“This isn’t just data—it’s your DNA,” Oregon Attorney General Dan Rayfield said in a statement. “People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder.”
A coalition of twenty-seven states, along with the District of Columbia, have filed a lawsuit opposing the sale of customers’ genetic data by 23andMe.
According to The New York Times, the lawsuit was filed Monday in U.S. Bankruptcy Court in the Eastern District of Missouri. In court filings, the attorneys general claim that 23andMe needs to obtain consent from each and every one of its former customers before permitting their data to be sold.
23andMe, which filed for bankruptcy earlier this year, has already entered into an agreement to sell itself, as well as its assets, in bankruptcy court. The assets would almost certainly include the genetic information of customers who had purchased DNA testing kits, often used to research ancestry and learn about inherited health risks.
Offering this type of information for sale, the lawsuit says, “compromises an unprecedented compilation of highly sensitive and immutable personal data of customers.”
“This isn’t just data—it’s your DNA,” Oregon Attorney General Dan Rayfield said in a statement. “People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder.”
Rayfield and his colleagues have asked the court to decide whether 23andMe has “the right to sell and transfer” customers’ personal data “without first obtaining express and informed consent from each customer.”
In a separate statement, Pennsylvania Attorney Dave Sunday reiterated many of Rayfield’s points, saying that Pennsylvanians who paid for 23andMe testing kids “did not expective their sensitive data to one day be sold off to the highest bidder.”
“23andMe is trying to avoid their legal obligations to consumers simply by labeling this sale and transfer of consumer data as a ‘change of ownership,’” Sunday said. “I continue to encourage 23andMe customers to consider deleting their data from the company’s database.”
A spokesperson for 23andMe has since called the lawsuit meritless, saying that the sale of genetic information was permitted under the company’s privacy policies and all applicable laws.
“Customers will continue to have the same rights and protections in the hands of the winning bidder,” 23andMe said in a statement.
Although 23andMe has yet to conclude bankruptcy proceedings, Regeneron Pharmaceuticals expressed interest in acquiring the company and its assets, offering up to $256 million.
Regeneron has pledged to comply with all of 23andMe’s existing privacy policies and said that it will only process consumer data in accordance with the terms and conditions customers originally agreed to.
Sources
23andMe Customers Did Not Expect Their DNA Data Would Be Sold, Lawsuit Claims
Dozens of states sue to block the sale of 23andMe personal genetic data
Dozens of states sue to block the sale of 23andMe personal genetic data without customer consent
PA Attorney General joins lawsuit to stop 23andMe’s sale of customer data
Join the conversation!