The company, which filed for Chapter 11 bankruptcy protection, says that ‘data privacy will be an important consideration in any potential transaction.’
The Federal Trade Commission (FTC) said it was worried about the safety of the personal data of Americans who were previously customers of genetic testing company 23andMe.
On March 23, 23andMe filed for Chapter 11 bankruptcy protection, seeking authorization to “sell substantially all of its assets.” The company said it was committed to “continuing to safeguard customer data” and that “data privacy will be an important consideration in any potential transaction.”
Attorneys general of California and New York have already urged users to remove their data from the company website to prevent it from being sold.
Now, the FTC has also picked up the issue. The agency has “concerns relating to the potential sale or transfer of millions of American consumers’ sensitive personal information,” FTC Chairman Andrew N. Ferguson said in a March 31 letter to the Office of the U.S. Trustee.
“It is my understanding that 23andMe user data may be an asset that is sold” as part of the company’s bankruptcy process, he wrote.
Since its launch in 2007, 23andMe has collected various data points from U.S. customers, including “genetic information, biological DNA samples, health information, ancestry and genealogy information, personal contact information, payment and billing information, and other information,” the letter states.
During its operational period, the company told customers it would protect user data and not share it with unauthorized third parties.
According to the company’s privacy statement, updated on March 14, if 23andMe is involved in bankruptcy, and customers’ personal information is sold as part of the transaction, the privacy protections outlined by 23andMe shall still apply.
Ferguson said the FTC “believes that, consistent with Section 363(b)(1) of the Bankruptcy Code, these types of promises to consumers must be kept.”
As such, any bankruptcy-related sale of 23andMe that includes users’ personal information and biological samples must retain the privacy and data security commitments the company had made to users, he said, adding that the customers had handed over sensitive data based on these commitments.
In a March 23 open letter to customers, 23andMe also made a similar statement, saying that any buyer of the company “will be required to agree to comply with our privacy policy and with all applicable law with respect to the treatment of customer data.”
