Dozens of states have filed a joint lawsuit against the bankrupt DNA-testing company 23andMe to block the company’s sale of its customers’ genetic data without explicit consent.
The suit, filed this week in U.S. Bankruptcy Court in the Eastern District of Missouri, comes months after 23andMe began a court-supervised sale process of its assets.
The South San Francisco-based venture was once valued at $6 billion and has collected DNA samples from more than 15 million customers.
The company’s bankruptcy has raised questions over privacy standards for genetic data, which experts say is uniquely sensitive, immutable and irreplaceable if stolen. Twenty-seven states and the District of Columbia filed the lawsuit, arguing that 23andMe customers have an inherent right to their own genetic information.
“This isn’t just data — it’s your DNA,” said Oregon Atty. Gen. Dan Rayfield in a statement. “It’s personal, permanent, and deeply private. People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder.”
23andMe announced in May that it would be sold to New York-based drug maker Regeneron Pharmaceuticals, which had agreed to comply with 23andMe’s existing privacy policy. However, a competing offer from nonprofit TTAM Research Institute led the bankruptcy judge to reopen the auction last week.
TTAM is run by 23andMe co-founder Anne Wojcicki, who has made several failed attempts to take the company private.
In a statement, a 23andMe spokesperson said the lawsuit’s claims “are without merit” and that the sale of genetic data does not violate privacy regulations.
“Customers will continue to have the same rights and protections in the hands of the winning bidder,” the spokesperson said.
23andMe customers have the right to delete their genetic information from the company’s database at any time, as outlined in the Genetic Information Privacy Act and the California Consumer Privacy Act.
During a testimony in Washington earlier this week, 23andMe interim Chief Executive Joseph Selsavage said that 1.9 million customers have requested their data be deleted since the company’s bankruptcy filing in March.
Sara Geoghegan, senior counsel at the Electronic Privacy Information Center, said that 23andMe’s privacy policy was subject to change and not adequate to protect customers’ data. In an interview in March, she stressed the sensitivity of genetic data.
“I would be very concerned if I had given a swab to 23andMe,” she said. “There is little we can do to control what happens to it.”
