Over the weekend, genetic testing and biotechnology company 23andMe filed for Chapter 11 bankruptcy.
Founded in 2006, the company gained popularity among millions of Americans who submitted saliva samples to learn about their ancestry and genetic health predispositions.
However, the company has faced significant challenges, including a class-action settlement following a data breach, the resignation of its independent board of directors, layoffs, and the closure of its drug development division. Amid these difficulties, 23andMe has indicated it may seek a buyer.
“The Company intends to continue operating its business in the ordinary course throughout the sale process,” 23andMe stated this week. “There are no changes to the way the Company stores, manages or protects customer data.”
The bankruptcy filing has raised concerns about the fate of personal and genetic data from over 15 million consumers worldwide.
“I don’t think they ever built sufficient consent into people sending them information, saying, ‘We’ll do our best to protect it, but we can’t promise,'” said Dr. Arthur Caplan, a professor of bioethics at the NYU Grossman School of Medicine, in an interview with ABC News.
Approximately 80% of 23andMe users have opted to allow their data to be used for medical research. According to the company’s policies, when shared with research partners, the genetic data is stripped of personal identifiers. However, while it remains anonymous to external researchers, experts suggest it is still identifiable within 23andMe’s internal systems.
As part of the bankruptcy proceedings, consumer data will be transferred to any new owner. Notably, this information is not protected under HIPAA, the federal law safeguarding patient privacy and health information security.
Consumers concerned about their data have the option to delete their accounts and request the destruction of their genetic samples. Those in states with genetic privacy laws, such as California, may have additional protections.