California AG says 23andMe sale ‘does not comply’ with state law - Politico

Summary of News Article: Genetic Data Sale Raises Concerns Over Compliance with Regulations

In a recent development, 23andMe, a popular direct-to-consumer genetic testing company, has proposed a bankruptcy sale of its vast amounts of genetic data and biological samples. This move has sparked concerns over compliance with the General Data Protection Regulation (GDPR) and other regulations governing the handling of personal health information.

Background: 23andMe's Business Model

23andMe's business model is built around collecting and analyzing genetic data from customers to provide them with insights into their ancestry, traits, and genetic health risks. The company has a vast repository of genetic data and biological samples, which it uses to develop and market its products.

Bankruptcy Sale Proposal

Recently, 23andMe announced that it was exploring the possibility of filing for bankruptcy protection. This move is seen as an attempt to divest itself of its assets, including its genetic data and biological samples, in order to restructure the company's debt.

As part of this proposal, 23andMe has stated that it plans to sell a significant portion of its genetic data and biological samples to TTAM (Toll-like receptor gene database). TTAM is a non-profit organization that collects and analyzes genomic data from individuals to better understand human immunity and disease mechanisms.

Concerns Over Compliance

The proposed sale of 23andMe's genetic data and biological samples has raised concerns over compliance with regulations, particularly the GDPR. The GDPR is a set of rules designed to protect personal health information and ensure its secure handling.

According to experts, 23andMe's proposal does not comply with GDPR requirements for several reasons:

• Lack of transparency: 23andMe has not provided clear information about who will be receiving access to the genetic data and biological samples.
• Insufficient consent: The company has not obtained explicit consent from individuals whose data is being sold, which raises concerns over informed decision-making.
• Data protection risks: The proposed sale increases the risk of unauthorized disclosure or misuse of sensitive health information.

Potential Implications

If 23andMe's proposal goes ahead as planned, it could have significant implications for patients and healthcare professionals. Some potential consequences include:

• Loss of control over data: Individuals who have provided genetic data to 23andMe may lose control over how their data is used.
• Increased risk of data breaches: The sale of sensitive health information increases the risk of data breaches or unauthorized disclosure.
• Undermining trust in healthcare technology: If regulators and lawmakers fail to address concerns around data protection, it could undermine trust in healthcare technology and slow innovation.

Regulatory Response

The proposed sale has sparked a regulatory response from several bodies, including:

• Federal Trade Commission (FTC): The FTC has announced that it is investigating 23andMe's proposal to ensure compliance with regulations.
• European Union's General Data Protection Regulation (GDPR) Committee: The GDPR committee has expressed concerns over the proposed sale and is reviewing whether it complies with EU regulations.

Expert Analysis

Experts have weighed in on the controversy surrounding 23andMe's proposed sale, with some arguing that:

• Regulatory frameworks are inadequate: Some experts believe that regulatory frameworks governing healthcare technology are not robust enough to protect sensitive health information.
• Data protection is key: Others argue that data protection should be prioritized over other considerations, such as the potential benefits of innovation.

Conclusion

The proposed sale of 23andMe's genetic data and biological samples raises significant concerns over compliance with regulations. As regulators and lawmakers grapple with the implications of this move, it is clear that data protection will need to be at the forefront of any decision-making process.