Hearings to examine the privacy and national security implications of the 23andMe bankruptcy.

1[Senate Hearing 119-200]2[From the U.S. Government Publishing Office]34                                                        S. Hrg. 119-20056                        23 AND YOU: THE PRIVACY7                   AND NATIONAL SECURITY IMPLICATIONS8                       OF THE 23ANDME BANKRUPTCY910=======================================================================1112                                HEARING1314                              BEFORE THE1516                       COMMITTEE ON THE JUDICIARY17                          UNITED STATES SENATE1819                    ONE HUNDRED NINETEENTH CONGRESS2021                             FIRST SESSION2223                               __________2425                             JUNE 11, 20252627                               __________2829                          Serial No. J-119-223031                               __________3233         Printed for the use of the Committee on the Judiciary3435[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]3637                        www.judiciary.senate.gov38                            www.govinfo.gov3940                               __________4142                   U.S. GOVERNMENT PUBLISHING OFFICE4361-889                    WASHINGTON : 20254445-----------------------------------------------------------------------------------4647                       COMMITTEE ON THE JUDICIARY4849                  CHARLES E. GRASSLEY, Iowa, Chairman50LINDSEY O. GRAHAM, South Carolina    RICHARD J. DURBIN, Illinois,51JOHN CORNYN, Texas                       Ranking Member52MICHAEL S. LEE, Utah                 SHELDON WHITEHOUSE, Rhode Island53TED CRUZ, Texas                      AMY KLOBUCHAR, Minnesota54JOSH HAWLEY, Missouri                CHRISTOPHER A. COONS, Delaware55THOM TILLIS, North Carolina          RICHARD BLUMENTHAL, Connecticut56JOHN KENNEDY, Louisiana              MAZIE K. HIRONO, Hawaii57MARSHA BLACKBURN, Tennessee          CORY A. BOOKER, New Jersey58ERIC SCHMITT, Missouri               ALEX PADILLA, California59KATIE BOYD BRITT, Alabama            PETER WELCH, Vermont60ASHLEY MOODY, Florida                ADAM B. SCHIFF, California6162             Kolan Davis, Chief Counsel and Staff Director63         Joe Zogby, Democratic Chief Counsel and Staff Director6465                            C O N T E N T S6667                              ----------6869                           OPENING STATEMENTS7071                                                                   Page7273Grassley, Hon. Charles E.........................................     174Durbin, Hon. Richard J...........................................     37576                               WITNESSES7778Cohen, Glenn.....................................................     679    Prepared statement...........................................    3380Gotberg, Brook...................................................     881    Prepared statement...........................................    4382Klein, Adam......................................................     983    Prepared statement...........................................    5384Selsavage, Joseph................................................     585    Prepared statement...........................................    618687                                APPENDIX8889Items submitted for the record...................................    759091                        23 AND YOU: THE PRIVACY92                   AND NATIONAL SECURITY IMPLICATIONS93                       OF THE 23ANDME BANKRUPTCY9495                              ----------9697                        WEDNESDAY, JUNE 11, 20259899                              United States Senate,100                                Committee on the Judiciary,101                                                    Washington, DC.102    The Committee met, pursuant to notice, at 10:19 a.m., in103Room 226, Dirksen Senate Office Building, Hon. Charles E.104Grassley, Chairman of the Committee, presiding.105    Present: Senators Grassley [presiding], Cornyn, Hawley,106Blackburn, Britt, Moody, Durbin, Klobuchar, Coons, Padilla, and107Schiff.108109        OPENING STATEMENT OF HON. CHARLES E. GRASSLEY,110             A U.S. SENATOR FROM THE STATE OF IOWA111112    Chairman Grassley. Good morning, everybody.113    Genetic data is the blueprint to a person. It is sensitive,114it is personal, and in the wrong hands, it can be dangerous. As115technology and biotechnology rapidly expand, they bring new and116serious challenges. Consumers deserve to know how their data is117going to be used, and Americans deserve protection from foreign118threats. That is why we are here today.119    The 23andMe saga has unveiled serious and concerning issues120regarding consumer protection, data privacy, and national121security. We have explored these issues in these hearings, but122today's hearing focuses upon genetic data. 23andMe collected123genetic data from roughly 15 million people, and when it did,124it told the consumers that their data would be safe. They said125it would be protected under their privacy policy.126    But now, 23andMe is in bankruptcy, and it is selling off127its data, Americans' genetic data, your data, to the highest128bidders, bidders who consumers never consented to giving their129information to, bidders who could manipulate and repurpose the130genetic data, bidders who could be loyal to or controlled by131foreign adversaries. Without any Federal law governing genomic132data privacy, the only protection for the American consumer was13323andMe's own privacy policies.134    Even putting aside whether consumers read or understood the135privacy policy, they were required to sign it as-is, or they136couldn't use the service. And now that 23andMe is in137bankruptcy, whichever company buys them can change the privacy138policy on a whim, however they see it.139    That's why, just yesterday, 27 States sued to block the140sale of this data. Though the bankruptcy code requires a141consumer privacy ombudsman to be appointed when personally142identifiable data is being sold in violation of a privacy143policy, that simply is not enough. On the one hand, the144bankruptcy code doesn't include genetic data within the145definition of these three words, personally identifiable146information. So even if a company sold genetic data in147violation of their privacy policy, the code doesn't require an148ombudsman to be appointed to protect consumer privacy interest.149    On the other hand, even if an ombudsman is appointed, the150timeline for on which they operate and the efficacy of their151role must be further interrogated. Before Americans' genetic152information is sold, they should be able to decide whether,153when, and how that data is going to be used.154    In addition to consumer rights concerns, the national155security implications of 23andMe bankruptcy are significant. In1562019, the Department of Defense issued guidance that157servicemembers refrain from using direct-to-consumer DNA158testing kits. When a consumer genetics company accumulates the159personal genomic blueprint of millions, many of whom are U.S.160citizens, government employees, or military personnel, it161becomes a strategic intelligence asset. In the wrong hands,162this data access isn't just a privacy breach, it is a potential163weapon.164    Foreign governments can design targeted biological weapons165and wage pathogenic warfare. They can identify health166vulnerabilities and conduct tailored attacks on key military167and government personnel. In light of the serious evidence that168COVID-19 was created in a Chinese laboratory, the weaponization169of biologics and the military application of genomic data are170no longer far-fetched fantasies of science fiction. They are171tenable threats to the national security.172    The threat from China is particularly acute. The Chinese173have invested heavily in their military-civil fusion strategy174where they seek to erase the line between private property and175military assets. The Chinese Communist Party aggressively176integrates development of artificial intelligence, biotech, and177computing into their military efforts. They seize and acquire178corporate assets to engage in unconventional and asymmetric179warfare.180    Just this week, for example, two Chinese nationals were181charged with smuggling a dangerous pathogen used for182agricultural terrorism into the United States. The Chinese183Government paid for one of the nationals to research this184pathogen, and a search of their electronics revealed185information linking them to the Chinese Communist Party.186    Data is a weapon, and genetic data is particularly a potent187weapon. Americans' genetic data must be zealously defended and188jealously protected. The 23andMe bankruptcy is a massive threat189to the protection of the genetic data of so many Americans.190    Congress has yet to enact sufficient protection on these191important issues. There is no data privacy law that protects192genomic data, no provision in the bankruptcy code that prevents193this data from being compromised through bankruptcy auction,194and no sufficient remedy for consumers.195    I recently co-sponsored Senator Cornyn's Don't Sell My DNA196Act, which aims at filling some of these gaps, but there is a197lot more work to do. I look forward to hearing from our198witnesses about how we can advance legislation that better199protects Americans' genetic security.200    With that, I will open things up to Senator Durbin to give201an opening statement. Then, we will hear from our witnesses.202203         OPENING STATEMENT OF HON. RICHARD J. DURBIN,204           A U.S. SENATOR FROM THE STATE OF ILLINOIS205206    Senator Durbin. Thanks, Senator Grassley, good and timely207hearing as far as I am concerned.208    23andMe has a data base containing the genetic information209of about 15 million people. If your genetic information is in210their data base, a researcher can tell you who your relatives211are, what your ethnicity is, what your eye color is, and212whether you think cilantro tastes like soap. They can also213determine a lot of information about your health. Are you at214risk of developing type 2 diabetes? How about celiac disease,215chronic kidney disease, Parkinson's?216    In short, 23andMe has access to deeply personal