00:00Thank you, Chairman Grassley, and thank you to each of the panelists for coming here today
00:05and testifying on this important issue.
00:08It is particularly valuable that you're here to shed light on two issues important to our nation,
00:14to our families, and frankly also to my home state of Delaware, namely bankruptcy and data privacy.
00:22As I'm sure some of you know, Delaware is the most popular state in our nation for corporate incorporation,
00:28which also makes it a prominent bankruptcy jurisdiction.
00:32Delaware also is one of a small handful of states that's enacted robust data privacy protection laws,
00:39making it a potential model for federal legislation on data privacy, particularly in the context of bankruptcy.
00:46I do think it's critical that we strike the right balance between safeguarding data and personal information
00:51and maintaining a bankruptcy system that makes creditors whole and gives debtors a fresh start.
00:56If I might, Professor Gottberg, is a prospective buyer in bankruptcy legally required to follow 23andMe's current privacy policy?
01:07So the privacy policy is a contract.
01:10Right.
01:10So contracts are enforceable as between the two parties.
01:15In law school, we like to teach that a contract is a promise to perform or to pay damages.
01:20So a company that undertakes a contract, if they don't perform, would open itself up to a lawsuit for damages.
01:27That's true for 23andMe, and it would be true for any subsequent buyer.
01:30Whatever the subsequent buyer agreed to do would just be a contract.
01:34There would be no enforcement mechanism to force them to comply.
01:38They could just choose to breach.
01:39Nothing other than damages enforces that contract.
01:42And is there anything in the bankruptcy code that specifically addresses the transfer and use of highly sensitive personal data?
01:49In that situation, that is where the Consumer Privacy Ombudsman could be appointed.
01:55Could be.
01:55Right.
01:56But in that situation, their role is primarily to advise the bankruptcy judge to weigh the costs and benefits of any potential breach of a privacy policy.
02:05So, again, without being able to put a number on what those damages are, what the cost is for a violation of privacy, it actually becomes a pretty difficult weighing exercise.
02:15Is there any relevant precedent?
02:18I don't know that it's ever been litigated.
02:20I haven't seen anything.
02:21Me neither.
02:22Professor Cohen, Delaware and a few other states have enacted strong data privacy laws designed to regulate entities that control sensitive data,
02:31give individual consumers the right to access, correct, or delete certain data.
02:36How can my colleagues and I do something similar at the federal level and specifically in the bankruptcy context to ensure sensitive data doesn't end up in the hands of the wrong people
02:44or the wrong country as a result of a bankruptcy proceeding?
02:49And what's your view on the Don't Sell My Data Act, where I've joined Senators Grassley, Cornyn, and Klobuchar as a co-sponsor?
02:55So, I think the Don't Sell My Data Act is exactly the right idea here.
03:00I will say that I think that what's important is this idea of affirmative consent.
03:05That's what's central to the bill upon the transfer.
03:09And again, we still really haven't heard a good reason why we can't go back to all of these people and ask them,
03:13can you affirmatively consent to the transfer of your data to Regeneron or TTAM?
03:17So, I'd love to see Congress push that and push it beyond bankruptcy to other kinds of sales of information as well.
03:23Let me ask you a question about affirmative consent.
03:25Part of the market value of 23andMe is a service that is individually genetically identifying that gives you information about,
03:35honestly, one of the most private things there could be, which is whether or not you're susceptible to certain diseases,
03:41what's your genetic ancestry, that sort of thing.
03:43Would it not stand to reason that although logistically challenging,
03:49going back to every individual who's given their personally identifying genetic information at 23andMe
03:54and affirming their consent would actually, in the end, build their market value
04:00by reinforcing that this kind of a service is something where people can count on it
04:06to protect their data privacy regardless of whether there are damages available?
04:10I think if you build your company on a reputation of trust and a reputation of autonomy and empowering people,
04:16this is exactly the thing you want to sell to customers to say,
04:19we believe so much in what we say that we're even going to do this upon sale or bankruptcy.
04:23I mean, I understand how it might be complex or expensive,
04:25but in the end, I think it ultimately serves the entire segment of personally identifying genetic consult
