A group of House lawmakers launched a probe Thursday into 23andMe’s handling of customers’ sensitive data following the company’s filing for bankruptcy last month.
In a letter to 23andMe, House Commerce and Energy Committee Chair Brett Guthrie (R-Ky.) and Reps. Gus Bilirakis (R-Fla.) and Gary Palmer (R-Ala.) asked the company to state its data privacy and security protections for former customers if the business chooses to sell the personal information in either a standalone sale or as part of a sale of the company.
23andMe, which filed for bankruptcy in Missouri federal court last month, is a human genetics and biotechnology company that became popular in recent years for its at-home DNA tests.
The testing required customers to submit a saliva sample by mail to then receive personalized genetic reports, which has resulted in the company holding the genetic data of more than 15 million customers.
“The company is in possession of highly sensitive personal information, including biological samples, medical information and personal information for more than 15 million customers,” the lawmakers wrote in the letter to Joe Selsavage, the company’s interim CEO.
The lawmakers noted Americans’ personal health information is shielded under federal privacy laws that restrict the release of medical information, but direct-to-consumer companies like 23andMe are not covered under these laws.
“Given the lack of HIPAA (Health Insurance Portability and Accountability Act) protections, the patchwork of state laws covering genetic privacy, and the uncertainty surrounding what happens to customer information should a sale of the company or customer data and information transpire, we are concerned that this trove of sensitive information is at risk of being compromised,” the lawmakers wrote.
When the company filed for Chapter 11 bankruptcy last month, it said customers’ personal information may be accessed, sold or transferred as part of a transaction and that all possible buyers must comply with its privacy policy and all applicable laws.
Users are able to delete their information from 23andMe’s website, though lawmakers on Thursday claimed some customers are having difficulty accessing their data online.
The lawmakers pointed to reports of some customers having difficulty with their 23andMe accounts due to the website being down or issues with verification codes.
“Regardless of whether the company changes ownership, we want to ensure that customer access and deletion requests are being honored by 23andMe,” the lawmakers said.
The letter asks 23andMe a series of questions, including whether it plans to change its privacy statement at any point before selling customers’ personal information and if it will vet prospective buyers.
The Hill reached out to the company for further comment.
Other government leaders have raised concerns in recent weeks about 23andMe’s data privacy protocols. Earlier this week, the House Oversight and Government Reform Committee sent an inquiry to the company, following a Federal Trade Commission letter late last month.