information217about you and your health, information that you would normally218want to keep private, I guess, between you and your family and219your doctor. Yet no federal law, no federal law, prevents22023andMe from sharing this data with others, including insurance221companies, future employers, and law enforcement. Rather, a222patchwork of State laws, privacy policies are the only things223protecting the genetic information of millions of Americans.224    If 23andMe's customers are anything like fellow Americans,225they likely did not read this privacy policy. According to a226survey by Pew Research, more than half Americans say they227always--well, almost always--often agree with privacy policies228without ever reading them. Who can blame them? Whether you are229activating your cell phone, setting up your Facebook account,230accessing a number of services, Americans are bombarded with231countless privacy policies to which they must agree, and232virtually all of us do.233    One company who studied the issue found that Americans234would have to spend, get ready, 47 hours a month to read the235privacy policies of the most visited websites. That is more236than a full 9 to 5 workweek every single month. Get real.237    When 23andMe filed for bankruptcy on March 23, a lot of238people suddenly became interested in privacy policy because239buried in the fine print of their privacy policy is the240following. Listen closely. ``If we are involved in a241bankruptcy, merger, acquisition, reorganization, or sale of242assets, your personal information may be accessed, sold, or243transferred as part of the transaction.'' Remember that clause?244Probably not.245    So 23andMe's 15 million customers are left wondering, who246is going to get access to my genetic information? What are they247going to do with it? What rights do I have to stop it? That is248why we need this hearing.249    Thankfully, 23andMe's privacy policy gave its customers the250right to delete their data upon request, and millions have done251so, so many, in fact, that 23andMe's website crashed with the252traffic. Again, this wasn't required by Federal law. There are253very few federal guardrails to protect the most sensitive254personal data, including your DNA and who can share it.255    It is time for Congress to put some protections in place256for Americans. In the right hands, a genetic data base could257help researchers unlock lifesaving medical cures and make258incredible discoveries. But in the wrong hands, in the wrong259hands, it could enable dystopian discrimination, and260surveillance could be used by our adversaries. You were turned261down for that job? Why did they turn me down? Turns out they262knew a lot more about you than you knew about yourself.263    The American people deserve to have faith that their264sensitive information will be and stay in the right hands265before they agree to share it. Yet nearly 20 years after26623andMe came on the scene, and at least that long since the267surveillance industrial complex started taking over the268internet, America still lacks a comprehensive federal law to269protect our privacy. Like other areas, including kids' online270safety, to which this Committee has dedicated a lot of time,271there is bipartisan consensus that something needs to be done272about our privacy.273    There have been signs of hope, including in 2022 when the274American Data Privacy and Protection Act passed the House by a275broad bipartisan vote of 53 to 2. This is the Energy and276Commerce Committee. But the American people are still waiting.277I think we can get together and pass a bipartisan bill. This278hearing might help.279    Thanks, Mr. Chairman.280    Chairman Grassley. Thank you.281    This is a consensus hearing, so I am going to go ahead and282introduce all the witnesses that have joined us today. Then, I283will swear them in.284    Mr. Joseph Selsavage serves as interim CEO, CFO, CAO,28523andMe, joined 23andMe in November 2021 through the286acquisition of Lemonaid Health. At Lemonaid Health, he was287chief financial officer. Mr. Selsavage received a BA in288economics and financial management and his MA in accountancy289from Catholic University. He also received his MBA from290Massachusetts Institute of Technology. He is a certified public291accountant.292    Next, we have Mr. Glenn Cohen, professor of law at Harvard293Law School and the faculty director of Harvard Center of Health294Law Policy, Biotechnology, and Bioethics. Professor Cohen is an295elected member of the National Academy of Medicine and has296spoken to NATO, OECD, and members of the U.S. and Korean297Congress on medical and biotech issues and policies. He298previously served as a lawyer for the U.S. Department of299Justice, Civil Division, where he handled litigation in Court300of appeals and U.S. Supreme Court.301    Next, we have Ms. Brook Gotberg, professor of law, Brigham302Young University. Professor Gotberg teaches bankruptcy,303contracts, secured transactions, and other commercial law304subjects. Her scholarship focuses on debtor and creditor305relations and various impacts on the bankruptcy code and306business reorganization. Professor Gotberg earned her BA in307political science magna cum laude, Brigham Young University,308and her JD cum laude from Harvard Law School.309    Mr. Adam Klein is a senior lecturer at UT Austin School of310Law and director of the Strauss Center for International311Security and Law. Previously, Mr. Klein served as chairman and312CEO of the United States Privacy and Civil Liberties Oversight313Board, overseeing counterterrorism programs at the NSA, FBI,314CIA, and the Department of Homeland Security. Before entering315government, Mr. Klein was a senior fellow at the Center for the316New American Security and National Security Think Tank. Earlier317in his career, he served as a law clerk to Justice Scalia of318the Supreme Court.319    Would you please rise so I could administer the oath?320    [Witnesses are sworn in.]321    Chairman Grassley. Thank you. And I think we will go my322left to my right, so you start, Mr. Selsavage.323324STATEMENT OF JOSEPH SELSAVAGE, INTERIM CHIEF EXECUTIVE OFFICER325  AND CHIEF FINANCIAL AND ACCOUNTING OFFICER, 23ANDME HOLDING326              CO., SOUTH SAN FRANCISCO, CALIFORNIA327328    Mr. Selsavage. Chairman Grassley, Ranking Member Durbin,329and Members of the Committee, thank you for the opportunity to330appear before you today. My name is Joseph Selsavage, and I am331the interim chief executive officer of 23andMe, a mission-332driven organization founded on the simple yet transformative333belief that individuals have the right to access, understand,334and benefit from their own genetic information. From the very335beginning, 23andMe's purpose has been clear, to help people336live healthier lives through direct access to their own DNA, to337accelerate scientific discovery, and to contribute meaningfully338to the future of personalized medicine.339    We recognize that with this vision comes immense340responsibility to the millions of individuals who have chosen341to participate in something larger than themselves. We are here342today not only to answer your questions, but to reaffirm our343deep commitment to data privacy and security, transparency,344customer choice, data stewardship, and scientific integrity.345    Founded in 2006, 23andMe is a personal genomics and346biotechnology company that pioneered direct-to-consumer genetic347testing. We are named after the 23 pairs of chromosomes in348every human cell. Our mission has always been to empower349consumers by providing access to information about their350personal genetics based on the latest science so that they can351make their own informed decisions about their healthcare352journey.353    Our services allow customers to gain DNA insights about354their genetic risk for dozens of conditions like type 2355diabetes, Alzheimer's disease, and certain cancers. They can356also learn about their carrier status for inherited conditions357like cystic fibrosis or Tay-Sachs disease, or wellness factors358like lactose intolerance or deep sleep intolerance.359    23andMe customers have consistently reported taking360positive health actions after learning about their genetics361through 23andMe's services. Eighty-two percent of our customers362with an actionable genetic result were previously unaware of363their health risks.364    The value of personal genomics goes beyond the insights365people learn about themselves. Customers who register for our366services also have the option to allow their data to be shared367for research purposes, and over 80 percent of our customers368have chosen to consent to research.369    Consent is a central tenet of 23andMe's research program.370We have separate research consents beyond our consents to371processing sensitive data, a privacy statement and terms of372service that customers must review and agree to if they want to373participate in our research program. We remove all identifying374information before any genetic data is shared with third375parties. Any customer who affirmatively consents to participate376in our research program can easily opt out at any time through377their account settings and have always been able to do so.378Customers are also free to delete their account and data at any379time.380    Our customers who have affirmatively consented contribute381to more than 230 studies on topics that range from Parkinson's382disease to lupus to asthma and more. We collaborate with383advocacy organizations, universities, and biotech companies to384bring customers opportunities to participate in research. Since3852010, 23andMe has published 293 papers that help advance386scientific research in a wide range of fields.387    Due to circumstances that I discuss in more detail in my388written testimony, 23andMe is currently conducting a sales389process supervised by a United States bankruptcy court. That390process has been a success to date. We have two remaining391bidders, both American enterprises, that will conduct a final392round of bidding later this week before the sale of the winning393bidder is presented for approval by the bankruptcy court.394Because this proceeding is ongoing, I am unable to speak about395the merits of either bid or the ongoing sale process.396    Let me assure the Committee that 23andMe remains committed397to protecting customer data. We are requiring that