When the Genomics Company Fails: A Policy Guide to Bankruptcy Proceedings and the Fate of Stored Genetic Data

When a consumer genomics company files for bankruptcy, the most valuable asset on its balance sheet is often not laboratory equipment or office leases. It is the database: millions of genotyped samples, linked health surveys, family trees, and contact information, all assembled under terms of service that most customers never read closely. Recent events in the sector, including the well-publicized 23andMe restructuring, have made this scenario concrete rather than hypothetical, and the Institute has received sustained inquiries from policymakers, researchers, and consumers seeking to understand what the law actually requires. This explainer outlines the legal terrain.

Why Genetic Data Appears in the Asset Column

Under the US Bankruptcy Code, a debtor's estate includes substantially all property interests, and courts have generally treated customer data as an asset subject to sale. The Privacy Act of 1988 and the Federal Trade Commission Act provide some constraints, but neither was drafted with genomes in mind. The Health Insurance Portability and Accountability Act (HIPAA), often cited in popular discussion, typically does not apply to direct-to-consumer genomics companies, which are generally not covered entities.

The result is that genetic databases are frequently available to a purchaser, subject primarily to the company's own privacy policy and whatever contractual restrictions were negotiated at the time of collection. In the 23andMe proceedings, court filings and oversight from state attorneys general ensured that any transfer would be conditioned on the company's existing privacy commitments, and the bankruptcy court required additional notice and consumer protections. That outcome, however, reflected unusual scrutiny rather than a settled statutory mandate.

The Limits of Existing Safeguards

Three structural weaknesses recur across bankruptcy cases involving sensitive consumer data:

• Contractual dependence. Privacy promises bind only the original company and any assignee that agrees to honor them. A purchaser can sometimes renegotiate, and enforcement against a foreign acquirer is uncertain.
• Notice asymmetry. Consumers often learn of a data transfer through media reports, not direct notification, because bankruptcy notice requirements are directed at creditors.
• Fragmented state law. California's Genetic Information Privacy Act and a handful of similar statutes impose consent requirements for transfers, but coverage varies dramatically by state, echoing the patchwork this Institute has documented in earlier work on interstate privacy divergence.

The Federal Trade Commission has enforced privacy policies through Section 5 even in insolvency, most notably in the 2000 Toysmart consent order, which permitted sale of customer data only to a buyer that agreed to use it under the same restrictions. That precedent remains the closest thing to a federal floor, but it is a settlement term, not a statute.

What Reform Would Require

A durable framework would need to address the bankruptcy context specifically. Candidate provisions include: mandatory consumer notification before any transfer of genetic data; an affirmative right to deletion exercised through a simple portal process that survives corporate dissolution; designation of genetic data as a disfavored asset requiring court approval with public comment; and a custodial alternative, such as a nonprofit data trust, to which databases could be transferred when no compliant buyer exists.

Several of these ideas appear in pending state legislation and in the working papers this Institute has published on data federation and consent architecture. The bankruptcy window is precisely when governance failures are most visible, and reforms drafted for that moment would strengthen privacy across the entire data lifecycle.

A Practical Checklist for Consumers

Until the law changes, individuals retain more leverage than they may realize. Before using a consumer genomics service, ask:

1. Does the privacy policy address bankruptcy or acquisition explicitly, and does it promise deletion on request?
2. Is there an account-level setting to delete data and destroy the physical sample, and has it been exercised?
3. Are research consents revocable independently of account closure?

After a company announces financial distress, consumers should promptly log in, download or delete their data, and submit formal deletion requests in writing. Requests submitted before a sale closes are far harder for a purchaser to ignore.

Conclusion

The 23andMe episode demonstrated that courts, regulators, and attorneys general can raise the cost of treating genomes as ordinary inventory. But the protections that prevailed were improvised. Codifying them, through federal baseline rules and interoperable state statutes, would ensure that the next corporate failure does not leave millions of Americans guessing about the fate of their most personal data.