A bipartisan legislative effort is underway in Congress to enhance protections for Americans' sensitive genetic data, prompted by the bankruptcy of DNA analysis company 23andMe and its pending sale to pharmaceutical giant Regeneron.
The bill, titled the
Don't Sell My DNA Act, was introduced by Senate Judiciary Committee Chairman Chuck Grassley (R-Iowa), alongside Sens. John Cornyn (R-Texas), and Amy Klobuchar (D-Minn). The legislation seeks to amend
Title 11 of the U.S. Code—the federal bankruptcy statute—to specifically include protections for genetic information.
Current law prohibits companies in bankruptcy from selling personally identifiable information such as names, addresses, phone numbers and Social Security numbers. However, the existing bankruptcy code does not explicitly include genetic information, a gap lawmakers say leaves Americans’ DNA “particularly vulnerable” in cases like 23andMe’s.
"Consumers should feel confident that any personal information shared with a public company isn't up for grabs when that company files for bankruptcy," Grassley
said. "This bill would fill gaps in current law to help safeguard consumers' genetic information and ensure Americans' DNA isn't treated like any other financial asset."
The legislation would impose restrictions on the use, sale, or lease of personally identifiable information that includes genetic data during bankruptcy proceedings. It specifies that "no use, sale, or lease shall be approved if the personally identifiable information consists, in whole or in part, of genetic information... unless all affected persons, including non-parties, have affirmatively consented in writing to such use.”
Cornyn
said: “Advances in DNA testing have allowed Americans to have unprecedented access to important insights about their genetics, but these companies must have a plan to protect this data in the event of bankruptcy.
“By updating the bankruptcy code, this legislation would safeguard Americans’ sensitive genetic information to ensure it cannot be weaponized against them or made public without their knowledge and consent.”
The bill also requires trustees or debtors to “permanently delete any data not subject to a sale or lease.”
23andMe Files for Bankruptcy
In March, 23andMe filed for Chapter 11 bankruptcy protection. At the time, the company
stated its intent to use the sale process to maximize business value while continuing operations. It reported assets of $277.42 million and debts totaling $214.7 million.
In a
press release, 23andMe told customers that “if the company is sold, any new owner must follow the law when it comes to your data.” The company said any buyer would be required to comply with its privacy policy and applicable laws.
Following a bankruptcy auction, Regeneron Pharmaceuticals is set to purchase 23andMe in a $256 million deal, pending court and regulatory approval.
The deal includes the 23andMe Biobank and genetic data from approximately 15 million customers. Regeneron said it plans to continue 23andMe’s consumer genome services without interruption. The company said it is “committed to protecting the 23andMe dataset” and to maintaining “high standards of data privacy, security, and ethical oversight.” Regeneron also said it would comply with existing privacy policies and process customer data according to terms of service and consent agreements.
“We believe we can help 23andMe deliver and build upon its mission to help those interested in learning about their own DNA and how to improve their personal health, while furthering Regeneron’s efforts to use large-scale genetics research to improve the way society treats and prevents illness overall,”
said George Yancopoulos, Regeneron co-founder.
AGs, FTC Warn on DNA Data Risk
Despite these assurances, the bankruptcy and sale have raised privacy concerns. Several state attorneys general have urged customers to request the destruction of biological samples and the deletion of genetic data. The Federal Trade Commission (FTC) also weighed in, urging that any sale be consistent with 23andMe’s prior privacy commitments.
FTC Chairman Andrew Ferguson said in a
letter that the company “collects and holds sensitive, immutable, identifiable personal information about millions of American consumers who have used the company’s genetic testing and telehealth services.” He added that this includes genetic information, biological DNA samples, health information, ancestry and genealogy data, personal contact and billing information, and other content, such as messages exchanged among genetic relatives on the platform.
The FTC is concerned about protecting 23andMe users’ interests, he said.
A court-appointed privacy ombudsman is required to review the transaction’s privacy implications before the sale can proceed.
