Attendees purchase DNA kits at the 23andMe booth at the RootsTech annual genealogical event in Salt Lake City, in February, 2019.GEORGE FREY/Reuters
The U.S. bankruptcy filing of 23andMe, one of the biggest direct-to-consumer genetic testers in the world, is raising concerns about what will happen to the personal health information of millions of users if the company is sold.
The San Francisco-based company was credited by Time magazine with the best invention of 2008 for its saliva-based, at-home DNA test that would report a customer’s ancestry, promising results down to a tenth of a percentage point. It later added health services that would use the genetic results to make drug recommendations or offer guidance on causes of migraines, for example.
Held privately for years, 23andMe made its debut on the U.S. stock market in 2021 and peaked at a valuation of US$6-billion. But sagging revenue and a major privacy breach disclosed in 2023 saw the value of the company plummet. A document filed in U.S. bankruptcy court Sunday valued the company at under US$500-million.
The company said in a statement that it was making the filing to facilitate the sale of its assets and to “resolve all outstanding legal liabilities” from the privacy breach.
That incident saw hackers steal the personal genetic information of 6.9 million customers and put the data up for sale on the dark web, a covert part of the internet often used to sell illicit goods and services.
Users launched class-action lawsuits in jurisdictions around the world, alleging that they were harmed by the privacy breach. One suit in the U.S. was recently settled for US$30-million.
23andMe on March 23 filed for bankruptcy in the U.S. after struggling with the fallout of a data breach and weak demand for its ancestry testing kits, and now experts say anyone who used the service should take action to protect their data.
Reuters
A class-action lawsuit filed in British Columbia is still continuing. Sage Nematollahi, a partner at KND Law and lawyer on the case, said the next hearing is currently scheduled for June.
The company’s most important asset is the genetic database it has built of 15 million customers. In searching for new revenue streams, 23andMe has licensed what it says are deidentified versions of the data to pharmaceutical companies, including British pharma giant GSK PLC, to aid in research for new drugs. (On Sunday, co-founder Anne Wojcicki said 85 per cent of users had opted to allow their data to be used for research.)
The company said in an open letter to customers Sunday that any buyer of 23andMe “will be required to comply with applicable law with respect to the treatment of customer data.”
But Teresa Scassa, Canada Research Chair in information law and policy at the University of Ottawa, said there are still uncertainties about what the sale process will mean for customers’ data.
“Some of the concerns a sale might raise include how the purchaser plans to use the data, as well as their own cybersecurity infrastructure to properly protect the data,” Prof. Scassa said.
She said it was noteworthy that California’s Attorney-General had issued an urgent consumer alert reminding users of their legal right to request that their data be deleted from 23andMe’s servers.
Last summer, privacy commissioners in Canada and Britain launched an investigation into the company’s data breach.
On Monday, the British Information Commissioner’s office said it had informed 23andMe earlier this month about its preliminary findings and planned to issue a £4.59-million ($8.49-million) fine and an enforcement notice. The office said in a statement it was monitoring the sale and was in touch with the company.
The Office of the Privacy Commissioner of Canada did not respond to a request for comment by deadline.
Ms. Wojcicki, the co-founder, resigned from her position as chief executive officer on Sunday to pursue an independent bid to buy the company.
“There is no doubt that the challenges faced by 23andMe through an evolving business model have been real, but my belief in the company and its future is unwavering,” she said in a statement posted on social media.
Her attempts to buy the company last year prompted the board’s seven independent directors to resign, saying in an open letter that they had “a protracted and distracting difference of view” with Ms. Wojcicki. They did not elaborate.
With reports from Reuters