FTC says 23andMe purchaser must uphold existing privacy policy for data handling

Federal Trade Commission Chair Andrew Ferguson on Monday sent a letter to Department of Justice bankruptcy regulators warning that any purchaser of 23andMe must adhere to the company’s current privacy policies for protecting consumers’ genetic and other data.

The letter, sent to the DOJ's United States Trustee Program, highlights several assurances 23andMe makes in its privacy policy, including that users are in control of their data and can determine how and for what purposes it is used. 

The company also gives users the ability to delete their data at will, the letter says, arguing that 23andMe has made “direct representations” to consumers about how it uses, shares and safeguards their personal information, including in the case of bankruptcy.

Pointing to statements that the company’s leadership has made asserting that user data should be considered an asset, Ferguson highlighted that 23andMe’s privacy statement tells users it does not share their data with insurers, employers, public databases or law enforcement without a court order, search warrant or subpoena.

It also promises consumers that it only shares their personal data in cases where it is needed to provide services, Ferguson added.

The genetic testing and ancestry company is explicit that its data protection guidelines apply to new entities it may be sold or transferred to, Ferguson said.

Quoting from 23andMe’s privacy statement he cites the fact that the company says that if it is transferred or sold to a new owner “this privacy statement will apply to your personal information as transferred to the new entity.”

“The FTC believes that [under bankruptcy law] these types of promises to consumers must be kept,” the letter says.

Ferguson notes that genetic data is not only sensitive, but also cannot be changed as is true for a phone number or other personal information. 23andMe stores biological DNA samples and ancestry and genealogy data belonging to millions of people.

“Many Americans are concerned about the impact of a potential sale of their personal data, and I understand those concerns,” Ferguson said in a statement. “Consumers should be able to trust that companies will keep their promises, including when it comes to handling of sensitive information.”