The delicate issue of selling genetic data from more than 15 million 23andMe customers has been entrusted significantly to Neil Richards, a professor at Washington University School of Law. Following Regeneron Pharmaceuticals Inc.’s recent announcement to purchase a substantial portion of the bankrupt genetic testing firm’s assets, Richards holds a crucial role as the court-appointed privacy ombudsman. His mandate is to scrutinize and report on the company’s privacy policies before June 10, providing recommendations on how the sale of this sensitive data should proceed while ensuring measures are in place to protect consumer interests and evaluate Regeneron’s cybersecurity practices.
The unique selection of Richards, an academic with expertise in privacy and constitutional law, marks a departure from the usual cadre of experts typically seen in such roles during bankruptcy processes. Notably, the appointment of a privacy ombudsman is not unprecedented in bankruptcy cases involving personal data sales; it began 20 years ago to address issues arising from Toysmart.com’s privacy policy violations during its bankruptcy. However, this appointment signifies a heightened sense of vigilance given the distinctive sensitivity of genetic data, and Richards’ background may provide fresh insights in this context.
Richards’ role carries the potential for significant influence in a process where many similar roles have been criticized for being more of a reassuring gesture than an effective layer of protection. Critics like US Bankruptcy Judge Christopher G. Bradley have described the ombudsman function as a form of “privacy theater,” suggesting that while the role is intended to safeguard consumer data during bankruptcy sales, its real efficacy is limited by statutory constraints. The privacy ombudsman serves as an advisor, not a consumer advocate, which means that while they can recommend privacy safeguards, they cannot enforce changes unilaterally.
With concerns from both state attorneys general and the Federal Trade Commission (FTC) about the potential sale of sensitive genetic information, Richards’ report will be crucial in shaping the future of the data’s handling. Although the FTC has reinforced the necessity for 23andMe’s existing privacy protections to continue, the final decision on the sale’s terms lies with Judge Brian C. Walsh.
Regeneron appears ready to collaborate with Richards, emphasizing its commitment to high standards of data privacy and ethical oversight. Nevertheless, the impact of Richards’ recommendations will ultimately depend on whether they align with the court’s capacity to enforce meaningful privacy safeguards as this complex situation unfolds.