ARI SHAPIRO, HOST:
23andMe was once a high-flying biotech firm. It collected a trove of DNA data on millions of its customers, and then it went bust. The fate of that data has been at the center of a legal battle over DNA privacy. NPR's John Ruwitch explains.
JOHN RUWITCH, BYLINE: Learning about where your family came from made 23andMe an alluring choice for more than 15 million people.
KYLE: My name is Kyle, and I got a gift for my parents a couple years ago. I got each of them a 23andMe.
RUWITCH: The test kits he got confirmed that one side of his family were Ashkenazi Jews.
KYLE: It was definitely, you know, affirming, and I would say we mostly forgot about it after that.
RUWITCH: And that was the problem with 23andMe's business model. It was a one-and-done product. Once people learned their ancestry or genetic health risks, they didn't need to test again. Some of them, like Kyle, stopped thinking about 23andMe. Until, that is, 23andMe filed bankruptcy this March, raising questions of what would happen to all that data? A pharmaceutical company called Regeneron won an initial auction to buy the remnants of 23andMe.
Kyle was nervous about the idea of his family's DNA changing hands, especially after reports of a lawsuit filed after the company was hacked in 2023. It alleged that 23andMe had failed to notify Chinese and Ashkenazi Jewish customers that their data had been targeted and was being sold online.
KYLE: I think, historically, there's a concern amongst the Jewish community for people, you know, knowing who we are, where we live and our genealogy. And if that information gets into the wrong hands, it's very dangerous.
RUWITCH: Kyle asked NPR to only use his first name, out of concern that being publicly identified could make him a target of antisemitism. Last year, 23andMe agreed to a settlement in the data breach suit without admitting wrongdoing. Kyle deleted the family's DNA data via the 23andMe website. It's an option the company says all customers have. But this spring, more than two dozen states filed a lawsuit to halt the sale.
JUSTIN LEONARD: The idea of sell - auctioning off customers' DNA to the highest bidder is just not OK.
RUWITCH: Justin Leonard represents Oregon in the state's lawsuit. It argues that genetic data is not ordinary property that can be sold off like other assets in a bankruptcy - say, desks or real estate - nor is it covered by HIPAA, the law that protects your medical information. The states want to make sure that consumers have full control over this highly personal and unchangeable information.
LEONARD: You can get a new phone number or new credit card if the information is stolen, but you can't change your DNA.
RUWITCH: A consumer privacy ombudsman overseeing the bankruptcy sale said consumers should be allowed to give separate and affirmative consent before their DNA data is sold. In response, 23andMe reopened the auction, and the new winning bid quickly made news. Here's how CNBC put it.
(SOUNDBITE OF ARCHIVED RECORDING)
UNIDENTIFIED NEWS ANCHOR: All right. In the meantime, Anne Wojcicki, the former CEO of 23andMe, has won the bidding to take over the company.
RUWITCH: Anne Wojcicki, co-founder of the company, had set up a nonprofit called the TTAM Research Institute - T-T-A-M being the acronym for 23andMe. It would honor 23andMe's privacy safeguards and keep the DNA data from moving. Lawyer Justin Leonard says this outcome satisfies the state's concerns.
LEONARD: It's going to be under the same privacy policies, the same cybersecurity protections, same management as it was before. We don't believe this is a transfer that state law intended to prohibit or intended to require consent for.
RUWITCH: But he says they're keeping the lawsuit active in case the TTAM sale falls through. TTAM did not respond to emailed questions from NPR. Regeneron says it's declined to submit a new bid. Still, the case cast a spotlight on genetic privacy, said Laura Coordes, an expert in bankruptcy at Arizona State University's law school.
LAURA COORDES: My hope is that the issues that this case raises and the attention that it's gotten will in turn spur some meaningful thought about data privacy protections and those protections in a bankruptcy.
RUWITCH: And hopefully, she says, lawmakers will be moved to create more robust protections for genetic information. John Ruwitch, NPR News. Transcript provided by NPR, Copyright NPR.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
