Bankrupt genetic testing company 23andMe wants to put its vast store of genetic data up for auction in order to repay creditors, but customer privacy concerns and a patchwork of state data protection laws could throw this plan into disarray. In its Chapter 11 sale procedures motion, the company said it will only accept bids from companies that comply with its existing privacy policy.
Lucy Porter told Law360 there was nothing preventing23andMe from changing its data sale policy previously — and nothing to prevent the eventual buyer from changing it in the future except compliance with certain state laws. “Typically, no law outright prohibits the sale or the transfer of this type of information,” she said.
There are currently no federal laws governing the use of 23andMe’s genetic data, as it isn’t a healthcare provider and therefore does not fall under the Health Insurance Portability and Accountability Act that governs the treatment of medical records. Instead, the use of the data falls under a “patchwork” of data privacy laws that have been enacted in 20 states and are now in effect in 13 of them, offering varying degrees of protection, usually including at least notification of the sale or transfer of data, Porter said.
