The House Committee on Energy and Commerce has launched an investigation into 23andMe following the company’s Chapter 11 bankruptcy filing in March.

Representatives Brett Guthrie, Gus Bilirakis, and Gary Palmer sent a letter to interim CEO Joe Selsavage, requesting details about the company’s data privacy practices by May 1.

Lawmakers are particularly concerned about the handling of sensitive genetic data during the asset sale process. They cited the 2023 hacking incident that exposed the data of nearly 7 million customers.

The congressmen also highlighted issues users face when trying to delete their data and the lack of federal privacy regulations for companies like 23andMe.

🔗 Source: CNBC

🧠 Food for thought

1️⃣ Genetic data faces a growing regulatory patchwork that leaves gaps

The 23andMe bankruptcy highlights a fundamental challenge in how sensitive genetic information is protected under U.S. law, as direct-to-consumer genetic testing companies typically operate outside of HIPAA protections that govern traditional healthcare data.

In response to this regulatory gap, individual states have been creating their own frameworks, with 11 states adopting genetic privacy bills over the past three years 1.

Most recently, Montana, Tennessee, Texas, and Virginia enacted genetic privacy laws in 2023 that require companies to publish privacy notices and establish security programs, but critics note these laws still have limitations regarding law enforcement access 2.

The Biden Administration has focused on genetic data privacy as part of broader efforts to protect sensitive personal information, recognizing that existing federal protections like the Genetic Information Nondiscrimination Act (GINA) primarily cover only employment and health insurance contexts 3.

This fragmented approach means that the fate of 23andMe’s genetic database, containing millions of highly personal DNA profiles, depends largely on which jurisdiction’s laws apply and how bankruptcy courts interpret them.

2️⃣ Corporate ownership changes pose unique risks for genetic information

While consumers are typically concerned about identity theft in data breaches, genetic information presents unique risks during company transitions like bankruptcies or acquisitions because DNA data is immutable and cannot be changed like passwords or credit card numbers 4.

The 23andMe situation demonstrates an under-addressed privacy vulnerability: what happens when companies holding vast genetic databases undergo ownership changes, with 30 million people globally having used genetic testing services 5.

Even with privacy policies that promise protection, these policies can be modified or interpreted differently by new owners, as highlighted by consumer advocates who specifically warn about the risks of companies going out of business or being sold 5.

Recent 23andMe developments