UK user data must be protected during 23andMe bankruptcy, watchdog says

The UK’s data protection watchdog has called for the personal data of UK customers of genetic firm 23andMe to be properly protected during and after its bankruptcy proceedings in the US.

The Information Commissioner’s Office (ICO) has joined with its Canadian counterpart, the Office of the Privacy Commissioner of Canada (OPC), to warn that they will take action against 23andMe if they believe user data is not protected properly during the case.

The DNA testing kit firm filed for bankruptcy protection in the US in March, after struggling with heavy losses and facing the aftermath of a data hack, and as it searches for a buyer.

Privacy experts have since raised concerns about what could happen to the vast amounts of genetic and other personal data the company holds if it is sold to a third-party, with many urging users to log in and request their data be deleted.

Now the UK and Canadian data protection regulators have written to the US Trustee, which oversees bankruptcy cases, to highlight that any potential buyer of 23andMe must adhere to both UK and Canadian data protection law.

Information Commissioner John Edwards said: “23andMe holds some of the most personal and highly sensitive information possible about its customers, including genetic data, health reports and self-reported health conditions.

“We have this week written to the US Trustee to call for the protection of this sensitive data during and after the company’s bankruptcy.

“The UK public need to trust that the bankruptcy proceedings, and any potential sale of the company or its assets, will safeguard their personal data from unauthorised use or misuse.

“We are here to advocate on their behalf and we will not hesitate to take action against 23andMe or any potential purchaser should data protection legislation not be adhered to.”

Philippe Dufresne, privacy commissioner of Canada, said: “23andMe holds the highly sensitive personal information, including DNA, of millions of customers.

My office is closely following the sale of 23andMe to ensure that any personal information relating to individuals located in Canada is handled in compliance with our federal private-sector privacy law.

“This is of the utmost importance given the significant concerns that Canadians may have about the protection of their personal information going forward, especially given that some of the data has previously been subject to a breach.”