What happens to sensitive personal information shared by consumers when the company collecting that information encounters financial distress? That exact issue is currently front and center in the Chapter 11 proceedings of 23andMe.
23andMe, of course, pioneered widespread access to human genetic information. Over the past two decades, the company has provided consumers with access to testing kits for insight into personalized genetic traits. Such data is valuable not only to individuals submitting the information but also, on an aggregate basis, to research companies focused on drug development.
Citing liquidity challenges, this spring 23andMe commenced a Chapter 11 bankruptcy case. At the same time, the company also announced it intended to sell substantially all of its assets free and clear of prepetition liabilities pursuant to Section 363 of the Bankruptcy Code.
News of the proposed sale sent off widespread alarms. Articles such as “23andMe Just Filed for Bankruptcy. You Should Delete Your Data Now” proliferated as did warnings from state regulators with guidance on steps to take to delete personal data. The company’s court filings only exacerbated the alarms by noting that no steps would be taken to seek the appointment of a consumer privacy ombudsman (“CPO”) under the Bankruptcy Code in connection with the sale.
The company’s argument in support of that position in fact had a legal basis. Section 363(b)(1) of the Bankruptcy Code requires a report from a CPO only in instances where a company seeks to sell personally identifiable information (as defined in the Bankruptcy Code) when the company has a policy prohibiting such a sale. 23andMe represented that its privacy policies did not restrict the transfer of consumer data in a sale or bankruptcy case – thus exempting it from the need for a CPO. Further, the company attempted to assuage the Court and others that, in any event, the contemplated bidding procedures required qualified bidders to comply with all of the company’s consumer privacy policies.
Such arguments did not calm the clamor. Soon, the company tried a different approach. Still noting that a CPO was not needed, the company filed a motion seeking authority to appoint a so-called “customer data representative” -- a self-invented position that would have some attributes of a CPO – but lack the key attribute of true independence from the company.
That motion too failed to calm the waters. Before long, the State of Texas filed a motion seeking the appointment of a CPO. That relief was supported by numerous states who similarly pushed for the appointment of a CPO.
Just one day prior to a scheduled court hearing, the company filed a motion seeking court approval of a joint stipulation resolving the conflicting positions. Under the stipulation, which the court has now approved, the company agreed to the appointment of a CPO and agreed to cooperate with the CPO to fulfill duties specified under the stipulation.
The United States Trustee subsequently appointed privacy expert and professor Neil M. Richards to serve in the role CPO. In accordance with the Stipulation, the CPO will conduct an examination and present a report to the Court at least seven days prior to the sale hearing to assist the court in its consideration of the facts, circumstances, and conditions of any sale.
The report will discuss:
- Whether such sale is consistent with the company’s privacy policies;
- Whether such sale would violate applicable nonbankruptcy law;
- The potential losses or gains of privacy to consumers if such sale is approved;
- The potential costs or benefits to consumers if such sale is approved;
- The cybersecurity program and security controls utilized by any potential purchaser;
- Any alternatives or changes that would mitigate potential privacy losses or potential costs to consumers; and
- The company’s existing cybersecurity program and security controls.
Just recently, 23andMe identified Regeneron Pharmaceuticals as the party with the highest and best bid for the company’s assets – a bid that included the commitment to honoring existing privacy policies and complying with all applicable laws. The sale hearing is currently set for June 17 and thus the CPO must complete his work and submit the required report to the Court no later than June 10. The CPO’s report to the Court and the Court’s ultimate order regarding the pending sale motion will serve as an answer to the question above about what happens to the sensitive personal information shared by consumers in the specific case of 23andMe.
Of course, other bankruptcy cases have involved the sale of personally identifiable information and issues around such sales has been the subject of analysis and debate. See for example a brief overview of pertinent issues in my article Are Consumer Privacy Ombudsmen Theatrical Performers? (ABI Journal, Feb. 2024). Among other topics, that article notes that the CPO statute is now two decades old and in need of review and reform to account for the tremendous changes in technology over that time. We will continue to monitor the 23andMe developments and update as appropriate in this blog and continue to stay focused on privacy and security issues relevant to restructuring and turnaround situations.
Several publications covering developments in the fast-moving 23andMe case reached out to John Loughnane for insight about privacy issues based on his experience as Certified Information Privacy Professional (CIPP/US) and recent experience serving as court appointed CPO in a case involving the personal information of thousands of consumers. Some articles incorporating his commentary include:
- Rick Archer, 23andMe’s Ch. 11 Sale Hinges on Patchwork of Privacy Law, Law360 (March 27, 2025)
- Karl Herchenroeder and Kara Thompson, 23andMe to Appoint Data ‘Representative’ in Bankruptcy Sale, Privacy Daily (April 9, 2025)
- Clara Geoghegan, 23andMe Ch. 11 Sale Sparks DNA Privacy Oversight Battle, Law360 (April 18, 2025)
- Alex Wittenberg, 23andMe DNA Data Sale In Ch. 11 Tests Ombudsmen’s Reach, Law360 (May 12, 2025)
[View source.]