anyone398bidding for 23andMe must agree to comply with our privacy399policies. We recognize the vital importance of protecting every400individual's right to access and control their own genetic401information. Empowering people with the knowledge about their402DNA is not only a matter of personal autonomy, it is a gateway403to proactive and personalized health, informed decisionmaking,404and greater engagement in consumer and scientific progress.405    At 23andMe, we believe that when consumers are trusted with406their own data, they become partners in advancing medicine and407not just patients of it.408    I appreciate the opportunity to testify before this409Committee today, and I welcome your questions.410    [The prepared statement of Mr. Selsavage appears as a411submission for the record.]412413STATEMENT OF I. GLENN COHEN, DEPUTY DEAN AND PROFESSOR, HARVARD414              LAW SCHOOL, CAMBRIDGE, MASSACHUSETTS415416    Professor Cohen. Chairman Grassley, Ranking Member Durbin,417other distinguished Members of the Committee, my name is Glenn418Cohen. I'm a deputy dean and professor at Harvard Law School. I419work on the legal and ethical issues in medicine and the420biosciences, including genetics. Thank you for the opportunity421to testify before you today.422    Genetic data requires special protection because it is423immutable, it inherently identifies us, it reveals information424about our blood relatives, and because many health conditions425have significant genetic components, so knowing about someone's426genes is knowing about their health. If one's genetic427information was accessed, it might reveal information on428prognosis for breast cancer, Alzheimer's disease, and many429other health conditions. It might let people identify you,430including reconstructing your face and vocal characteristics.431You might face discrimination in life, disability, and long-432term care insurance, and it might reveal misattributed433paternity.434    There are additional risks to our servicemembers. Indeed,435the Pentagon warned that our enemies might use the 23andMe data436for ``mass surveillance and the ability to track individuals437without their authorization or awareness.'' And that's just438today's risks. The development of polygenic risk scores may439further reveal our risk for various diseases, and some have440begun using 23andMe data to create scores to predict behavioral441traits like risk tolerance and even educational attainment.442    Since 2006, through its direct-to-consumer genetic tests,44323andMe has amassed a vast data base that includes the genetic444and personal information of more than 15 million consumers. For445many, it also holds physical specimens like saliva samples. The446main privacy protection for those customers is just a promise447the company has made in its privacy statement not to share448personal information voluntarily with insurance companies,449employers, or public data bases, or with law enforcement450agencies without a valid subpoena, search warrant, or court451order.452    But if you read more closely, the privacy statement453provides much less protection than it appears to. Few customers454read or understand privacy statements or terms of use. 23andMe455reserves the right to alter the terms customers have relied on,456and moreover, the company explicitly reserves the right to457transfer customer personal information in the event of the sale458of the company or a bankruptcy.459    The company has announced as part of the bankruptcy process460it will ``require anyone bidding for 23andMe to agree to comply461with our privacy policies and all applicable privacy laws.''462Well, that's all well and good, but even if that becomes a463condition of the sale, nothing prohibits Regeneron, TTAM, or464another buyer of the data from altering that privacy policy465just as there's nothing to stop 23andMe from doing so tomorrow.466It's also unclear to me what's going to happen to the saliva467samples, raising additional privacy concerns.468    Trust is all about a relationship. Customers who chose46923andMe entered into a particular kind of relationship with a470particular kind of company. They shared their genetic and other471personal information, recognizing there was some privacy risk472to obtain potential ancestry and health-related insights, and473for some of them to help enable research and the development of474potential new drugs or other therapeutics.475    Upon bankruptcy or sale of the assets, consumers may find476themselves in a relationship with a very different kind of477company with goals they may not support and policies that have478changed while they weren't looking. Privacy statements and479customer acquiescence have a role to play, but private ordering480solutions can only go so far to deal with these concerns.481    And Federal law is not currently up to the job. The Health482Insurance Portability and Accountability Act, HIPAA, our main483health privacy law on the Federal level, will not apply to48423andMe because it's not a covered entity. The Genetic485Information Nondiscrimination Act of 2008 protects individuals486from genetic discrimination for employment or health insurance,487but unlike its equivalent in many of our peer countries, it488doesn't cover life, disability, and long-term care insurance.489It excludes military personnel and excludes protection for490individuals on the basis of conditions that have already491manifested in the individual.492    In my written testimony, I've analyzed a series of possible493alternatives for you to consider, but I want to focus on two494here, two that I think are particularly promising. First, the495Don't Sell My DNA Act introduced by Members of this Committee,496Chairman Grassley, Senators Cornyn and Klobuchar, which would497introduce a strong model of affirmative consent upon498bankruptcy. We've heard a lot about consent from the company,499and the question is, why aren't they getting consent at this500moment for the transfer? Why not go back and ask people to501affirmatively consent to that transfer? And that is what your502act would help do. I would like to see it extended, in fact,503beyond the bankruptcy to other forms of sale or transfer of504genetic data and more explicitly cover the biospecimens.505    The second complementary model I want to highlight is from506Florida, which in 2020 became the first U.S. State to ban507insurers from discriminating on the basis of genetic508information in areas not covered by GINA, life, long-term care,509and disability insurance. I would like to see a similar effort510on the Federal level because when it comes to--I respect511federalism, but when it comes to genetic discrimination,512really, all Americans should have this protection.513    Chairman Grassley, Ranking Member Durbin, and Members of514the Committee, I'm appreciative of your focus on this important515issue, and I thank you for the opportunity to testify before516you today, and I look forward to answering your questions.517Thank you very much.518    [The prepared statement of Professor Cohen appears as a519submission for the record.]520    Chairman Grassley. I am going to open up the Senate.521Senator Cornyn, would you Chair while I am gone? I will be gone522about 15 or 20 minutes. Thank you.523    Go ahead, Professor Gotberg.524525         STATEMENT OF BROOK GOTBERG, PROFESSOR OF LAW,526                  BYU LAW SCHOOL, PROVO, UTAH527528    Professor Gotberg. Okay. Thank you for the opportunity to529present to you today.530    Chairman Grassley. Push the button.531    Professor Gotberg. Thank you. Thank you for the opportunity532to present to you today. I'm happy to provide some perspective533on the sale of personal consumer data in bankruptcy. And the534main message that I'd like to convey is that the concerns that535you've raised are not inherently bankruptcy issues. I'd also536like to advise against passing bankruptcy-specific prohibitions537on the sale of data, and I'll explain.538    Bankruptcy provides a vital public policy role in the539smooth running of our economy. Bankruptcy is not inevitable540when a company becomes insolvent, but its primary purpose is to541mitigate and manage the losses caused by a debtor's insolvency.542When a company becomes insolvent, the creditors of that company543are obligated to engage in a competition for those debtors'544limited assets. This competition looks like a race to recover545their legal rights. This is the metaphorical or actual race to546the courthouse.547    The race imposes costs on creditors who have to expend548resources, sometimes fruitlessly, because they have gotten549there too late after the money has run out. Also, a piecemeal550liquidation of the debtor's assets frequently devalues those551assets or destroys value so that creditors are ultimately paid552less. That's why we want parties to choose bankruptcy when the553debtor is insolvent.554    Bankruptcy isn't a haven for any party to avoid the555enforcement of outside laws. This is a primary issue in the55623andMe bankruptcy right now to determine if there are State557laws that would prohibit the sale of assets in that bankruptcy.558But we also don't want parties to avoid bankruptcy because of559specific laws that arise only in those instances.560    If a company cannot sell assets in bankruptcy, it will561simply do so outside of bankruptcy, without the benefit of562court oversight or the transparency provided by bankruptcy563proceedings and probably for a lower price. This won't actually564protect consumers from the sale of their data. It will just565deny them these protections that bankruptcy is intended to566give. The primary advantage of bankruptcy is its efficiency and567its ability to maximize the value of debtor's assets.568    Federal law shouldn't protect consumer data only in569bankruptcy proceedings. To the extent that Congress wants to570prohibit the sale of personal consumer data, it should do so571both inside and outside bankruptcy to prevent the strategic use572of bankruptcy for reasons that have nothing to do with the573efficiency of the proceedings.574    I'm happy to answer any questions about this or any575bankruptcy-related issues, but I would really encourage the576Committee to consider holistic and universally applicable577prohibitions to the extent they exist. Thanks.578    [The prepared statement of Professor Gotberg appears as a579submission for the record.]580    Senator