Schiff To 23andMe CEO: What Controls Are There To Prevent Data Misuse Amid Bankruptcy Proceedings?

Forbes Breaking News

During a Senate Judiciary Committee hearing on Wednesday, Sen. Adam Schiff (D-CA) questioned Joseph Selsavage, Interim Chief Executive Officer and Chief Financial and Accounting Officer of 23andMe Holding Co., about data privacy controls of sensitive data.

Transcript

00:00that went into effect in 2022 requiring direct-to-consumer genetic testing companies like

00:0523andMe to obtain Californians' express consent for the collection, use, or disclosure of their

00:11genetic data. Under this law, Californians are also able to delete their accounts and genetic

00:16data and to destroy the biological samples they provided to these companies. In the context of

00:2323andMe's bankruptcy, can Californians still exercise these deletion rights, or does the

00:30bankruptcy process somehow interfere with, override, or otherwise affect our state's privacy protections?

00:37Thank you. Bankruptcy proceedings do not override any applicable law. So state law and federal law

00:43are recognized in bankruptcy proceedings. Whatever rights your consumers have outside bankruptcy,

00:48they'll have inside bankruptcy in terms of their legal rights.

00:50And if the database, 23andMe's database, is sold as a bankruptcy asset, what obligations would the

01:00acquiring company have under a federal or California law to maintain those same security standards?

01:06So the same laws that would apply now to 23andMe would presumably apply to any buyer.

01:13And even, so even if this is not a California company operating in some other state, they would

01:19still be bound post-bankruptcy to California's privacy standards?

01:23To the extent that California privacy standards apply, yes, they would.

01:28And is a commitment made by an acquiring company somehow enforceable? Apart from California's law,

01:35vis-a-vis residents of other states, is a promise made by an acquiring company somehow legally enforceable,

01:42or is it only as good as the person's intention to comply with that commitment?

01:48So contractual promises are enforceable up to the point that they can be enforced.

01:52That's not a great answer, but again, our statement is a contract is a promise to perform or to pay damages.

01:59It's possible for parties to breach that agreement, in which case the party that, on the other side of it,

02:05would be entitled to damages for the harm that they've experienced.

02:07But I guess, you know, let's say I'm acquiring 23andMe's data set.

02:13I commit to maintaining the deletion provisions, et cetera, complying with California law,

02:20even if it's not required somehow.

02:24I acquire the data set.

02:26I don't comply.

02:28Right.

02:28Has my offer to comply or my commitment pre-bankruptcy,

02:35has that somehow turned into a binding contract with the owners of the genetic data,

02:42the people who have the genetic data?

02:44So it would depend on who you were in privity with, I guess,

02:48in terms of the contract to use, I guess, a fancy legal term.

02:51A contract is between two parties, and so you have to have an agreement between those two parties.

02:58And I guess the question in those situations, if you were promising to abide by the commitment,

03:03who would be on the other side of that promise?

03:05Who would be able to enforce it?

03:07Right.

03:07Well, it would sound like the consumer would not be on the other side of that promise.

03:11It would be more one of the parties to the bankruptcy, which we would be then reliant on them to enforce that promise.

03:21Does that analysis make sense?

03:24That makes sense to me.

03:27And what controls are in place, Mr. Selsavage, maybe I can ask you this question.

03:31What controls are in place to prevent any unauthorized access or misuse of information during the bankruptcy proceedings?

03:38You know, 23andMe is, you know, basically places data security and data privacy is top of mind.

03:45You know, we basically have continued to maintain a strong system of security, making sure all of our data is encrypted.

03:53You know, the genetic data is stored separately from any consumer identifying information,

03:58identifying who that genetic data belongs to.

04:00We have enhanced our security processes, especially around bankruptcy, understanding that there is additional threats.

04:05And, you know, basically from on the consumer side, you know, we have since enacted two-factor authentication to access,

04:12so basically there is a second level of either an SMS text message or an email verification when somebody is trying to access their account

04:20and then placed additional restrictions if sensitive.

04:23If I could just interrupt with one last question because my time is going to expire.

04:27How do we know that an acquiring company or entity or person would maintain the same security standards that you have over privacy

04:37and even those standards were subject to hack?

04:41Senator, the good news here is there's two potential buyers at this point for 23andMe.

04:46The first is Regeneron, an American $55 billion market cap pharmaceutical company

04:52who actually has data security over genomic data today, and TTAM Research Institute would be,

04:59which would be maintaining the same security standards as 23andMe.

05:03Senator Bray.

05:05Thank you, Mr. Chairman.

05:07To follow up on the Senator's question, so would you commit today to the same privacy standards

05:13that you have demanding those of the company that purchases 23andMe?

Category

Transcript

Recommended