Anne Wojcicki's bid to buy back 23andMe may not end a legal fight over DNA customer data

Anne Wojcicki's TTAM Research Institute won the bid to reacquire 23andMe amid bankruptcy proceedings, raising data privacy concerns regarding the DNA of 15 million users. The deal faces scrutiny from state attorneys general and regulators, who question the legality of transferring sensitive consumer data, especially given 23andMe's past security lapses and the potential for TTAM, as a non-profit, to operate outside data protection laws. Experts suggest the case highlights the need for stronger federal consumer privacy laws, particularly concerning genetic data.

Analysis

Anne Wojcicki's non-profit, TTAM Research Institute, has submitted the winning bid to reacquire the bankrupt consumer genomics company 23andMe (MEHCQ), outbidding Regeneron (REGN), yet this move intensifies the controversy surrounding the DNA data of 15 million users. The proposed purchase, pending a bankruptcy judge's approval at a hearing set for Wednesday, faces significant headwinds: members of Congress have questioned Wojcicki, and over half of U.S. states are legally challenging 23andMe's bankruptcy estate to prevent the sale of consumer biological samples and health data. Data privacy experts, like Brian Focht, underscore the immutable nature of genetic information, urging caution. A consumer watchdog report filed with the bankruptcy court highlighted that any sale, even to TTAM, presents unique challenges due to the data's extreme sensitivity, surpassing that in prior bankruptcies. Confidence in Wojcicki's ability to safeguard data is undermined by her tenure as CEO during 23andMe's 2023 privacy and cybersecurity lapses, which exposed data, including potential genetic information, for approximately 7 million customers. Furthermore, TTAM's non-profit status raises concerns, as articulated by the bankruptcy court's watchdog and privacy lawyer Gary Kibel, that it could operate outside many data protection laws, potentially creating a "privacy and security enforcement and accountability vacuum," given most state consumer privacy laws do not apply to non-profits. The legal right of 23andMe to sell this data, which is not federally protected by HIPAA as it's a direct-to-consumer company, remains untested. Twenty-eight state attorneys general contend that consumer DNA and personal information, particularly for users who agreed to terms before June 8, 2022 (when terms stated data wouldn't be sold without explicit consent), are not company assets. Bankruptcy lawyer Daniel Gielchinsky suggests the court may not grant TTAM the same data rights 23andMe currently claims. Additional complexities include the potential inclusion of 23andMe's telemedicine subsidiary, Lemonaid Health, and concerns from lawmakers about foreign access to U.S. genetic data, despite Wojcicki's pledge against such sales. This situation underscores, as professor Uttara Ananthakrishnan noted, the profound and novel risks associated with genetic data, and may, according to Kibel, catalyze efforts towards a federal comprehensive consumer privacy law.

Key Decisions for Investors

• Given 23andMe's (MEHCQ) bankruptcy, intense legal challenges from state attorneys general, and profound data privacy issues surrounding its 15 million users' DNA, existing equity holders face substantial uncertainty and a predominantly negative outlook; the upcoming bankruptcy court hearing on Wednesday is a critical event to monitor for the purchase approval and any attached data handling conditions.
• Investors should critically assess portfolio companies within the consumer genomics, data-intensive healthcare, and direct-to-consumer health sectors for potential vulnerabilities arising from heightened regulatory scrutiny and evolving legal precedents on data privacy and ownership, as starkly highlighted by the 23andMe case.
• The legal outcomes of this bankruptcy, particularly concerning the transferability of highly sensitive consumer data and the enforceability of privacy policy changes, may establish significant precedents, warranting close observation by investors in any business model reliant on large-scale personal data collection and monetization.
• For Regeneron (REGN), being outbid for 23andMe's assets means it avoids direct entanglement with the significant legal, reputational, and data security risks associated with the genetic database, an outcome that can be viewed as neutral to slightly positive by sidestepping a potentially problematic acquisition.