23andMe, the company that has used at-home DNA testing kits to help an estimated 15 million people learn more about their ancestry, now claims they can sell the private information of their customers to third parties.
Having recently filed for bankruptcy in the Eastern District of Missouri, 23andMe is attempting to sell its company assets, including the stored private information of its customers. This has led to twenty-seven (27) states — including New Jersey and New York — suing 23andMe to stop the massive sale of such personal and private information.
In their lawsuit, the Attorneys General argue that this sale would include “an unprecedented compilation of highly sensitive and immutable personal data: a human being’s permanent and everlasting genetic identity (their genome).” Furthermore, the Attorneys General argue that a sale of such highly sensitive data should not be permitted without “first obtaining express and informed consent from each customer” and that “customers have inherent common law rights of ownership or control in (a) their biological matter (i.e., their spit); (b) their Genotype Data (i.e., Their DNA code, which may include their entire genone); and (c) their personal information, including Profile Data..”
23andMe argues that the sale complies with relevant privacy laws and company policies. On 23andMe’s website, it states their bankruptcy filing does not change how the data is managed or stored and that, “[i]f the company is sold, any new owner must follow the law when it comes to your data. Through the sales process, 23andMe will look to secure a partner who shares in its commitment to customer data privacy and will further its mission of helping people access, understand and benefit from the human genome.” As pointed out, per 23andMe’s terms of service, it specifically states that if 23andMe is sold, the new owner must comply with all relevant laws pertaining to the data. And while it states that customers have the option to individually delete their personal data from the 23andMe website, it does not deny that personal data will be sold to a new owner.
Further complicating matters, the highest bid to purchase 23andMe and their assets came from TTAM Research Institute, a non-profit led by the 23andMe’s co-founder and former CEO, for $305 million. This adds a wrinkle to the legal complexity as many state consumer privacy laws do not apply to non-profit organizations.
At the heart of this lawsuit is the weighing of individuals’ privacy rights versus a business’s ability to commodify voluntarily submitted personal data. PTGB Law Blog will continue to monitor this case and provide updates on important legal questions it raises.
With further questions about your data privacy rights, please feel free to contact PTGB Law at 201-569-5959.
