Congress to examine 23andMe’s management of confidential information

Following biotechnology company 23andMe’s filing for bankruptcy, losing its CEO, and searching for a buyer last month, the House Committee on Energy and Commerce initiated an investigation into the genetic data company’s management of customers’ personal information. On Friday, the committee sent a letter to 23andMe regarding the potential sale of sensitive customer information following its Chapter 11 bankruptcy filing. The letter was signed by committee Chair Rep. Brett Guthrie of Kentucky, Rep. Gus Bilirakis of Florida, and Rep. Gary Palmer of Alabama. The latter two are chairmen of the Subcommittee on Commerce, Manufacturing, and Trade and the Subcommittee on Oversight and Investigations, respectively.

The letter notes that according to 23andMe’s privacy policy, in the event of bankruptcy, customers’ personal information may be “accessed, sold, or transferred as part of that transaction.” Furthermore, a judge recently ruled that 23andMe has the right to sell the sensitive medical and genetic data of its 15 million customers, which is deemed the company’s most valuable asset. “With the absence of a federal comprehensive data privacy and security law, we express our significant concern regarding the safety of Americans’ most sensitive personal information,” the letter states. The committee then poses several questions for the company, including how 23andMe plans to vet potential buyers and how it intends to safeguard people’s data in the event of a sale. The Committee of Energy and Commerce requested responses by May 1.

In a press release, 23andMe outlined the bidding requirements and procedures for a sale, emphasizing that it will not accept bids from entities based in or managing investments from “countries of concern” such as China, Cuba, Iran, North Korea, Russia, or Venezuela. Regarding personal data management, the company stated, “23andMe takes its responsibility as a steward of customer data seriously. The Company maintains strict data privacy and security protocols and is subject to consumer privacy and genetic privacy laws.”

In recent years, the genomics company has faced scrutiny due to a data breach and a subsequent lawsuit. Since 23andMe is not covered by the Health Insurance Portability and Accountability Act (HIPAA), customer information does not receive those privacy protections. Following the bankruptcy announcement and the resignation of former CEO Anne Wojcicki in March, customers may want to review their data management options with 23andMe.

UPDATE: Apr. 21, 2025, 10:15 a.m. EDT This article has been updated to include a press release from 23andMe.