WATCH KLOBUCHAR’S FULL QUESTIONS HERE

WASHINGTON - U.S. Senator Amy Klobuchar (D-MN), Ranking Member of the Senate Judiciary Subcommittee on Privacy, Technology, and the Law, raised concerns about what will happen to the genetic data collected by 23andMe following the company’s bankruptcy during a hearing titled “23 and You: The Privacy and National Security Implications of the 23andMe Bankruptcy.” 

 “It is my belief that the privacy policies [of 23andMe] aren't meeting the privacy needs of consumers during bankruptcy. That's why I've worked with Senator Cornyn. I appreciate his leadership, and Grassley to give consumers control over their genetic data with our bill, Don't Sell My DNA Act,” said Klobuchar.

Testifying at the hearing was Joe Selsavage, Interim CEO at 23andMe; I. Glenn Cohen, Professor of Law, Harvard Law School; Brook Gotberg, Professor of Law, BYU Law; Adam Klein, Director, Strauss Center for International Security and Law.  

A rough transcript of Klobuchar’s questions is available below. Video is available HERE.

Klobuchar: Thank you. I think I'll start by following up with Senator Blackburn's good questions. And by the way, thank you, Mr. Klein, for mentioning the need for a general privacy bill, which we badly need.

So, on this deletion issue, it's my understanding that 1.3 million consumers asked 23andMe to delete their genetic data. Many faced technical issues. So, how long is the backlog right now, and what are you doing to make sure all the requests are fulfilled?

Joseph Selsavage: Senator, the good news is that today, there is no backlog, that we are current on all of the deletion requests. What did occur, you know, is when we filed for bankruptcy. And you know, many state attorneys general requested, or suggested, to consumers that they delete their data at 23andMe. We did receive a significant amount of deletion requests. We quickly added additional staff, and you know, basically were able to reduce that backlog. 

Klobuchar: Will you commit to ensuring that consumers will retain their right to have their genetic data deleted after the bankruptcy sale is completed, by making deletion rights a condition of the sale?

Selsavage: Both of the bidders, and you know, the bankruptcy sale of 23andMe, both Regeneron and TTAM Research Institute, have agreed to adopt the policies of 23andMe, the privacy policy.

Klobuchar: So the answer is yes?

Selsavage: So, you know the answer is yes. 

Klobuchar: Okay, during the bankruptcy process, how has 23andMe insured consumers could decide how information is used and for what purposes? That's what your, that's what your website has promised consumers.

Selsavage: Our consumers consent, not only to a terms of service, a privacy policy, there are also separate consents for our customers to, if they so choose, to engage in research at 23andMe. And yet, and then a separate consent to allow us to engage with research with third parties. And you know, we make sure that customers have the right to actually opt in. We don't default those. Customers are actually clicking 'yes' to indicate that they want to conduct or enable their data to be used for research purposes. Many customers understand these are important for understanding disease and genetic conditions, and life-saving medical treatments. 

Klobuchar: Thank you. Professor Cohen, it's my belief that the privacy policies aren't meeting the privacy needs of consumers during bankruptcy. That's why I've worked with Senator Cornyn. I appreciate his leadership, and Grassley to give consumers control over their genetic data with our bill, Don't Sell My DNA Act. Why is it so important that we require consent from the consumer before their genetic data is sold to another company with which they have no prior relationship? 

Professor I. Glenn Cohen: People are engaged in a trust relationship. You know, if my father gave me access to his medical records and said, “Son, I want you to look at this and be careful with this.” And I went ahead and said, “Let me give it to somebody else” without asking my dad, you'd look askance at what I was doing. The same thing is happening here. They're essentially transferring data and transferring a trust relationship to a new entity, and people have the right to know who they're dealing with and a right to consent to it.

Klobuchar: Do you believe that the right to control one's personal genetic information should take precedence over maximizing returns for creditors in a bankruptcy proceeding? 

Cohen: Well, I think that it would be nice for the creditors to get paid. Senator, in this instance, I think this information is so sensitive and so important, it's really important to protect people's information. 

Klobuchar: Okay, thank you. And Professor Gotberg, do you believe that the current Consumer Privacy Ombudsman system in bankruptcy proceedings is sufficient to protect consumers' most sensitive information?

Professor Brook Gotberg: So, the Consumer Privacy Ombudsman is appointed to help the court in weighing the costs and the benefits of any particular sale of assets. If you permit personal consumer data to be sold outside of bankruptcy, it's permissible inside of bankruptcy as well. And so the Consumer Privacy Ombudsman is just trying to weigh what would be the negative effects of that sale. Without an understanding of the price of privacy, so to speak, that's a very hard balancing act to perform. To my knowledge, there's been no final litigation to determine what the damages would be for an individual to have their privacy violated in that way. So it makes it really hard for the Consumer Privacy Ombudsman to have an effective role there. 

Klobuchar: Okay, and sort of to end where I began with Mr. Klein's point. Why is it so important that Congress enact a comprehensive privacy law? 

By the way, the same companies that were lobbying against one, because I'm also on the Commerce Committee, say, 10 years ago, now want one because of the patchwork of laws that we now have in our states. Which is very predictable, which I hope people will realize that we should need some AI rules of the road in place and tech rules of the law in place. And it's just the worst that people just think they can lobby against things, and then all of a sudden they're like, “oh no.” So, tell me why we need a privacy law and how that would have helped here.

Gotberg: So, a greater predictability for companies when they're entering into agreements with consumers would be, is always beneficial. So if companies know what the legal limitations are, then they can take that into account, and creditors can take that into account whether an asset will be available before lending to the, to the debtor. So it's important to have that law in place inside and outside bankruptcy.

###