WASHINGTON – U.S. Senate Democratic Whip Dick Durbin (D-IL), Ranking Member of the Senate Judiciary Committee, today questioned witnesses during a Senate Judiciary Committee hearing entitled “23 and You: The Privacy and National Security Implications of the 23andMe Bankruptcy.” Today’s hearing examined the bankruptcy of 23andMe, Inc., and the potential sale of the company’s database of customers’ personal genetic information. The hearing also provided an opportunity to examine policy and ethical issues associated with the collection and use of personal genetic information, the need for a comprehensive federal data privacy law in the United States, and the treatment of consumer data privacy in the bankruptcy process.
Durbin began by asking Joe Selsavage, Interim CEO & Chief Financial & Accounting Officer at 23andMe, about 23andMe’s privacy policy and the need for a federal data privacy law to ensure individuals’ sensitive information is subject to a minimum degree of protection.
“So, it seems to me that 23andMe tried, Mr. Selsavage, to come up with a policy to protect its consumers,” Durbin said. “But there is little to guarantee that the next buyer or the one after that won’t abuse that policy, is there?”
Mr. Selsavage responded, “23andMe has required as part of the sale of the assets of the company that any buyer of the company must comply and adopt the privacy policy and consents that 23andMe has in place today.”
Durbin pushed back, saying, “What I am suggesting to you is that two or three buyers removed, your best intentions don’t mean much, do they?”
Mr. Selsavage repeated his first response noting that 23andMe has required as part of the sale of the company that any buyer must comply and adopt the privacy policy and consents that 23andMe has in place today.
Durbin responded, “Unless we have a federal law relative to this issue that applies to future transactions, your best intentions don’t mean much.”
Durbin then asked Glenn Cohen, Professor of Law at Harvard Law School and Director of the Petrie-Flom Center for Health Law Policy, about the best-selling book called The Immortal Life of Henrietta Lacks. It tells the story of an African American woman who died in 1951 of cervical cancer. A sample of her tumor generated what is known as the HeLa cell line. That cell line was mass-produced and sold to laboratories all over the world. It has been used in scientific research, including research into cancer, the human genome, and the development of the polio vaccine. It’s still being used today. Famously, Henrietta Lacks never consented to the use of her cells in this way. And, despite the vast sums of money the cell line has generated, her family has never seen a dime of those profits.
“Part of what is being sold by 23andMe is a collection of biological samples submitted by consumers who wanted their DNA examined. They may have consented to some use of their samples, but I question how informed it actually was,” Durbin said. “And there’s no guarantee a new owner won’t change how those samples are used. Are you familiar with this story? Is there anything we can learn from it in this application?”
Professor Cohen said he was familiar with this story, responding, “[We can learn the] importance of affirmative consent. And again, affirmative consent that can explain, as much as possible, what you want to do with the material. And again, we still haven’t heard an answer in why, at this stage, they are not going back to all of their customers and asking, ‘can you consent to the transfer of your data to this new buyer?’ It is a very simple thing that the company could do. Why aren’t they doing it?”
Durbin then directed Professor Cohen’s question to Mr. Selsavage: “Why aren’t you doing it [going back to all of their customers and asking, ‘can you consent to the transfer of your data to this new buyer?’]? Mr. Selsavage?”
Mr. Selsavage said that 23andMe believes that they have obtained consent from their customers when they signed up for the service.
Durbin noted that what Professor Cohen is suggesting is that there is more that could be done to protect 23andMe’s consumers. Mr. Selsavage responded, “I can take that back to our team.”
Durbin concluded by asking Brook Gotberg, Professor of Law at Brigham Young University Law School, about the need for a federal data privacy law to ensure individuals’ sensitive information is subject to a minimum degree of protection.
“I guess my conclusion from your testimony was the bankruptcy code really didn’t envision what we were talking about?” Durbin said. “And what you say is, in your testimony, ‘current bankruptcy law provides some oversight that can prevent the worst privacy policy abuses in a bankruptcy sale, but it does not prohibit the sale from taking place. Placing a prohibition on bankruptcy sales would simply push them outside bankruptcy proceedings where there are fewer protections. The best policy would make any restrictions on the sale of personal consumer data universally applicable. It’s time for us to legislate, isn’t it?”
Professor Gotberg responded, “If you want to protect consumers from having their personal consumer data bought and sold, you need to do that.”
Video of Durbin’s questions in Committee is available here.
Audio of Durbin’s questions in Committee is available here.
Footage of Durbin’s questions in Committee is available here for TV Stations.
-30-