A company’s bankruptcy can turn its customer information into a transaction issue. When that information includes genetic data and biological samples, the consequences extend well beyond the purchase price.
California has reached a US$6 million settlement with Chrome Holding Co., formerly 23andMe, over alleged security failures associated with the company’s 2023 breach.
The agreement was announced October 19 and filed in the US Bankruptcy Court for the Eastern District of Missouri. Court approval remains pending. California Attorney General: proposed 23andMe settlement.
Two disputes resolved through one agreement
The settlement addresses both the breach allegations and California’s appeal concerning the bankruptcy sale of customers’ genetic information and samples without affirmative consent.
According to the Attorney General’s announcement, affected consumers retain rights to request deletion of their information and destruction of their samples. The announcement describes a negotiated resolution; the state’s allegations should not be reported as new judicial findings. California Attorney General: proposed 23andMe settlement.
Why the data-transfer issue matters
For privacy and insolvency counsel, the transaction question is more complex than identifying an asset a buyer wants.
The legal review may need to examine collection promises, statutory consent requirements, the intended recipient and the continuing rights attached to the information.
Genetic information also creates a practical distinction between deleting a digital record and destroying a physical sample. A transaction plan should identify who is responsible for each obligation and how requests will be handled after closing.
The case therefore offers a useful due-diligence framework for businesses holding sensitive information:
- Identify what data and samples are included in the transaction.
- Review the permissions and restrictions attached to their transfer.
- Determine which customer rights continue afterward.
- Assign responsibility for responding to outstanding and future requests.
Those are transaction-specific questions. The California agreement does not establish a universal rule governing every insolvency sale or determine Canadian requirements.
Its significance is the combination of issues: security failures, control over a transfer and consumer choices after ownership changes.
The payment resolves part of the dispute. The continuing obligations explain why the data cannot be treated like an ordinary asset.
Related coverage: Sheppard Mullin Data Breach Lawsuit Highlights Social-Engineering Risk.
Sources: California Attorney General: proposed 23andMe settlement .