- Utah Attorney General Derek Brown joins 27 states in a lawsuit against 23andMe's data sale.
- The lawsuit claims 23andMe's sale of genetic data breaches privacy without consent.
- 23andMe states its policies allow for the sale and the new owners will uphold data privacy.
SALT LAKE CITY — Utah Attorney General Derek Brown has joined 27 other states in a lawsuit against genealogy company 23andMe and its recently proposed sale of customer data, according to an announcement Wednesday.
23andMe is a company that provides genetic testing to give customers insights on individual ancestry and the presence of genetic risk factors for diseases.
23andMe filed for bankruptcy in March this year and, as part of the financial proceedings, the company is attempting to sell "millions of Americans' highly personal genetic and health material," a statement from Brown said.
A day after filing for bankruptcy, the company sought court approval to conduct bidding procedures for the sale of its assets, which included "industry data," comprising all customer data and biological samples.
As of May 3, 23andMe has the biological data of more than 15 million customers, about 10 million of whom consented to have their genetic data stored in a biobank. This data includes personal data, health information, family relative information, phenotype data such as observable individual characteristics, medical records and samples of spit that are analyzed to create "record of a human's raw genetic code."
23andMe gave notice in mid-May that biotechnology company Regeneron was the successful bidder with a purchase price of $256 million for the company's assets, and TTAM Research Institute would be a backup bidder.
Regeneron said it would comply with 23andMe's privacy policies and applicable law. It said it would process all customer personal data in accordance with the consents, privacy policies and statements, terms of service, and notices currently in effect and have security controls in place designed to protect such data.
Brown joined a bipartisan group of 27 other attorneys general to be plaintiffs in the suit, arguing that biological data should not be sold without the person's express consent. The attorneys argue no sale should be allowed unless the company first gets informed consent from each customer impacted.
"Genetic material is incredibly sensitive and personal — nobody should be allowed to auction this immutable and identifying information off to the highest bidder," said Douglas Crapo, consumer protection deputy for the attorney general's office. "Utahns have the right to control this deeply private information and did not expect it to be sold. We are committed to protecting Utahns' rights and personal data."
The "unprecedented compilation" of sensitive, exclusively personal and immutable data constitutes "a human being's permanent and everlasting genetic identity."
The data is irreplaceable and, while stored in its current form, "is effectively eternal," prosecutors said. They argue it could be misused to track and identify anyone related to the customer.
"The magnitude of the data in this proposed sale stretches far beyond the 23andMe consumers, impacting those who have no awareness of the sale as well as humans who do not even exist yet," the lawsuit states. "The customer's genome could remain in existence in corporate hands and subject to use long after future generations of the 23andMe's consumer have passed away."
Change in ownership or sale?
The lawsuit asks for the court to issue a declaratory judgment on whether 23andMe has the right to sell and transfer the genetic material and related data without first obtaining consent.
The attorneys general claim 23andMe are "avoiding legal obligations" by labeling the purchase of data a "change in ownership" rather than a sale.
"Just because the new owner retains the website and agrees to follow the (23andMe)'s same privacy policies and terms of use does not magically transform this sale into a 'change in ownership.' The customer data — the core asset of the company — is being sold, transferred and disclosed here, even if the asset purchase agreement says otherwise," prosecutors allege.
The lawsuit also voiced concern about the backup buyer TTAM Research Institute because it's a tax-exempt nonprofit and could potentially evade regulatory scrutiny.
"Utahns entrusted 23andMe with their most personal genetic information, under the promise of privacy and protection. The company's intent to sell this data to the highest bidder is an egregious betrayal of that trust and will not be tolerated," said Katie Hass, Utah Division of Consumer Protection director. "Every consumer should have the right to decide how this intimate, personal and unique data is handled going forward."
The attorneys general allege the sale would be a breach of privacy and 23andMe has a duty to honor its promises of privacy it has given customers.
"You can be assured that your genetic data will not be shared with employers, insurance companies, or public databases without your explicit consent," 23andMe's website says.
"Based on this, customers have a reasonable expectation that their genetic data would not be auctioned off and shared with the highest bidder without explicit consent," the lawsuit says.
The company argues that every customer accepted the possibility of their data being sold in the event of a bankruptcy when they clicked acceptance to the 23andMe's terms of service and privacy statement when signing up.
The bankruptcy provision was only added June 8, 2022, meaning 23andMe still holds the responsibility to obtain consent from any customer who signed up for service prior to that date, the attorneys general argue.
A 23andMe spokesperson said the attorneys general's arguments are "without merit" and will be addressed at a sale hearing.
"We required any bidder to adopt our policies and comply with applicable law as a condition to participating in our sales process. Customers will continue to have the same rights and protections in the hands of the winning bidder," the 23andMe statement said.
Both Regeneron and TTAM are U.S. companies that have committed to abiding by 23andMe privacy policies and will operate the company "as it has always been operated," the company said.