Cornyn [presiding]. Mr. Klein.581582 STATEMENT OF ADAM KLEIN, DIRECTOR AND SENIOR LECTURER, ROBERT583   S. STRAUSS CENTER FOR INTERNATIONAL SECURITY AND LAW, (UT584                     AUSTIN), AUSTIN, TEXAS585586    Mr. Klein. Mr. Chairman, Mr. Ranking Member, and Members of587the Committee, thank you for inviting me to testify today.588    Before joining the University of Texas, I served as589chairman of the United States Privacy and Civil Liberties590Oversight Board, an agency that Members of this Committee591oversee and know well. Many of our oversight projects revolved592around the insights that intelligence agencies can gain from593personal data. That is because data is not just another594commodity. When our adversaries buy or steal sensitive American595data, they use it to harm the United States. China, in596particular, has used American data to strengthen its military,597conduct hostile intelligence operations, and help its companies598displace American competitors.599    Genomic data, like the DNA profiles held by 23andMe,600presents several distinct national security risks. First, China601could use DNA profiles to identify and track people of602interest, such as American intelligence officers and critics of603the CCP, the Chinese Communist Party, who live in the United604States. China has already built a genetic data base to track605and identify members of its Uyghur minority. With our genomic606data, it could do the same for Americans.607    Second, access to American genomic data could help Chinese608biotech companies gain an unfair advantage over American609companies. It could also help China train specialized AI models610for biomedical research. Now, China has domestic AI datasets,611but its population is far less genetically diverse than ours,612so American genomic data would hold great value for them.613    Third, China could use American genomic data for bioweapons614research. Now, that risk is speculative, but it can't be615dismissed. My written testimony lists several clues that China616might be open to this kind of research. For example, a Chinese617military textbook speculated about bioweapons designed for618specific ethnic genetic attacks. Access to American DNA619profiles with their greater genetic diversity could facilitate620research into ethnically targeted bioweapons.621    There is a disturbingly high chance, as Members of this622Committee know, that we will find ourselves in an armed623confrontation with the People's Republic of China before the624decade is out, most likely over Taiwan. If so, we should expect625China to target our homeland with unconventional, asymmetric626tactics, which could include biologic attacks.627    Next year, this Committee will once again consider Section628702 of the Foreign Intelligence Surveillance Act. As you do so,629I respectfully encourage you to keep in mind that law's vital630role in detecting adversarial plots against our homeland and631stopping cyber intrusions into sensitive systems, potentially632including systems like 23andMe's that store Americans' data.633    I'd like to conclude on a positive note. In recent years,634Congress, including this Committee and Members of this635Committee and the executive branch, have done a great deal to636protect Americans' data from hostile foreign powers. And as637this hearing illustrates, leaders are now vigilant about the638security risks of letting adversaries buy our data. For those639reasons, I'm confident that the executive branch would block640and could block an adversary-controlled entity from buying64123andMe. But the attention of this Committee and others in642Congress is vital to help ensure an outcome to this bankruptcy643that protects the privacy and security of Americans.644    Thank you, and I look forward to your questions.645    [The prepared statement of Mr. Klein appears as a646submission for the record.]647    Senator Cornyn. Thank you all very much. We will start with648the 5-minute rounds of questions, and I will begin.649    So back in 1990, Congress authorized something called the650Human Genome Project, which was designed to map the human651genome, which gave rise to an incredible amount of information652about the human genome, which is what makes us who we are. And653it has had enormous positive benefits in terms of law654enforcement, for example, being able to use DNA as an essential655part of regular criminal investigations to identify an656assailant. For example, in a forensic analysis of a rape kit,657it can identify with virtual certainty the perpetrator of the658crime.659    But at the time, it was also recognized that there could be660tremendous abuse of that information. And indeed, we have661touched on some of those, for example, discriminating against662people based on their genetic profile for insurance purposes.663For example, if you apply for life insurance or something of664that nature and someone had access to your genetic profile,665they could basically deny you because of perhaps some666indication, some evidence of a genetic defect that would lead667you to contract a disease or the like. And then, of course,668employment, where there could be discrimination by employers669against people based on their genetic profile.670    So all of this is something we have anticipated to some671extent, but I don't think we have been able to predict the672extent to which this genetic profile, this genome data can be673subject to not only beneficial use, but also use by our674adversaries and for improper purposes.675    Mr. Selsavage, did 23andMe do the actual testing of the676saliva samples that were submitted by the people who engaged677your company and your product?678    Mr. Selsavage. We contract with LabCorp, which is an679American-based testing company to do the testing of the DNA680samples for 23andMe.681    Senator Cornyn. For all of it?682    Mr. Selsavage. For all of our testing, yes.683    Senator Cornyn. And to your knowledge, is LabCorp--are684there efforts to attack or to basically do cyber attacks on the685data base that LabCorp maintained of 23andMe genetic samples686and data?687    Mr. Selsavage. I am not aware of any particular cyber688attacks on LabCorp. However----689    Senator Cornyn. Well, you are not saying that LabCorp was690somehow immune from cyber intrusions or cyber attacks, right?691    Mr. Selsavage [continuing]. No, I'm not, Senator.692    Senator Cornyn. So can you tell us, as you sit here today,693whether any of the genetic material that LabCorp tested that694was collected by any of our adversaries or by criminal695organizations, can you tell us with certainty that all of it696was protected?697    Mr. Selsavage. To the best of my knowledge, you know, that698data has been protected by LabCorp, and there has not been any699breaches at LabCorp which has affected our data.700    Senator Cornyn. Professor Cohen, generally speaking, if701there is genetic information supplied along the same lines as70223andMe, what is to protect individuals from outsourcing of703some of that testing to, let's say, labs in China?704    Mr. Cohen. I don't think there's much, Senator.705    Senator Cornyn. And Professor Klein, you said this is a706national security vulnerability. Why is that? Why would China,707the Chinese Communist Party, want the genetic information on708Americans?709    Mr. Klein. Well, there are several potential uses, none of710which are good. One is to use genetic information as a means of711tracking and identifying people, something that every712intelligence service and law enforcement agency----713    Senator Cornyn. And that could include the active-duty714military?715    Mr. Klein. Active-duty military, intelligence officers716working for the United States, Chinese dissidents who are717living here and have come here to enjoy freedom and freedom of718speech but whom the CCP is tracking.719    But then looking forward into the age of AI, having large720datasets with genetically diverse populations represented in721them is very attractive for training specialized AI models. We722know we're in a fierce competition with them, and we need to723keep these advantages for American companies and for the U.S.724Government.725    Senator Cornyn. And would each of you agree with me that726the genetic information that is collected through one of these727saliva samples by a company like 23andMe doesn't just tell you728something about the person who provides that saliva sample. It729tells you something about their parents, about their children,730and about their grandchildren, and anybody who might be a731genetic relative of that individual.732    Professor Cohen. That's right, Senator. When we say 15733million, that is kind of an underestimate when you think about734all of these generations of people who are affected.735    Senator Cornyn. Senator Durbin.736    Senator Durbin. So it seems to me that 23andMe tried, Mr.737Selsavage, to come up with a policy to protect its consumers,738but there is little to guarantee that the next buyer or the one739after that won't abuse that policy, is there?740    Mr. Selsavage. Senator and Ranking Member, 23andMe has741required as part of the sale of the assets of the company that742any buyer of the company must comply and adopt the privacy743policy and consents that 23andMe have in place today.744    Senator Durbin. So I didn't think I would ever say this in745this room, but does the rule against perpetuities apply?746    [Laughter.]747    Mr. Selsavage. Congressman, can you clarify that for me?748    [Laughter.]749    Senator Durbin. I have tried to forget every aspect of that750course in law school, but what I am suggesting to you is two or751three buyers removed, your best intentions don't mean much, do752they?753    Mr. Selsavage. Senator and Ranking Member, you know, my754understanding is that, you know, 23andMe is doing everything we755can to ensure that the next buyer adopts the policies and756consents of 23andMe, and, you know, while I can't actually757testify to their future intentions, both are, you know,758American institutions with experience in genomics, and, you759know, are committed to protecting that data and continuing----760    Senator Durbin. Unless we have a Federal law relative to761this issue that applies to future transactions, your best762intentions don't mean much, as far as I am concerned. And don't763take it personally.764    So, Professor Cohen, there was a best-selling book