The School of Law’s Neil Richards has dedicated a significant portion of his summer delving into inquiries concerning consumer protection and genetic privacy legislation.
During the bankruptcy proceedings of the genetic testing firm 23andMe, various regulators and consumer advocacy groups raised concerns regarding privacy and data security issues related to the potential sale of sensitive genetic information collected and retained by the company. These concerns became especially pressing following 23andMe’s data breach in October 2023—an incident deemed preventable by many data security specialists.
The involved parties concurred that a Consumer Privacy Ombudsman (CPO) ought to be appointed to assist the court in navigating the unprecedented and complex privacy matters related to such a transaction.
As the situation unfolded in federal bankruptcy court in St. Louis, a name that quickly emerged as a possible CPO was Richards, the Koch Distinguished Professor of Law at Washington University in St. Louis—one of the leading authorities on privacy law worldwide.
Richards also serves as co-director of the university’s Cordell Institute for Policy in Medicine & Law, which specifically addresses issues at the nexus of healthcare, privacy, technology, and law.
“Genetic data is enormously significant and raises a multitude of novel and uncharted legal and ethical dilemmas,” Richards remarked.
Founded in 2006 to provide genetic testing and interpretation to individual clients, 23andMe filed for bankruptcy in March after millions of customers deleted their data in response to the data breach, while state privacy regulators investigated the company’s allegedly deficient data management practices. Several potential buyers expressed interest in acquiring 23andMe and its extensive collection of genetic data, prompting attorneys general from 27 states to assert that the sale might infringe upon various state privacy laws.
Richards was designated as CPO to assist the court in determining whether the proposed sale contravened any privacy or related statutes and to represent consumers’ interests in any potential transactions.
Richards began investigating these issues with the assistance of Ryan Durrie, policy director of the Cordell Institute. They engaged with representatives from 23andMe, two prospective bidders (Regeneron and TTAM Research Institute), the creditors’ committee, lawyers representing consumers impacted by the data breach, regulators, and others.
After more than a month of fact-finding, interviewing, and writing, they produced a comprehensive 211-page report. Richards recommended that any purchaser of 23andMe must, at minimum, commit to upholding 23andMe’s current privacy policies and the capacity to withdraw consent for future research.
Other notable recommendations included that the buyer obtain consent from consumers, or provide explicit notification of the transaction directly to consumers, and establish protections for posthumous use, recognizing that deceased individuals cannot delete their data.
U.S. Bankruptcy Court Judge Brian Walsh stated at the sale hearing that Richards’ report was instrumental in “organizing the facts and otherwise emphasizing the critical privacy issues at play in this case.”
“It was quite an effort, but also truly exhilarating,” remarked Richards, who has functioned as an expert witness in privacy cases concerning Facebook and other tech firms over recent years.
On July 5, the bankruptcy judge sanctioned the acquisition of 23andMe by a new buyer, TTAM Research Group, a nonprofit led by Anne Wojcicki, the former CEO and co-founder of 23andMe. The final sale price reached $305 million. As part of the acquisition, TTAM committed to adhering to the existing 23andMe privacy policies and honoring customer requests to erase information or withdraw their data from research utilization.
“These opportunities truly are a privilege as they involve such significant and impactful work. These cases could set precedents regarding genetic privacy and potentially bring about changes to current legislation,” Richards stated. “Additionally, this work is particularly valuable as an academic in training lawyers to operate in the real world. I can integrate insights back into WashU that enhance my teaching and enrich my scholarship.”
The post Richards serves as privacy ombudsman in 23andMe bankruptcy case appeared first on The Source.