Congress Is Investigating 23andMe’s Handling of Personal Data

Republican lawmakers associated with the House Committee on Energy and Commerce are probing the 23andMe bankruptcy out of concern for Americans’ DNA information.

The troubled genomics company has been in a downward spiral ever since it suffered an unfortunate data breach in 2023. The company has since endured a maelstrom of conflict and controversy, including layoffs, litigation, and a plummeting financial valuation. In March, it filed for Chapter 11 bankruptcy and has been looking for a buyer for its genetic data business ever since.

On Friday, Congressmen Brett Guthrie (R-KY), Gus Bilirakis (R-FL), Gary Palmer (R-AL), sent a letter to 23andMe making several inquiries about the company’s handling of Americans’ data. The letter notes that a judge “recently ruled 23andMe has the right to sell the sensitive medical and genetic information of its 15 million customers, which is considered to be the company’s most valuable asset” and states that, with “the lack of a federal comprehensive data privacy and security law, we write to express our great concern about the safety of Americans’ most sensitive personal information.”

The letter notes that some customers have reported difficulties in deleting their accounts and information, and asks the company to explain how many of those deletion requests have been fulfilled. It also asks whether the company has a “vetting process” in place to determine whether its prospective buyer has a “history of implementing data security protections and compliance with sectoral, state, or any other data privacy and security laws.”

It should be noted that while the Republican letter complains of a lack of a “federal comprehensive data privacy” law, lawmakers have only themselves to blame for this, given the fact that there have been multiple (failed) attempts to pass such a law.

Gizmodo reached out to 23andMe for comment.

Concern for 23andMe user data may be high, although the company has repeatedly promised to continue protecting customers’ information. A press release from March notes that to “constitute a qualified bid, potential buyers must, among other requirements, agree to comply with 23andMe’s consumer privacy policy and all applicable laws with respect to the treatment of customer data.” In other words, the data privacy assurances that the company currently promises will be carried over to whatever company buys the business.

You may feel that doesn’t amount to much, given the fact that the company has already allowed user information to be compromised via its previous data leak. If so, you can still ask the company to delete your information via the process described here, courtesy of the Electronic Frontier Foundation.