a few765years ago called The Immortal Life of Henrietta Lacks,766fascinating book, story of an African-American woman who died767in 1951 of cervical cancer in Baltimore if I am not mistaken. A768sample of her tumor generated what is known as the HeLa cell769line. That cell line was mass-produced and sold to laboratories770all over the world. It has been used in scientific research,771including research into cancer, the human genome, and the772development of the polio vaccine. It is still being used today.773Famously, Henrietta Lacks never consented to the use of her774cells in this way, and despite the vast sums of money the cell775line has generated, her family has never seen a dime of776profits.777    Part of what is being sold by 23andMe is a collection of778biological samples submitted by consumers who wanted their DNA779examined. They may have consented to some use of their samples,780but I question how informed it actually was. And there is no781guarantee a new owner won't change how the samples are used.782Are you familiar with this story?783    Mr. Cohen. I am, Senator.784    Senator Durbin. Is there anything we can learn from it in785this application?786    Professor Cohen. I think to learn for the importance of787affirmative consent, and again, affirmative consent that can788explain as much as possible what you want to do with material.789And again, we still haven't heard an answer why at this stage790they're not going back to all of their customers and asking,791can you consent to the transfer of your data to this new buyer?792It's a very simple thing that the company could do. Why aren't793they doing it?794    Senator Durbin. Mr. Selsavage, why aren't you doing it?795    Mr. Selsavage. Senator, 23andMe believes we've obtained the796consent from our customers, and when the customer signed up to797our--to the service, they have agreed affirmatively to consent798to our privacy and terms of service, which specifically says799that we--in the event of a bankruptcy sale, that we can800actually transfer their data.801    Senator Durbin. I think what Professor Cohen is suggesting802is that there is more that could be done to protect your803consumers. Would you consider it?804    Mr. Selsavage. I can take that suggestion back to our team,805Senator.806    Senator Durbin. I hope you will.807    Professor Gotberg, I guess my conclusion from your808testimony was the bankruptcy code really didn't envision what809we are talking about here.810    Professor Gotberg. So the bankruptcy code treats--it811respects law that exists outside of bankruptcy just the same in812bankruptcy proceedings as outside, so any legal prohibitions813that apply outside bankruptcy also apply inside bankruptcy. So814in a way, the bankruptcy code did anticipate that. It just815doesn't introduce new substantive law when a company files for816bankruptcy. There's not new prohibitions that exist.817    Senator Durbin. But what you say is, in your testimony,818current bankruptcy law provides some oversight that can prevent819the worst privacy policy abuses in a bankruptcy sale, but it820does not prohibit the sale from taking place. Placing a821prohibition on bankruptcy sales would simply push them outside822bankruptcy proceedings where there are fewer protections. The823best policy would make any restrictions on the sale of personal824consumer data universally applicable. It is time for us to825legislate, isn't it?826    Professor Gotberg. I would say if you want to protect827consumers from having their personal consumer data bought and828sold, you need to do that.829    Senator Durbin. Amen. Thank you, Mr. Chairman.830    Senator Cornyn. Senator Durbin, we have seen history made831today because in your long and distinguished career in the U.S.832Senate, I know you have been waiting to use the phrase rule833against perpetuities in a question, so congratulations for834that.835    [Laughter.]836    Senator Cornyn. Senator Blackburn.837    Senator Blackburn. Thank you, Mr. Chairman.838    Mr. Selsavage, I want to ask you--let me say this. We all839know that China is hard at work trying to build a virtual you840of each and every one of us, and this is why we need to have a841Federally preemptive online privacy law, which we do not have.842And whether it is 23andMe and genetic information or whether it843is data security, this is something that we need. But you seem844a bit naive to think that you haven't had any breaches or any845attacks, cyber attacks. Our critical infrastructure in this846country is hit many times a day.847    So what I want you to do--and you can submit this in848writing--is to go into detail about how you anonymize and how849you mask consumers and their information. And you can submit850that during the QFR period. But I think it is important that851you lay this out so that individuals know what level of852protection that they are going to have. You all may sell, and853then there may be an immediate buyer. You sold to 23andMe. You854thought that would be a longer-term relationship. It is not.855And then there may be three or four subsequent buyers, so some856certainty and some awareness would be a good thing. And I want857that in writing. Thank you.858    Mr. Selsavage. Senator, thank you for that. And I will take859that back to our team as well.860    I do want to note that, you know, I'm clearly aware that,861you know, basically there are many cybersecurity threats. And862at 23andMe, security and our customers' privacy is top of mind.863And, you know, basically, we, you know, at 23andMe, do have864cybersecurity threats from our foreign adversaries and others.865And I will take your concerns back.866    Senator Blackburn. Thank you. I thank you for that867clarification because we deal with that issue repeatedly and868the severe threats that exist each and every day.869    Okay. Mr. Klein, I want to come to you. Talking about a870privacy standard, there are some States, including my State of871Tennessee, who have stepped forward. And Tennessee, in 2023,872enacted the Genetic Information Privacy Act. That requires873companies to protect consumers' private information and to874provide them with the ability to access their data, to delete875their data and their account, and to destroy their biological876sample. However, not all Americans enjoy this protection. So in877that regard, is the Tennessee law a model for moving forward?878    Mr. Klein. Well, I haven't studied that law closely,879Senator, but it certainly sounds appealing to me as a citizen,880as a consumer. And I've been following the saga of the general881Federal privacy law that everyone seems to want for many years882now. And the Committee understands better than I do the883challenges that have arisen in coming to an agreement on884something that everybody seems to want.885    I think what the bill that Senator Cornyn and the other886Members have introduced demonstrates is that even as--and the887Tennessee bill is that even as we wait for a general law, there888is possibility of making progress on sector-specific issues.889And in my testimony, I highlighted some of the very good things890that the Committee and other parts of the Congress has done on891this specific threat from hostile foreign actors. And I do892think, to Congress' credit, we've tightened that up893considerably in the past few years.894    Senator Blackburn. Mr. Selsavage, the Tennessee attorney895general issued a statement after you all filed for bankruptcy,896issued a statement notifying Tennesseans of their right to897request a deletion. So talk to me about how you were moving898forward with these deletion requests.899    Mr. Selsavage. At 23andMe, any one of our customers at any900time can delete their data. For our customers, it's a simple901process. All they need to do is log into their account at90223andMe, go to their settings, and request their account to be903deleted. That process is automatic. We do ask for their date of904birth just as an additional verification measure. And we've905complied with those deletion requests and over--you know,906through--you know, through the bankruptcy process and prior to907that.908    Senator Blackburn. And when they delete their account, they909are also deleting their biological sample. Is that correct?910    Mr. Selsavage. If a customer has consented to--for us to911biobank their saliva sample, we will also delete and destroy912that saliva sample----913    Senator Blackburn. Thank you.914    Mr. Selsavage [continuing]. Upon their request to delete915their data.916    Senator Blackburn. I yield back.917    Senator Cornyn. Senator Klobuchar.918    Senator Klobuchar. Thank you. I think I will start by919following up with Senator Blackburn's good questions. And by920the way, thank you, Mr. Klein, for mentioning the need for a921general privacy bill, which we badly need.922    So on this deletion issue, it is my understanding that 1.3923million consumers asked 23andMe to delete their genetic data.924Many faces technical issues. So how long is the backlog right925now? And what are you doing to make sure all the requests are926fulfilled?927    Mr. Selsavage. Senator, the good news is that today there928is no backlog, that we are current on all of the deletion929requests. What did occur, you know, is when we filed for930bankruptcy and, you know, many State attorneys general931requested--or suggested to consumers that they delete their932data at 23andMe. We did receive a significant amount of933deletion requests. We quickly added additional staff and, you934know, basically were able to reduce that backlog.935    Senator Klobuchar. Thank you. And will you commit to936ensuring that consumers will retain their right to have their937genetic data deleted after the bankruptcy sale is completed by938making deletion rights a condition of the sale?939    Mr. Selsavage. Both of the bidders and, you know, the940bankruptcy sale of 23andMe, both Regeneron and TTAM Research941Institute, have agreed to adopt the policies of 23andMe, the942privacy policies----943    Senator Klobuchar. So the answer is yes?944    Mr. Selsavage. So, you know, the answer is yes.945    Senator Klobuchar. Okay. During the bankruptcy process, how946is 23andMe ensured consumers could decide how information is947used and for what purposes since that is what your website has948promised consumers?949    Mr. Selsavage. Our consumers consent not only to a terms of950service, a privacy