23andMe has filed for bankruptcy. What could happen to users' genetic data?
Over the weekend, genetic testing and biotechnology company 23andMe filed for Chapter 11 bankruptcy.
Founded in 2006, the company became popular with millions of Americans who sent in samples of saliva with the promise of learning about their ancestry and genetic health predispositions.
However, following a class-action settlement from a data breach, the resignation of the entire board of independent directors, layoffs and its drug development division closure, the firm has experienced business troubles and said it may be looking for a buyer.
"The Company intends to continue operating its business in the ordinary course throughout the sale process," 23andMe said in a statement this week. "There are no changes to the way the Company stores, manages, or protects customer data."
23andMe directed ABC News to its statement in a request for comment as well as to an open letter to its customers.
The bankruptcy filing has led to concerns over what will happen to the personal and genetic information of 23andMe's more than 15 million consumers worldwide.
"I don't think they ever built sufficient consent into people sending them information, saying, 'We'll do our best to protect it, but we can't promise,"' Dr. Arthur Caplan, a professor of bioethics at the NYU Grossman School of Medicine, told ABC News.
"So, what you might have thought was safe and secure is clearly not, as the bankruptcy is making clear now, but hasn't been from the beginning," he added.
Anya Prince, a professor at the University of Iowa College of Law with research interests in health and genetic privacy, said what happens to the data 23andMe collects is covered by the company's privacy policy.
In the event of a bankruptcy or sale, a user's 23andMe data can go to a new company or be sold in bankruptcy, Prince noted.
"The privacy policy also says that the new company has to follow the existing privacy policy, which sounds great, but the existing privacy policy also says that it can be changed at any time," Prince told ABC News. "So, the new company could adopt the same privacy policy and then change it in ways that maybe the customers don't like."
I. Glenn Cohen, a professor of health law and bioethics at Harvard Law School, told ABC News that in one of 23andMe's bankruptcy filings, the company indicated that any bidder would have to express compliance with the current privacy statement.
However, it's not uncommon for a new company to issue a new privacy statement and to ask people to click through to agree, he said.
One example of a change could be in how a new company would handle handing over data to law enforcement.
"Under the current 23andMe privacy rules, they will wait for a valid subpoena, search warrant or court order" before sharing data with law enforcement, Cohen said. "It's possible this new company would have a different approach and would get you to opt in to their privacy statements such that the information might be more readily shared with law enforcement or possibly with employers and insurance."
Additionally, about 80% of 23andMe users have selected the additional opt in for their data to be used for medical research.
Under existing 23andMe policy, when the data is shared with companies for research, it doesn't have names attached to the genetic samples. While the data might be anonymous for the company that is conducting the research, it isn't necessarily anonymous at 23andMe, experts told ABC News.
Cohen said that data will also transfer over to a new company as part of bankruptcy proceedings.
This information is not protected by HIPAA, which is a law that protects patient privacy and ensures the security of health information.
"Unlike your health records, which are covered by HIPAA, your electronic health records, and the kind of data you share with your doctor … 23andMe does business with you as a consumer, not as a patient," Cohen said. "You don't get those overall federal health privacy protections that we give, for example, to the data you share with your doctor."
Added Caplan: "The privacy law we have applies to information in health care settings. It doesn't apply to protecting information that you gave freely to a private company."
Consumers have the option of deleting their account and asking for their sample to be destroyed, especially if they are in a state that has a genetic privacy law, such as California.
California's Attorney General Rob Bonta put out a press release with steps on how to delete genetic data, destroy a test sample and to revoke permission for genetic data being used in research.
"There might be people out there who say, 'I'm fine with that, I think the risks are low, and I'm happy for a new company to share my data in x, y or z way,'" Prince said. "But to the extent that that it's somebody who does say, 'Oh, I didn't realize that that's how my data can be shared, or I just I trusted 23andMe but I don't know whether I trust the next company that might have this data, then they might want to consider going in and deleting that account."
