The School of Law’s Neil Richards has spent much of his summer knee-deep in questions related to consumer protection and genetic privacy law.
During the bankruptcy proceedings for genetic testing company 23andMe, various regulators and consumer groups raised questions about the privacy and data security issues surrounding the potential sale of sensitive genetic data the company collects and stores as part of its business. These issues became particularly important given 23andMe’s data breach in October 2023 — one that many data security experts believe was avoidable.
The parties involved agreed that a Consumer Privacy Ombudsman (CPO) should be appointed to help advise the court about the novel and complex privacy issues involved in such a sale.
As the case played out in federal bankruptcy court in St. Louis, one name that immediately surfaced as a potential CPO was Richards, the Koch Distinguished Professor in Law at Washington University in St. Louis — one of the world’s foremost experts on privacy law.
Richards is also co-director of the university’s Cordell Institute for Policy in Medicine & Law, which focuses specifically on issues at the intersection of health care, privacy, technology and law.
“Genetic data is massively important and raises a host of novel and unexplored legal and ethical questions,” Richards said.
23andMe was founded in 2006 to offer genetic testing and interpretation to individual consumers. The company filed for bankruptcy in March after millions of its customers deleted their data due to the data breach, and state privacy regulators were investigating the company for its allegedly poor data practices. Several potential bidders were interested in purchasing 23andMe and its trove of genetic data, leading attorneys general in 27 states to claim the sale could violate various state privacy laws.
Richards was appointed CPO to help the court determine if the potential sale violated any privacy or related laws and to articulate consumers’ interests in any proposed transaction.
Richards started examining the issues with the help of Ryan Durrie, policy director of the Cordell Institute. They met with representatives from 23andMe, two bidders for the company (Regeneron and TTAM Research Institute), the creditors committee, lawyers representing consumers affected by the data breach, regulators and more.
It took more than a month of fact finding, interviewing and writing, resulting in a 211-page report. Richards recommended that any buyer of 23andMe should agree, at minimum, to honor 23andMe’s existing privacy policies and ability to revoke consent to research going forward.
Some additional key recommendations included that the buyer obtain consent from consumers, or provide specific notice of the transaction directly to consumers, and implement posthumous use safeguards, recognizing that people who have died cannot delete their data.
U.S. Bankruptcy Court Judge Brian Walsh said at the sale hearing that Richards’ report was very helpful for “marshaling the facts and otherwise highlighting the important privacy issues we have in this case.”
“It was a lot of work, but it was also really exciting,” said Richards, who also has served as an expert witness in privacy cases involving Facebook and other technology companies over the last several years.
On July 5, the bankruptcy judge approved the sale of 23andMe to a new buyer, TTAM Research Group, a nonprofit led by Anne Wojcicki, the former CEO and co-founder of 23andMe. The final sales price was $305 million. As part of the purchase, TTAM agreed to follow the existing 23andMe privacy policies and to honor customer requests to delete information or to withdraw their data from research use.
“These things really are an honor to do as it’s such important and meaningful work. These cases could determine precedent on genetic privacy and could potentially result in changes to the current law,” Richards said. “I also think this work is especially important as an academic preparing lawyers to practice out there in the world. I can bring things back to WashU that helps my teaching and informs my scholarship.”