policy, there are also separate consents for951our customers to--if they so choose, to engage in research at95223andMe and yet a--and then a separate consent to allow us to953engage with research with third parties. And, you know, we make954sure that customers have the right to actually opt in. We don't955default those. Customers are actually clicking yes, they will956want to conduct--or enable their data to be used for research957purposes. Many customers understand these are important for958understanding disease and genetic conditions and lifesaving959medical treatments.960    Senator Klobuchar. Thank you. Professor Cohen, it is my961belief that the privacy policies aren't meeting the privacy962needs of consumers during bankruptcy. That is why I have worked963with Senator Cornyn. I appreciate his leadership, and Grassley,964to give consumers control over their genetic data with our965bill, Don't Sell My DNA Act. Why is it so important that we966require consent from the consumer before their genetic data is967sold to another company with which they have no prior968relationship?969    Professor Cohen. People are engaged in a trust970relationship. You know, if my father gave me access to his971medical records and says, son, I want you to look at this and972be careful with this, and I went ahead and said, let me give it973to somebody else without asking my dad, you'd look askance at974what I was doing. The same thing is happening here. They're975essentially transferring data and transferring a trust976relationship to a new entity, and people have the right to know977who they're dealing with and the right to consent to it.978    Senator Klobuchar. Do you believe that the right to control979one's personal genetic information should take precedence over980maximizing returns for creditors in a bankruptcy proceeding?981    Professor Cohen. Well, I think that it would be nice for982the creditors to get paid, Senator. In this instance, I think983this information is so sensitive and so important, it's really984important to protect people's information.985    Senator Klobuchar. Okay. Thank you. And Professor Gotberg,986do you believe that the current consumer privacy ombudsman987system in bankruptcy proceedings is sufficient to protect988consumers' most sensitive information?989    Professor Gotberg. So the consumer privacy ombudsman is990appointed to help the court in weighing the costs and the991benefits of any particular sale of assets. If you permit992consumer--privacy--personal consumer data to be sold outside of993bankruptcy, it's permissible inside of bankruptcy as well. And994so the consumer privacy ombudsman is just trying to weigh what995would be the negative effects of that sale.996    Without an understanding of the price of privacy, so to997speak, that's a very hard balancing act to perform. To my998knowledge, there's been no final litigation to determine what999the damages would be for an individual to have their privacy1000violated in that way, so it makes it really hard for the1001consumer privacy ombudsman to have an effective role there.1002    Senator Klobuchar. Okay. And sort of to end where I began1003with Mr. Klein's point, why is it so important that Congress1004enact a comprehensive privacy law? By the way, the same1005companies that were lobbying against one, because I am also on1006the Commerce Committee, say 10 years ago now want one because1007of the patchwork of laws that we now have in our States, which1008is very predictable, which I hope people will realize that we1009need some AI rules of the road in place and tech rules of the1010road in place. And it is just the worst, that people just think1011they can lobby against things, and then all of a sudden they1012are like, oh no. So tell me why we need a privacy law and how1013that would have helped here.1014    Professor Gotberg. So a greater predictability for1015companies when they're entering into agreements with consumers1016would be--is always beneficial. So if companies know what the1017legal limitations are, then they can take that into account and1018creditors can take that into account whether an asset will be1019available before lending to the debtor. So it's important to1020have that law in place inside and outside bankruptcy.1021    Chairman Grassley. Oh, I am sorry. I didn't mean to1022interrupt you. I thought you were done.1023    Senator Klobuchar. Well, good. No, I am not going over my1024time. Done.1025    Chairman Grassley. Senator Moody.1026    Senator Moody. Thank you, Mr. Chair. And thank you for1027conducting this hearing and for all of our witnesses that have1028taken time to be here. These are complex issues and certainly1029we appreciate your expertise on the matter.1030    I think any American sitting at home when they learned of1031this bankruptcy that had submitted information to 23andMe was1032probably, you know, terrified and had never thought about what1033would happen to their information. So it is not just1034policymakers that are worried about this. I think people all1035around the United States are now concerned of what happens to1036their very sensitive personal information.1037    And I think this is going to affect everything from data1038privacy to national security to potential biotech threats. And1039we cannot overState the threat to this Nation and to people1040individually. I think it is both going to be from a national1041security concern, but also private companies getting access to1042some of this data.1043    I appreciate the shoutout to Florida. Florida does lead in1044many of these policy areas. We are not afraid to diligently dig1045in and take action quickly to protect people and their rights,1046and thank you for acknowledging that. In fact, right now, as we1047sit here, it is not illegal for insurance companies, life,1048disability insurance to inquire about, get access to your1049genetic information in all 50 States except Florida, and so we1050appreciate that.1051    And I think it is going to be imperative that this body, as1052we are presented with the sale of companies that have access to1053this information--and it is not just 23andMe. There are going1054to be other companies that get access to genetic information to1055be used in business models, to develop strategies to maximize1056profits, whether that is from their everyday course of business1057or whether that is selling of assets. We are going to have to1058deal with how the exchange of genetic information of Americans1059is protected and whether it can even be treated as an asset.1060    And I want to start first, sir, we appreciate you being1061here, and I know you have the best of intentions, you have1062said, as it relates to the assets. And you consider the genetic1063information of Americans to be assets?1064    Mr. Selsavage. The genetic information belongs to the1065consumers and--you know, basically, and it is a very valuable1066asset to those consumers, yes.1067    Senator Moody. But to 23andMe, you considered that to be an1068asset?1069    Mr. Selsavage. It is an asset to 23andMe, yes. I mean----1070    Senator Moody. And in terms of valuing your business moving1071forward or valuing your particular parts of your assets in a1072bankruptcy, that is one core asset?1073    Mr. Selsavage. Senator, we did not value that asset, you1074know, per se as part of the bankruptcy. However, the bidders1075are looking at that and placing a value on it.1076    Senator Moody. A bidder wanting to buy your company is1077assessing whether or not they can buy that data as part of how1078much they are going to pay you?1079    Mr. Selsavage. Yes.1080    Senator Moody. And the more customers that delete their1081information, the less of that asset is available to transfer is1082what you are telling us today?1083    Mr. Selsavage. Senator, you know, for us at 23andMe, we've1084let the buyer----1085    Senator Moody. Yes or no. And you are deleting that data,1086and once you sell an asset off, will it be less of an asset to1087sell?1088    Mr. Selsavage. There will be less customers with genetic1089information in our data base as people delete them, yes.1090    Senator Moody. So the customers that don't get this notice1091across the United States, the warnings from the attorneys1092general that this is a problem, you need to delete your1093information, if they have moved and they don't get the notice1094and they don't delete it, they are part of the asset group that1095goes to the other country, right?1096    Mr. Selsavage. Senator----1097    Senator Moody. Or goes to the other--could be the other1098country, I am sorry, the other business.1099    Mr. Selsavage. Senator, we have provided notice to all of1100our customers of the bankruptcy proceedings. And this week, we1101will be providing notice of the sale of the company to either1102Regeneron or TTAM Research Institute. And at all times, our1103customers have complete control over their data. They have the1104right----1105    Senator Moody. Except for the ones that didn't get notice1106and don't know about the sale, right?1107    Mr. Selsavage. Senator, with all due respect, we are doing1108everything we can to make sure all of our customers get that1109notice of the bankruptcy and of the sale. We are--we've emailed1110them----1111    Senator Moody. I heard that you have the best intentions.1112So I am also hearing that we might need to modify Federal law1113to address these intentions because when you are talking about1114the sale, you list that you will not sell to any countries of1115concern on your website. But I guess all other foreign nations1116could presumably offer to buy, right, if they're not a country1117of concern in your mind?1118    Mr. Selsavage. Senator, you know----1119    Senator Moody. Yes or no? Your limiting the exclusion of1120those to countries of concern.1121    Mr. Selsavage. We are limiting the sale of assets to any1122foreign adversary to the United States, any companies in those1123countries.1124    Senator Moody. But another foreign adversary could buy this1125information--or excuse me, another foreign nation-state could1126buy this information and sell it to a foreign adversary.1127Nothing prevents that, right?1128    Mr. Selsavage. Senator, with all due respect, we have only1129two bidders left here, and both are American enterprises. Both1130Regeneron is a public pharmaceutical company here based in the1131U.S. and TTAM Research Institute