Historical Context

Bankruptcy proceedings involving customer data can lead to unexpected consequences for consumers. High-profile cases, such as that of ToySmart in 2000, highlighted the need for robust protections. In this instance, the Federal Trade Commission (FTC) intervened to prevent the retailer from selling its customer data as a standalone asset, requiring that users consent to any new uses of their information.

Similarly, in 2015, the FTC took action during RadioShack’s bankruptcy to ensure that the company would adhere to its commitments regarding the sale of personal customer data. Ultimately, RadioShack agreed to dispose of the data rather than risk misuse.

The Role of Consumer Privacy Ombudsman

The ToySmart case established the role of the consumer privacy ombudsman, an appointed figure by bankruptcy judges to evaluate the implications of selling personal data within bankruptcy cases. The ombudsman assesses potential benefits and harms to consumers, providing courts with critical insights that can shape decisions regarding data sales.

The U.S. Trustee has requested the appointment of such an ombudsman in recent bankruptcy proceedings, reflecting ongoing concerns about consumer data protection. Although experts argue for enhanced authority and intervention from the FTC and state bodies, existing frameworks exist to manage personal data in bankruptcy effectively. Ultimately, bankruptcy judges hold significant decision-making powers regarding the fate of such assets.

The Case of 23andMe

Current concerns arise in light of 23andMe’s more lenient privacy policies compared to ToySmart or RadioShack. Genetic data presents severe risks; if mismanaged or used improperly, the consequences can be irreversible. Given 23andMe’s struggles to maintain a sustainable business model based on genetic testing, there is growing apprehension that prospective buyers may exploit user data in ways that users wouldn’t approve of.

Implementing Opt-In Frameworks

An effective solution to these risks could involve an opt-in requirement for genetic data usage. Under such a model, a bankruptcy trustee could safeguard genetic information, releasing it only with explicit user consent. If users do not opt in within a designated time, the data would be permanently deleted. This approach could motivate new owners to gain user trust, fostering a business model grounded in respect for user privacy, rather than exploitation of sensitive data.

Weighing Privacy Against Value

Before 23andMe entered bankruptcy, previous acquisition attempts valued the company at $74.7 million and $12.1 million, respectively. Based on the higher valuation and the estimated 15 million users, this equates to around $5 per individual user. This raises a critical ethical question: is it ethically justifiable to jeopardize an individual’s genetic privacy for the sake of enhancing the bankruptcy estate’s value by a minimal amount?

The Need for Legislative Action

A fundamental question persists: how is it permissible for companies to acquire the genetic data of millions of Americans during bankruptcy? The answer lies in legislative inaction. Current federal and state laws permit companies to override promises regarding the privacy of sensitive consumer data with alarming ease. Launched in 2006, 23andMe was presented as a pioneer in personalized health care. Yet, as we stand nearly two decades later, the prevailing privacy laws cast doubt on the public’s willingness to embrace such innovations.