- 23andMe has filed for Chapter 11 bankruptcy and plans to sell the company through a 45-day auction process.
- The company promises to safeguard customer data throughout the transition, but privacy concerns have prompted California's attorney general to urge users to delete their data.
- According to the company's privacy policy, user data could be transferred to new owners in the event of a sale or acquisition.
The biotechnology company 23andMe announced Sunday that company leaders have initiated Chapter 11 bankruptcy and plan on selling the company, raising sensitive data protection concerns.
The company maintains that they will continue to “safeguard customer data” and be “transparent about the management of user data going forward,” but attorneys general across the U.S., including Utah Attorney General Derek Brown, have released alerts urging 23andMe patrons to delete their data.
The Washington Post on Monday reported, “If you’re one of the 15 million people who shared your DNA with 23andMe, it’s time to delete your data.”
23andMe uses saliva to analyze a user’s DNA to provide in depth information on their genetics, ranging from ancestry to potential health risks, as the Deseret News previously reported.
However, after a massive data breach in 2023 exposing nearly 7 million customers' personal information over five months, the biotech company’s stock has been on the decline.
On Monday, the company’s co-founder Anne Wojcicki resigned after failed attempts to take the company private, and shares fell 50% to 88 cents, per Reuters.
The company is seeking approval from a bankruptcy court to run a 45-day auction to sell off its assets. In the meantime, the company has $35 million to keep day-to-day operations running, according to a 23andMe press release on Sunday.
What happens to 23andMe data if the company is sold?
In the case of a change in ownership, the DNA genetic testing company states in their privacy section the following:
“If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction and this Privacy Statement will apply to your Personal Information as transferred to the new entity. We may also disclose Personal Information about you to our corporate affiliates to help operate our services and our affiliates’ services,” it states.
What can you do to protect your genetic data?
In a press release, Utah’s Department of Commerce’s Division of Consumer Protection and the Attorney General’s office cited Utahns rights to protect their genetic data, as defined under the UCPA and GIPA.
Those rights include the right to rescind access to your own genetic data, the right to request data destruction and the right to delete your own account.
“In light of the company’s financial difficulties and the potential risks to your sensitive information, you may want to consider this,” the joint release stated.
Similarly, California Attorney General Rob Bonta encouraged people in his state to delete their data and provided steps to take to do so.
In a statement, he wrote, “Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company.”