also is an American1132foundation, you know, founded by the former CEO and co-founder1133of 23andMe----1134    Senator Moody. At the core of it, I understand you are1135saying right now there are only two bidders left, but under1136Federal law and under what your best intentions are permitting,1137it could have allowed for a foreign State to buy these assets,1138nothing would have prohibited that, and selling it to a foreign1139adversary, correct? Nothing in federal law would have prevented1140that.1141    Mr. Selsavage. Senator----1142    Senator Moody. Correct?1143    Mr. Selsavage [continuing]. I am not a lawyer, but I do1144believe there are regulations, and there would have been1145different oversight if any of the assets were sold to anyone1146outside of the United States. And----1147    Chairman Grassley.1148    [Off mic.]1149    Senator Moody. Thank you, Chairman Grassley.1150    Chairman Grassley.1151    [Off mic.]1152    Senator Coons. Thank you, Chairman Grassley, and thank you1153to each of the panelists for coming here today and testifying1154on this important issue. It is particularly valuable that you1155are here to shed light on two issues important to our Nation,1156to our families, and frankly, also to my home State of1157Delaware, namely, bankruptcy and data privacy.1158    As I am sure some of you know, Delaware is the most popular1159State in our Nation for corporate incorporation, which also1160makes it a prominent bankruptcy jurisdiction. Delaware also is1161one of a small handful of States that has enacted robust data1162privacy protection laws, making it a potential model for1163federal legislation on data privacy, particularly in the1164context of bankruptcy.1165    I do think it is critical that we strike the right balance1166between safeguarding data and personal information and1167maintaining a bankruptcy system that makes creditors whole and1168gives debtors a fresh start.1169    If I might, Professor Gotberg, is a prospective buyer in1170bankruptcy legally required to follow 23andMe's current privacy1171policy?1172    Professor Gotberg. So the privacy policy is a contract----1173    Senator Coons. Right.1174    Professor Gotberg [continuing]. So contracts are1175enforceable as between the two parties. In law school we like1176to teach that a contract is a promise to perform or to pay1177damages. So a company that undertakes a contract, if they don't1178perform, would open itself up to a lawsuit for damages. That's1179true for 23andMe, and it would be true for any subsequent1180buyer. Whatever the buyer agreed to do would just be a1181contract. It wouldn't be--there would be no enforcement1182mechanism to force them to comply. They could just choose to1183breach.1184    Senator Coons. Nothing other than damages enforces that1185contract. And is there anything in the bankruptcy code that1186specifically addresses the transfer and use of highly sensitive1187personal data?1188    Professor Gotberg. In that situation, that is where the1189consumer privacy ombudsman could be appointed.1190    Senator Coons. Could be.1191    Professor Gotberg. Right, but in that situation, their role1192is primarily to advise the bankruptcy judge to weigh the costs1193and benefits of any potential breach of a privacy policy. So1194again, without being able to put a number on what that--those1195damages are, what the cost is for a violation of privacy, it1196actually becomes a pretty difficult weighing exercise.1197    Senator Coons. Is there any relevant precedent?1198    Professor Gotberg. I don't know that it's ever been1199litigated. I haven't seen anything.1200    Senator Coons. Me neither. Professor Cohen, Delaware and a1201few other States have enacted strong data privacy laws designed1202to regulate entities that control sensitive data, give1203individual consumers the right to access, correct, or delete1204certain data. How can my colleagues and I do something similar1205at the federal level and specifically in the bankruptcy context1206to ensure sensitive data doesn't end up in the hands of the1207wrong people or the wrong country as a result of a bankruptcy1208proceeding? And what is your view on the Don't Sell My Data Act1209where I have joined Senators Grassley, Cornyn, and Klobuchar as1210a co-sponsor?1211    Professor Cohen. So I think the Don't Sell My Data Act is1212exactly the right idea here. I will say that I think that the--1213what's important is this idea of affirmative consent. That's1214what is central to the bill upon the transfer. And again, we1215still really haven't heard a good reason why we can't go back1216to all of these people and ask them, can you affirmatively1217consent to the transfer of your data to Regeneron or TTAM? So I1218would love to see Congress push that and push it beyond1219bankruptcy to other kinds of sales of information as well.1220    Senator Coons. Let me ask you a question about affirmative1221consent. Part of the market value of 23andMe is a service that1222is individually genetically identifying that gives you1223information about, honestly, one of the most private things1224there could be, which is whether or not you are susceptible to1225certain diseases, what is your genetic ancestry, that sort of1226thing. Would it not stand to reason that although logistically1227challenging, going back to every individual who has given their1228personally identifying genetic information to 23andMe and1229affirming their consent would actually, in the end, build their1230market value by reinforcing that this kind of a service is1231something where people can count on it to protect their data1232privacy, regardless of whether there are damages available?1233    Professor Cohen. I think if you build your company on a1234reputation of trust and a reputation of autonomy and empowering1235people, this is exactly the thing you want to sell to customers1236to say, we believe so much in what we say that we're even going1237to do this upon sale or bankruptcy.1238    Senator Coons. And I understand how it might be complex or1239expensive, but in the end, I think it ultimately serves the1240entire segment of personally identifying genetic consult1241because it builds trust.1242    Thank you, Mr. Chairman. Thanks for a chance to question.1243    Chairman Grassley. I will take my turn now. I am going to1244start with Mr. Selsavage.1245    In 23andMe's March 23 press release, the company indicated1246that data privacy would be ``an important consideration in any1247potential sale.'' But when there was a motion to appoint a1248consumer privacy ombudsman in the bankruptcy, 23andMe first1249opposed the appointment of an independent ombudsman to ensure1250that genetic data was protected in the sale. Why did the1251company oppose appointing a privacy ombudsman?1252    Mr. Selsavage. Yes, Mr. Chairman, 23andMe was the first to1253suggest that the bankruptcy court appoint a customer data1254representative, which would look at the privacy issues in this1255particular bankruptcy case. 23andMe, at the time, did not1256believe that a consumer privacy ombudsman was needed. And the1257reason--the differentiation there is a consumer privacy1258ombudsman is required in bankruptcy when, you know, there's a1259change in the privacy policy from one company to the next.1260    In this particular case, you know, we, as part of the1261bidding process for 23andMe, were requiring that any company1262that was considering acquiring 23andMe's assets, including its1263data base and our customers, would be required to retain the1264privacy policies and consent going forward.1265    Chairman Grassley. I think that answers that question. So1266is 23andMe's priority to sell consumer genetic information to1267the highest bidder or to ensure that the genetic data it has1268collected will be protected according to existing privacy1269policies?1270    Mr. Selsavage. Mr. Chairman, our customers' data and1271privacy is, you know, a top priority in this process, you know,1272at 23andMe and for the special committee overseeing this1273process. It is not just the highest bidder. We are--have1274required that, you know, basically any bidder, as I said, and1275the two remaining bidders have affirmatively said that they1276would actually continue those privacy policies and consent and1277put that in writing in their asset purchase agreements or1278contracts to buy the company.1279    Chairman Grassley. Also to you, the point of bankruptcy is1280to ``marshal assets in a way that maximizes their value for the1281benefit primarily of creditors and then once creditors are paid1282for owners.'' And in your written testimony, you agree with the1283aim of maximizing the value of the business for stakeholders,1284but placing as little restrictions on the customer data as1285possible makes the data more valuable to the buyer. Would you1286characterize genomic data as a bankruptcy asset?1287    Mr. Selsavage. Mr. Chairman, you know, I believe that the1288genomic data is an asset and, you know, we have--23andMe is1289treating it--and not only maximizing the value for our1290creditors and our shareholders, but also, you know, one of the1291most important pieces--parts of 23andMe is our customers and1292our customers' trust, and we are putting their privacy and1293their security as part of that process and it is top of mind1294for the company and special committee overseeing this process.1295    Chairman Grassley. Okay. Based upon your ``yes'' answer,1296isn't your duty to protect consumer data in tension with your1297duty to maximize the value of the estate asset?1298    Mr. Selsavage. I think we are looking at both of those1299duties combined, Mr. Chairman.1300    Chairman Grassley. So I think you are saying that consumer1301data doesn't have a higher value than the estate. So aren't you1302a little bit in conflict with some other things you said here?1303    Mr. Selsavage. You know, basically protecting our1304consumers' data and their privacy and their consents as part of1305this process is a large consideration and, as I mentioned, it1306is not just accepting the highest dollar amount for the assets.1307    Chairman Grassley. My last question will be, Mr. Klein, in13082019, the DOD advised members of the armed services not to use1309direct-to-consumer genetic testing devices. The guidance noted1310the risk of mass surveillance and the ability to attract1311individuals without authorization. How could