Bankruptcy Sale
It’s unclear if enforcers like the FTC can require the buyer of 23andMe to honor the company’s privacy policies if the buyer doesn’t publicly state its intention to do so, according to Reed Freeman, co-chair of the ArentFox privacy and data security group.
Sign up for a free preview to unlock the rest of this article
Regeneron Pharmaceuticals on Monday announced its winning bid to purchase most of 23andMe’s assets for $256 million (see 2505190047). The deal is subject to court and regulatory approval. The U.S. Bankruptcy Court for Eastern Missouri appointed a consumer privacy ombudsman (CPRO) to assess privacy implications in the sale.
As Freeman noted in a post Thursday, the ombudsman's recommendations are non-binding, but judges often defer. “Even if the new buyer were required to comply with the 23andMe’s current privacy policy, there is no way to guarantee that the new buyer will retain those policies once it owns the data,” he wrote.
“Moreover, it is not clear that regulators, such as the FTC, could enforce the policy against a new buyer absent its own public representation to do so.” Freeman said if the “terms of the sale fail to resolve privacy concerns or are in contravention of any states’ applicable privacy laws, we can expect objections to be filed and a contested sale.”