{"id":851625,"date":"2025-05-27T22:12:40","date_gmt":"2025-05-28T03:12:40","guid":{"rendered":"https:\/\/newsycanuse.com\/index.php\/2025\/05\/27\/how-a-bankruptcy-judge-can-stop-a-genetic-privacy-disaster\/"},"modified":"2025-05-27T22:12:40","modified_gmt":"2025-05-28T03:12:40","slug":"how-a-bankruptcy-judge-can-stop-a-genetic-privacy-disaster","status":"publish","type":"post","link":"https:\/\/newsycanuse.com\/index.php\/2025\/05\/27\/how-a-bankruptcy-judge-can-stop-a-genetic-privacy-disaster\/","title":{"rendered":"How a bankruptcy judge can stop a genetic privacy disaster"},"content":{"rendered":"
\n

Stop me if you\u2019ve heard this one before: A tech company accumulates a ton of user data, hoping to figure out a business model later. That business model never arrives, the company goes under, and the data is in the wind.\u00a0<\/p>\n

The latest version of that story emerged on March 24, when the onetime genetic testing darling 23andMe filed for bankruptcy. Now the fate of 15 million people\u2019s genetic data rests in the hands of a bankruptcy judge. <\/strong>At a hearing<\/a> on March 26, the judge gave 23andMe permission to seek offers for its users\u2019 data. But, there\u2019s still a small chance of writing a better ending for users.<\/p>\n<\/p><\/div>\n

\n

After the bankruptcy filing, the immediate take from policymakers and privacy advocates was that 23andMe users should delete their accounts to prevent genetic data from falling into the wrong hands. That\u2019s good advice for the individual user (and you can read how to do so here<\/a>). But the reality is most people won\u2019t do it. Maybe they won\u2019t see the recommendations to do so. Maybe they don\u2019t know why they should be worried. Maybe they have long since abandoned an account that they don\u2019t even remember exists. Or maybe they\u2019re just occupied with the chaos of everyday life.\u00a0<\/p>\n

This means the real value of this data comes from the fact that people have forgotten about it. Given 23andMe\u2019s meager revenue\u2014fewer than 4% of people who took tests pay for subscriptions\u2014it seems inevitable that the new owner, whoever it is, will have to find some new way to monetize that data.\u00a0<\/p>\n

This is a terrible deal for users who just wanted to learn a little more about themselves or their ancestry. Because genetic data is forever. Contact information can go stale over time: you can always change your password, your email, your phone number, or even your address. But a bad actor who has your genetic data\u2014whether a cybercriminal selling<\/a> it to the highest bidder, a company building a profile<\/a> of your future health risk<\/a>, or a government<\/a> trying to identify<\/a> you\u2014will have it tomorrow and the next day and all the days after that.\u00a0<\/p>\n<\/p><\/div>\n

\n

Users with exposed genetic data are not only vulnerable to harm today; they\u2019re vulnerable to exploits that might be developed in the future.\u00a0<\/p>\n

While 23andMe promises<\/a> that it will not voluntarily share data with insurance providers, employers, or public databases, its new owner could unwind those promises at any time with a simple change in terms.\u00a0<\/p>\n

In other words: If a bankruptcy court makes a mistake authorizing the sale of 23andMe\u2019s user data, that mistake is likely permanent and irreparable.\u00a0<\/p>\n

All this is possible because American lawmakers have neglected to meaningfully engage with digital privacy for nearly a quarter-century. As a result, services are incentivized to make flimsy, deceptive promises that can be abandoned at a moment\u2019s notice. And the burden falls on users to keep track of it all, or just give up.<\/p>\n

Here, a simple fix would be to reverse that burden. A bankruptcy court could require that users individually opt in before their genetic data can be transferred to 23andMe\u2019s new owners, regardless of who those new owners are. Anyone who didn\u2019t respond or who opted out would have the data deleted.\u00a0<\/p>\n<\/p><\/div>\n

\n

Bankruptcy proceedings involving personal data don\u2019t have to end badly. In 2000, the Federal Trade Commission settled<\/a> with the bankrupt retailer ToySmart to ensure that its customer data could not be sold as a stand-alone asset, and that customers would have to affirmatively consent to unexpected new uses of their data. And in 2015, the FTC intervened<\/a> in the bankruptcy of RadioShack to ensure that it would keep its promises never to sell the personal data of its customers. (RadioShack eventually agreed to destroy it.)\u00a0<\/p>\n

The ToySmart case also gave rise to the role of the consumer privacy ombudsman. Bankruptcy judges can appoint an ombuds to help<\/a> the court consider how the sale of personal data might affect the bankruptcy estate, examining the potential harms or benefits to consumers and any alternatives that might mitigate those harms. The U.S. Trustee has requested the appointment of an ombuds in this case. While scholars have called<\/a> for the role to have more<\/a> teeth and for the FTC and states to intervene more often, a framework for protecting personal data in bankruptcy is available. And ultimately, the bankruptcy judge has broad power to make decisions about how (or whether) property in bankruptcy is sold.<\/p>\n

Here, 23andMe has a more permissive privacy policy than ToySmart or RadioShack. But the risks incurred if genetic data falls into the wrong hands or is misused are severe and irreversible. And given 23andMe\u2019s failure to build a viable business model from testing kits, it seems likely that a new business would use genetic data in ways that users wouldn\u2019t expect or want.\u00a0<\/p>\n

An opt-in requirement for genetic data solves this problem. Genetic data (and other sensitive data) could be held by the bankruptcy trustee and released as individual users gave their consent. If users failed to opt in after a period of time, the remaining data would be deleted. This would incentivize 23andMe\u2019s new owners to earn user trust and build a business that delivers value to users, instead of finding unexpected ways to exploit their data. And it would impose virtually no burden on the people whose genetic data is at risk: after all, they have plenty more DNA to spare.<\/p>\n

Consider the alternative. Before 23andMe went into bankruptcy, its then-CEO made two failed attempts<\/a> to buy it, at reported valuations of $74.7 million and $12.1 million. Using the higher offer, and with 15 million users, that works out to a little under $5 per user. Is it really worth it to permanently risk a person\u2019s genetic privacy just to add a few dollars in value to the bankruptcy estate?\u00a0\u00a0\u00a0\u00a0<\/p>\n

Of course, this raises a bigger question: Why should anyone be able to buy the genetic data of millions of Americans in a bankruptcy proceeding? The answer is simple: Lawmakers allow them to. Federal and state inaction allows companies to dissolve promises about protecting Americans\u2019 most sensitive data at a moment\u2019s notice. When 23andMe was founded, in 2006, the promise was that personalized health care was around the corner. Today, 18 years later, that era may really be almost here. But with privacy laws like ours, who would trust it?<\/p>\n

Keith Porcaro is the Rueben Everett Senior Lecturing Fellow at Duke Law School.<\/em><\/p>\n<\/p><\/div>\n

Keith Porcaro
Read More<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Stop me if you\u2019ve heard this one before: A tech company accumulates a ton of user data, hoping to figure out a business model later. That business model never arrives, the company goes under, and the data is in the wind.\u00a0 The latest version of that story emerged on March 24, when the onetime genetic<\/p>\n","protected":false},"author":1,"featured_media":851626,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24752,559],"tags":[10100,5610],"class_list":{"0":"post-851625","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-bankruptcy","8":"category-judge","9":"tag-bankruptcy","10":"tag-judge"},"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/851625","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/comments?post=851625"}],"version-history":[{"count":0,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/851625\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media\/851626"}],"wp:attachment":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media?parent=851625"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/categories?post=851625"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/tags?post=851625"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}