23andMe’s Genetic Data Trove Rests on Professor as Protector (1)

A crucial step in handling the sale of genetic data from over 15 million 23andMe customers now rests largely in the hands of a law professor.

The May 19 announcement that Regeneron Pharmaceuticals Inc. will buy most of the assets of the bankrupt genetic testing provider started a countdown for Washington University School of Law professor Neil Richards, the court-appointed privacy ombudsman, to investigate the company’s privacy policies.

In a report due before June 10, he’ll recommend to the judge whether—and how—the sale of data should take place, highlight any necessary changes to mitigate consumer harm, and evaluate Regeneron’s cybersecurity controls.

Such roles have historically prioritized ensuring the seamless sale of assets. But the unusual sensitivity and security risks surrounding 23andMe’s customer data, coupled with stringent federal, state and, international regulatory oversight, may give new weight to the ombudsman’s recommendations.

“We’re at the second inning of this whole thing,” said Alan Chapell, outside counsel and chief privacy officer for technology companies, and privacy ombudsman in over 25 bankruptcy cases. “It’s going to be really interesting to see what takes shape as a result of this.”

Richards declined to comment ahead of the report.

A ‘Unique’ Pick

This appears to be the first privacy ombudsman appointment for Richards, who teaches courses on privacy, free speech, and constitutional law—a notable pick for a bankruptcy court that tends to rely on a small set of recurring experts.

“That seems to me to be just the kind of resume that that you want,” said Clifford White, former director of the US Trustee Program, the Department of Justice’s bankruptcy watchdog. “He may have some innovative thoughts,” he added.

In bankruptcy cases that involve personally identifiable information, the trustee can appoint an ombudsman to advise the court on the consumer privacy impact of the asset sales. The privacy ombudsman’s role was created 20 years ago in response to Toysmart.com’s attempt to sell consumer information, including children’s data, to the highest bidder during its bankruptcy proceedings. That attempted sale conflicted with the company’s privacy policy, and it was challenged by the Federal Trade Commission and other regulators.

Since then, ombudsmen have been appointed sporadically, and the US Trustee Program has kept an unofficial list of privacy and bankruptcy professionals to perform the function.

“To do the job, you really have to have a fairly unusual set of characteristics” to understand both areas of the law, said Warren E. Agin, senior director of contract intelligence for contract AI firm Clearlaw and former privacy ombudsman.

He added, “Nobody wants a privacy ombudsman who is going to upset a bankruptcy sale’s process.”

Richards stands out for his experience as an academic, his writings on privacy and civil liberties, and his expert testimony in litigation versus Big Tech—including in a proposed class action under the Illinois Biometric Information Privacy Act against Amazon.com Inc .

His “more unique” qualifications match the singularity of this case, said Luis Salazar, founder of Salazar Law LLP and a repeat privacy ombudsman, referring to the sensitivity of the genetic data.

The US Trustee declined to comment.

Working With Regulators

Richards’ appointment came in response to mounting concerns from state attorneys general and the FTC regarding the sale of genetic data from 23andMe’s 15 million customers.

In previous bankruptcy cases, the FTC has sometimes reached out directly to ombudsmen to advocate for consumer protections, such as during Borders Group’s 2011 bankruptcy sale or RadioShack’s in 2015. FTC Chairman Andrew N. Ferguson warned in March that the agency would closely watch 23andMe’s data sale.

The agency insisted 23andMe’s current privacy protections will have to continue “even if the data is sold or transferred.”

Though privacy ombudsmen are independent experts, anyone “would seriously consider anything that’s submitted by the FTC,” Salazar said.

The FTC declined to comment on when and how it whether it might work with Richards ahead of the report.

Regeneron said it is prepared to work with Richards. “We think the external, expert validation will be helpful for deepening both the Court’s and customers’ confidence in this how this acquisition protects the privacy interests of 23andMe customers,” a company spokesperson said in an email.

The company is “committed to protecting the 23andMe dataset with our high standards of data privacy, security and ethical oversight,” the spokesperson said.

Privacy Theater?

Richards will assess whether the sale violates promises 23andMe made in its privacy policies. He’s also charged with evaluating whether customers should opt in or out of selling their data, the security protections in place if data is sold, and under what conditions the data was originally collected.

But it’s too soon to tell whether Richards’ recommendations will meaningfully influence the sale, especially in light of some skepticism toward the scope of the ombudsman’s role.

“The regime is best understood as a form of ‘privacy theater,’ intended to reassure the public that consumer data is protected in bankruptcy proceedings,” US Bankruptcy Judge Christopher G. Bradley wrote in a 2023 law journal article about ombudsmen. In reality, he added, the current system “does not fulfill its promise of protecting consumer data.”

Some criticism has been fueled by the role’s own statutory limitations: A privacy ombudsman is an adviser, not a consumer advocate. The role is meant to ensure that sales of a bankrupt company’s assets move forward, often against tight deadlines.

To do so, ombudsmen often work with parties to ensure the sale’s terms are attainable before publishing their report.

“There’s a lot more to the privacy analysis than just looking at the privacy policy, especially given the recent enactment of state privacy laws,” said Lucy Thomson, principal of Livingston PLLC. She’s served as ombudsman more than 35 times.

Whatever Richards recommends, Judge Brian C. Walsh has the last word on the sale’s terms.

“There’s truth to the idea that consumer privacy ombudsmen don’t have a veto,” Salazar said. In that sense, he added, “it doesn’t have a lot of fangs.”