§ 363 Sale of Genetic Information? (In re 23andme)

By: Donald L Swanson

Here are two legal policies in these United States that can conflict:

• personally identifiable information (“PII”) needs be protected; and
• in bankruptcy, asset values need to be maximized.

The conflict is this: what happens when value maximization in bankruptcy requires the sale of PII?

A recent example of a bankruptcy court struggling with this conflict is, In re 23andme Holding Co., Case No. 25-40976, Eastern Missouri Bankruptcy Court (decided June 27, 2025; Doc. 908).

What follows is a summary of the In re 23andme opinion.

Facts

Debtor operates a direct-to-consumer genetic-testing business and has 13 million customers on the day it files a voluntary Chapter 11 bankruptcy petition.

Here’s how Debtor’s business works: after creating an account, each customer sends a saliva sample to Debtor to be tested.  Customers can then:

• learn about their personal genome, including their ancestry and susceptibility to certain illnesses; and
• participate in medical research—more than 80% choose to do so, and data provided to researchers is deidentified (i.e., not associated with individual customers).

Customers may opt out of medical research at any time. They also have the right to delete their accounts and to direct Debtor to dispose of their saliva samples—1.9 million customers have deleted their accounts since Debtor’s bankruptcy filing.

PII & Privacy Policies

Debtor maintains consumer-related assets in physical form (saliva samples housed in biobanks) and in electronic form (DNA testing results and other customer account information such as names and email addresses).  Both forms qualify as PII.

Debtor’s website emphasizes that:

• Debtor is committed to protecting consumer data;
• consumers are in control of their genetic information;
• Debtor “does not sell, lease, or rent your individual-level Personal Information without explicit consent,” but information might be sold as part of a sale of assets; and
• in some states, customers have a right to “opt-out of a sale or sharing of your Personal Information with a third party.”

Debtor’s contract with each of its customers includes an acknowledgement that:

• customer’s personal information may be “accessed, sold or transferred” in connection with a merger, acquisition, or sale of Debtor’s assets; and
• Debtor’s privacy policies will apply to any successor or purchaser.

Bankruptcy Filing

Before filing bankruptcy, Debtor’s Owner/Co-Founder considers various steps to address Debtor’s financial struggles, such as taking Debtor private.

Meanwhile, a Special Committee of independent directors is formed to consider the Owner/Co-Founder’s proposals, bankruptcy, and other options.

The Special Committee, (i) tries, unsuccessfully, to sell Debtor’s assets, and (ii) then decides on filing bankruptcy and liquidating Debtor’s assets through a bankruptcy sale. 

Debtor cites several causes for its Chapter 11 filing, such as inflation and rising competition, but

• the biggest strain is from legal actions relating to a 2023 data breach, during which hackers accessed data from 7 million of Debtor’s customers.

Proposed Transaction

In the bankruptcy, a multi-days auction produces a $305 million highest bid—from TTAM Research Institute.  TTAM is a non-profit public-benefit corporation, created and funded by Debtor’s Owner/Co-Founder (who is also TTAM’s CEO, President and one of its three board members) with the goal of purchasing Debtor’s assets out of bankruptcy.

The transfer to TTAM is to occur in two phases:

1. Debtor will form a new and wholly-owned limited-liability company (“Newco”), which will purchase all Debtor’s assets (including all customer data) free and clear of liens, claims, and encumbrances; and
2. then, Debtor will sell its 100% equity interest in Newco to TTAM—also free and clear of liens, claims, and encumbrances.

The idea of the transfer is to keep Debtor’s assets operating in the same manner as before.  To that end:

• TTAM will make employment offers to all of Debtor’s employees;
• the same limited number of people that currently have access to Debtor’s customer data will continue the same access; and
• TTAM’s privacy policy will be the same as the Debtors’ policy in effect at the bankruptcy filing date—including the right of customers to delete information and to opt-out.

Privacy enhancements in the proposed sale include an independent consumer privacy advisory board and two years of identity-theft monitoring.

Privacy Ombudsman

A consumer privacy Ombudsman is appointed in this case, as authorized by § 332.  The Ombudsman proposes privacy safeguards for the proposed sale, including:

• Debtor should be required to obtain separate and express consent from each customer before transferring the customer’s data, even if the law does not require such consent; or
• the purchaser should not be allowed to use the purchased data without first obtaining customer’s affirmative consent; or
• requiring Debtor to provide customers with actual notice of the sale, including a statement about a customer’s right to delete their data—noting that this alternative is significantly less protective of consumers’ privacy interests than the other two alternatives.

Court’s Analysis

The Bankruptcy Court’s opinion contains a lengthy analysis of such legal issues as:

• preemption of state-law restrictions on transfer—generally;
• preemption of state-law restrictions on transfer—PII;
• Debtor’s privacy policies in effect on the bankruptcy filing date;
• § 363(b)(1) provisions on sale of PII [fn. 1];
• facts, circumstances, and conditions of the sale;
• states statutes governing genetic information;
• compliance with business judgment / good business reason standards; and
• etc.

Court’s Ruling

Here’s how the Bankruptcy Court rules:

• this case present challenging issues involving sensitive information;
• in the abstract, a company’s sale of genetic data is a scary proposition, and reasonable people might conclude that it should not be permitted in any circumstances—but in our society, legislators are empowered to make decisions of that sort, and they have not taken such a firm stance;
• this proposed sale will result in Owner/Co-Founder repurchasing the same business and keeping the same operations going—but to make that happen, Owner/Co-Founder:
  • will pay a very large sum of money—an amount sufficient to pay all Debtor’s creditors, including customers harmed by the data breach; and
  • will improve privacy practices while honoring customers’ rights to delete their accounts and data; and
• so, the motion to approve the proposed sale is granted.

Conclusion

Handling PII as an asset of a bankruptcy estate is difficult. 

And courts are wrestling with that difficulty. 

The In re 23andme opinion discussed above is a fascinating and recent example of such a wrestling match.

————————-

Footnote 1.  11 U.S.C. § 363(b)(1) says (emphasis added): “(b)(1) The trustee, after notice and a hearing, may use, sell, or lease, other than in the ordinary course of business, property of the estate, except that if the debtor in connection with offering a product or a service discloses to an individual a policy prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor and if such policy is in effect on the date of the commencement of the case, then the trustee may not sell or lease personally identifiable information to any person unless—(A) such sale or such lease is consistent with such policy; or (B) after appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale or such lease—(i) giving due consideration to the facts, circumstances, and conditions of such sale or such lease; and (ii) finding that no showing was made that such sale or such lease would violate applicable nonbankruptcy law.”

** If you find this article of value, please feel free to share. If you’d like to discuss, let me know.