23andMe files for bankruptcy as concerns erupt over DNA biometric data

DNA testing company 23andMe has filed for bankruptcy as consumers scramble to delete their DNA biometrics.

After continued poor sales of its ancestry testing kits, the U.S. firm sought to keep afloat with $35 million of financing secured over the weekend. But it appears it wasn’t enough as the firm has filed for bankruptcy igniting concerns over user data.

23andMe collected genetic biometric data from its customers with its privacy policies allowing the sale of the data to other companies. But 23andMe has said the bankruptcy process will not affect how it stores, manages or protects customer data, Reuters reports.

On Monday, 23andMe’s co-founder Anne Wojcicki resigned as CEO after making repeated failed takeover bids. The company’s worth peaked in late 2021 after being taken public that same year, reaching a valuation of nearly $6 billion. In 2023 the company suffered a major blow to its reputation after hackers gained access to nearly seven million customers’ personal data over a five-month period. 23andMe agreed to a $30 million settlement following a lawsuit related to the data breach late last year.

Data concerns

California Attorney General Rob Bonta urged customers to delete their data after reports of the company’s financial struggles. Social media posts and newspaper articles have laid out instructions on how users can delete their data. While deleting an account can help, experts warned that this does not necessarily mean all DNA biometric data has been removed.

Reuters reports that 23andMe has made at least 30 deals with pharmaceutical and biotech companies, such as UK drugmaker GSK, giving them access to its database.

On March 24, the UK’s Information Commissioner’s Office (ICO) released a statement on its investigation into 23andMe. ICO and the Office of the Privacy Commissioner of Canada had been jointly investigating the 2023 data breach of 23andMe, and issued the company a notice of intent to fine it £4.59 million ($5.9m). ICO stressed that the findings are provisional and are subject to representations from 23andMe.

“We are aware that 23andMe has filed for Chapter 11 bankruptcy in the US to facilitate a sale process,” Stephen Bonner, ICO Deputy Commissioner, said. “As a matter of UK law, the protections and restrictions of the UK GDPR continue to apply and 23andMe remains under an obligation to protect the personal information of its customers.” The deputy commissioner added that they are monitoring the situation “closely” and are in contact with the company.

ICO prefaced its statement to say that genetic information is among “the most sensitive personal data that a person can entrust to a company” and that organizations handling such data are required to uphold a “very high standard” of security and governance in accordance with the UK GDPR. In California, where 23andMe is based, the Genetic Information Privacy Act places data collection, use, security and disclosure requirements on direct-to-consumer genetic testing companies and provides consumers with access and deletion rights.

Such regulations will continue to apply to 23andMe and its rival AncestryDNA, which is owned by Blackstone.

Article Topics

23andMe  |  biometric data  |  biometric identifiers  |  biometrics  |  data protection  |  dna