Three congressmen from the House Committee on Energy and Commerce are raising concerns over data privacy weeks after the genetic testing company 23andMe filed for bankruptcy, putting millions of customers’ personal information up for sale.
The Republican representatives — Brett Guthrie from Kentucky, Gus Bilirakis from Florida and Gary Palmer from Alaska — sent a letter to 23andMe interim Chief Executive Joe Selsavage on Thursday requesting answers to several questions by May 1.
The questions revolve around the fate of 23andMe’s genetic database, which includes DNA information from more than 15 million people. The congressmen asked the company how it would protect the data in an event of a sale and how it would vet potential buyers.
The company did not immediately respond to a request for comment.
23andMe declared Chapter 11 bankruptcy in March and received authorization from the U.S. Bankruptcy Court for the Eastern District of Missouri to sell substantially all its assets. The company, founded in 2006 and once valued at $6 billion, popularized at-home DNA test kits and spurred a trend of ancestry hunting and amateur criminal investigations.
But the venture failed to establish a sustainable business model, and as it struggles to stay afloat, experts, customers and government officials are worried genetic information could fall into the wrong hands.
“Given the lack of HIPAA protections, the patchwork of state laws covering genetic privacy, and the uncertainty surrounding what happens to customer information should a sale of the company or customer data and information transpire, we are concerned that this trove of sensitive information is at risk of being compromised,” the Energy and Commerce letter said.
Though any buyer of 23andMe must agree to comply with the company’s privacy policy, that policy can be unilaterally changed at any time, according to Sara Geoghegan, senior counsel at the Electronic Privacy Information Center.
“I would be very concerned if I had given a swab to 23andMe,” Geoghegan said. “There is little we can do to control what happens to it.”
The bankruptcy filing prompted California Atty. Gen. Rob Bonta to issue a consumer alert urging customers to delete the data they had provided to the company.
“Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and destroy any samples of genetic material held by the company,” Bonta wrote.
The 23andMe website crashed following the warning as customers rushed to log in, the Wall Street Journal reported. Thursday’s letter raised the issue, noting that “customers are experiencing issues accessing and deleting their data.”
Guthrie, Bilirakis and Palmer are the latest government officials to voice concern over the situation. The House Committee on Oversight and Government Reform and the Federal Trade Commission have also sent letters to 23andMe recently inquiring about data protection.
23andMe issued an open letter to customers in late March assuring them that their data would remain protected in the event of a sale.