A recent paper published in the New England Journal of Medicine calls for regulations to protect customers’ personal and genetic data in light of biotech company 23andMe’s uncertain future.

The genetic genealogy firm, launched in 2007, became wildly popular, with millions of customers sending in saliva samples for analysis to learn about their ancestry and genetic makeup.

The company was valued at $6 billion, or $17.65 a share, shortly after going public in 2021. It has since fallen to about $48 million, or $1.78 per share, after a 2023 data breach and resignation of some board members. The firm said in January that it’s exploring “strategic alternatives,” including a sale of the company or assets, restructuring, or business combination, among other options.

In this edited conversation, I. Glenn Cohen, one of the paper’s authors and faculty director of the Petrie-Flom Center at Harvard Law School, explains the legal landscape surrounding genetic data, the reasons for more consumer protection laws, and the steps for consumers to protect their personal and genetic data.

If 23andMe were to file for bankruptcy protection, what might happen with the genetic data of 14 million people the company holds?

As 23andMe faces significant financial distress and might be purchased directly or go bankrupt and its assets sold, all of the genetic and health information provided by people is a valuable asset to the company. Many people have used services like 23andMe, Ancestry.com, and others which are direct-to-consumer genetic tests companies, to answer questions about their ancestry or their genetic code.

But in the course of answering these questions for themselves, they’ve also contributed to these huge genetic databases. Our concern is that they may end up in the hands of somebody other than 23andMe, in a way that many people who have given their information to 23andMe never contemplated and might object to.

What are the possible case scenarios, and what are your concerns?

One is about data security. We saw that 23andMe itself was subject to a massive data breach in 2023, and if the company that takes over the data lacks good data security, there’s a possibility of breach.

Interestingly, once upon a time, the Pentagon told military personnel not to use these at-home DNA kits because it was concerned about national security. A more quotidian concern is that your genetic information might become available to others, and it’s possible you could become reidentified.

To give you an example from a study several years ago, a number of researchers used genetic data to try to identify, through what’s called genome-wide association studies (GWAS) technology and approach, what parts of the genome were associated with being gay. Many people who had given their genetic information were understandably upset at the idea this could be a possible use of their information.

So, while customers have made the decision to share with 23andMe, from whom they get a lot of benefit, they really have very little say about what will happen should the company be taken over or should the company go bankrupt, and its assets sold.