Will Genetic Privacy Concerns Raised by 23andMe’s Collapse Last?

When the genetic testing company 23andMe announced it had entered the federal bankruptcy process in March, concern quickly turned to what would happen to customers’ genetic data.

The California biotech company said the bankruptcy would not change how it protected sensitive customer information. And its buyer, Regeneron Pharmaceuticals, has promised to use 23andMe’s data ethically.

“As a world leader in human genetics, Regeneron Genetics Center is committed to and has a proven track record of safeguarding the genetic data of people across the globe, and, with their consent, using this data to pursue discoveries that benefit science and society,” Aris Baras, MD, Senior Vice President and Head of the Regeneron Genetics Center, said in a May 19 press release. “We assure 23andMe customers that we are committed to protecting the 23andMe dataset with our high standards of data privacy, security and ethical oversight and will advance its full potential to improve human health.”

But federal and state laws don’t appear to have contemplated this precise scenario: the demise of a company holding individuals’ genetic data.

In the wake of 23andMe’s bankruptcy announcement, attorneys general in Alabama, Arizona, California, Kentucky, New Hampshire, North Carolina and Texas all issued warnings to their residents about the company’s collapse and encouraged them to delete any genetic data held by the company. 

“Given the uncertainty surrounding 23andMe’s bankruptcy, consumers should seriously consider deleting their accounts to protect their personal genetic data,” said Alabama Attorney General Steve Marshall (R) in a March press release. “Without clear assurances to protect consumer privacy or the future handling of accounts, deleting your account may be the safest way to ensure sensitive information isn’t obtained by those looking to do harm.”

This month, 27 states and the District of Columbia filed a lawsuit seeking to prevent 23andMe from selling customers’ genetic data without obtaining their “explicit consent” first.

“The customer’s genome could remain in existence in corporate hands and subject to use (ranging from research to cloning) long after future generations of 23andMe’s consumers have passed away,” said the states’ complaint, filed in the U.S. Bankruptcy Court in the Eastern District of Missouri.

A spokesperson for 23andMe said the arguments in the complaint were “without merit” and they would “address them at the sales hearing,” presumably referring to a hearing regarding the company’s proposed sale to Regeneron that was scheduled for June 17.

Genetic Data Privacy Bills Introduced in Nearly Half of States

At least 24 states have introduced bills this year dealing with the privacy of genetic data. Five of those states have enacted such measures.

Gap in Genetic Privacy Laws

23andMe burst onto the scene in 2006 with an intriguing proposition: With a simple mail-in saliva sample it could build a genetic profile of users that could reveal ancestral connections as well as insights into your health.

The company became ubiquitous, but it struggled to maintain profitability, and a huge data breach in 2023 caused its stock price to fall through the floor.

The company’s failure revealed a gap in the laws regulating genetic data privacy.

“While many companies have robust privacy and informed consent policies, no federal laws prohibit companies from providing individuals’ genetic information to third parties,” according to the National Human Genome Research Institute, a part of the National Institutes of Health.

The institute also notes that “many U.S. states have laws or regulations that govern genomic privacy and illegitimate uses of genomic data,” but it says “these laws vary substantially.”

Alabama Considers Criminalizing ‘Genetic Theft’

Lawmakers in Alabama attempted to fill this hole with HB 449, by Rep. Ben Robbins (R). The bill would have made it a crime to transfer genetic material or genetic information to another party without the consent of the owner.

The measure would have made the unlawful use of DNA—“genetic theft,” as Robbins calls it—a Class C felony under state law. Such crimes carry penalties of up to 10 years in prison.

The bill was passed by the state’s House but failed to make it through the Senate before the Legislature adjourned for the year.

Proposals Pending in New York and Pennsylvania

Meanwhile, in New York, Assemblyman Jake Blumencranz (R) has introduced AB 7559, the Genetic Privacy and Protection Act, which would require the mandatory deletion of genetic data when a company encounters financial distress or bankruptcy.

The assemblyman said on his Instagram page, “After the @23andme scandal, investors are eyeing your genetic data like it’s up for auction. That’s why just introduced the Genetic Privacy and Protection Act to stop companies from selling your DNA when they go bankrupt.”

To the south, Pennsylvania Rep. Danilo Burgos (D) has introduced HB 1530, which would prohibit direct-to-consumer genetic testing companies from disclosing consumer data.

Both bills have been referred to committee.

Genetic Privacy Concern in Many Other States

More than a dozen other states have already enacted measures regulating direct-to-consumer genetic testing companies. And genetic data privacy in general is a key area of interest for state lawmakers. A search of the LexisNexis® State Net® legislative tracking database turned up 45 bills in 24 states that deal with the subject.

It remains to be seen if Regeneron’s purchase of 23andMe will go through and if the episode will spur more legislative action directed at genetic testing companies.

—By SNCJ Correspondent BRIAN JOSEPH

Visit our webpage to connect with a LexisNexis® State Net® representative and learn how the State Net legislative and regulatory tracking service can help you identify, track, analyze and report on relevant legislative and regulatory developments.