foreign1312adversaries use either the personalized or the aggregated1313genetic information of U.S. servicemembers to harm U.S.1314interest in military operations?1315    Mr. Klein. Thank you, Senator. Well, we know that1316intelligence services and police agencies like the FBI use1317genetic data to identify people of interest, and foreign1318adversaries certainly have a great interest in members of our1319military, where they go, what they do. So that would certainly1320be a concern for me, and we can be assured that they are1321looking at that and trying to use our servicemembers' genetic1322data.1323    You also mentioned aggregate. Large datasets have great1324value today for training AI models. China is trying to build1325large datasets in every conceivable area, but they have some1326gaps. One of those gaps is that their population is not1327genetically diverse, and so they may have a large number of DNA1328profiles in their country, but they don't have the diversity1329that we have. And that genetic diversity is very helpful if you1330want to train a model that is predictive for things benign,1331like biomedical research, but also things malevolent, like1332bioweapons research. We don't want them to build out their data1333base of DNA profiles with the diverse and rich datasets that we1334have here in America.1335    Chairman Grassley. Senator Schiff.1336    Senator Schiff. Thank you, Mr. Chairman.1337    Professor Gotberg, California has already passed1338legislation that went into effect in 2022 requiring direct-to-1339consumer genetic testing companies like 23andMe to obtain1340Californians' express consent for the collection, use, or1341disclosure of their genetic data. Under this law, Californians1342are also able to delete their accounts and genetic data and to1343destroy the biological samples they provided to these1344companies.1345    In the context of 23andMe's bankruptcy, can Californians1346still exercise these deletion rights, or does the bankruptcy1347process somehow interfere with, override, or otherwise affect1348our State's privacy protections?1349    Ms. Gotberg. Thank you. Bankruptcy proceedings do not1350override any applicable law. So State law and Federal law are1351recognized in bankruptcy proceedings. Whatever rights your1352consumers have outside bankruptcy, they'll have inside1353bankruptcy in terms of their legal rights.1354    Senator Schiff. And if the data base, 23andMe's data base,1355is sold as a bankruptcy asset, what obligations would the1356acquiring company have under Federal or California law to1357maintain those same security standards?1358    Ms. Gotberg. So the same laws that would apply now to135923andMe would presumably apply to any buyer.1360    Senator Schiff. And so even if this is not a California1361company operating in some other State, they would still be1362bound post-bankruptcy to California's privacy standards?1363    Ms. Gotberg. To the extent that California privacy1364standards apply, yes, they would.1365    Senator Schiff. And is a commitment made by an acquiring1366company somehow enforceable, apart from California's law, vis-1367a-vis residents of other States, is a promise made by an1368acquiring company somehow legally enforceable, or is it only as1369good as the person's intention to comply with that commitment?1370    Ms. Gotberg. So contractual promises are enforceable up to1371the point that they can be enforced. That's not a great answer,1372but again, our statement is a contract is a promise to perform1373or to pay damages. It's possible for parties to breach that1374agreement, in which case the party that--on the other side of1375it would be entitled to damages for the harm that they've1376experienced. But without----1377    Senator Schiff. You know, let's say I am acquiring137823andMe's dataset. I commit to maintaining the deletion1379provisions, et cetera, complying with California law even if it1380is not required somehow. I acquire the dataset, I don't1381comply----1382    Professor Gotberg. Right.1383    Senator Schiff [continuing]. Has my offer to comply or my1384commitment pre-bankruptcy, has that somehow turned into a1385binding contract with the owners of the genetic data, the1386people who have the genetic data?1387    Professor Gotberg. So it would depend on who you were in1388privity with, I guess, in terms of the contract, to use, I1389guess, a fancy legal term. A contract is between two parties,1390and so you have to have an agreement between those two parties.1391And I guess the question in those situations, if you were1392promising to abide by the commitment, who would be on the other1393side of that promise? Who would be able to enforce it?1394    Senator Schiff. Right. Well, it would sound like the1395consumer would not be on the other side of that promise. It1396would be more one of the parties to the bankruptcy, which then1397we would be then relying on them to enforce that promise. Does1398that analysis make sense?1399    Professor Gotberg. That makes sense to me.1400    Senator Schiff. And what controls are in place, Mr.1401Selsavage--maybe I can ask you this question. What controls are1402in place to prevent any unauthorized access or misuse of1403information during the bankruptcy proceedings?1404    Mr. Selsavage. 23andMe is--you know, basically places data1405security and data privacy as top of mind. You know, we1406basically have continued to maintain a strong system of1407security, making sure all of our data is encrypted. You know,1408the genetic data is stored separately from any consumer1409identifying information identifying who that genetic data1410belongs to. We have enhanced our security processes, especially1411around bankruptcy, understanding that there is additional1412threats. And, you know, basically from--on the consumer side,1413you know, we have since enacted two-factor authentication to1414access--so basically, there is a second level of either an SMS1415text message or an email verification when somebody is trying1416to access their account and then placed additional restrictions1417if sensitive----1418    Senator Schiff. If I could just interrupt with one last1419question because my time is going to expire. How do we know1420that an acquiring company or entity or person would maintain1421the same security standards that you have over privacy and even1422those standards were subject to hack?1423    Mr. Selsavage. Senator, the good news here is there is two1424potential buyers at this point for 23andMe. The first is1425Regeneron, an American $55 billion market cap pharmaceutical1426company who actually has data security over genomic data today.1427And TTAM Research Institute would be--which would be1428maintaining the same security standards as 23andMe.1429    Senator Schiff. Thank you, Mr. Chairman.1430    Chairman Grassley. Senator Britt.1431    Senator Britt. Thank you, Mr. Chairman.1432    To followup on the Senator's question, so would you commit1433today to the same privacy standards that you have demanding1434those of the company that purchases 23andMe? Do not sell unless1435they keep the same privacy standards that you have?1436    Mr. Selsavage. Yes, that is a requirement, you know,1437basically of any--of the two buyers, and they have put that in1438their asset purchase agreement.1439    Senator Britt. Excellent. And tell me, what all do you test1440for?1441    Mr. Selsavage. You know, 23andMe tests for, you know,1442basically a significant level of, you know, genetic traits,1443ancestry, and health conditions. We actually, as part of our1444process, test over 600,000 variants through our testing1445process.1446    Senator Britt. Okay. So you are able to tell somebody maybe1447it is predictability of potential disease and other things?1448    Mr. Selsavage. And while we can't definitively say that1449that person will get the disease, we can highlight risk--and1450basically when people are at higher risk for certain diseases.1451    Senator Britt. And so do you test for sex?1452    Mr. Selsavage. You know, as part of our testing, we do1453identify if the DNA showed that the--if the individual is male1454or female.1455    Senator Britt. And male is XY chromosome?1456    Mr. Selsavage. That is correct.1457    Senator Britt. And female XX?1458    Mr. Selsavage. Correct.1459    Senator Britt. On your data base though, you go into saying1460that if people self-identify of another gender, that you will1461attempt to give them a prognosis of the gender that they1462identify with versus the gender that they test for?1463    Mr. Selsavage. Senator, I'm not aware of that----1464    Senator Britt. Oh, yes, you do. So it says, ``We understand1465that sex is not always binary and the words male and female may1466not accurately reflect an individual's identity. We also1467recognize that being categorized by birth sex may be an1468uncomfortable or triggering experience to some, and we do not1469mean to delegitimize anyone's gender identity or expression. We1470use your self-reported sex to customize your health and trait1471reports. For example, genetic risk and what they may mean1472differ between men and women.'' So men and women are different,1473right? I mean, you say that here. We just talked about the1474genetic testing.1475    But then you go on to say, ``If you tell us you are female,1476your reports will contain information that is relevant to1477genetic females XX. If you tell us you are male, your reports1478will contain information that is relevant to genetic males XY.1479Additionally, there are some sex-specific reports that are1480available on individual selected profile sex such as male hair1481loss or bald spot. That is because either we are not able to1482build out an acceptable model for both genders or because the1483trait is actually sex-specific.''1484    And so I guess I am wondering, did you test--like if it is1485a genetic female that identified to you as a male, would you1486test them for male pattern baldness?1487    Mr. Selsavage. Senator, you know, we--as you mentioned, we1488actually do--the customer does report to us, you know, what1489they believe their sex is, and we test against that, as well as1490what we found in the DNA as--testing as well.1491    Senator Britt. I think probably the DNA is what is best for1492predicting actual future disease or harm or what may come, good1493or bad, for the individual.1494    On that note, you have about 15 million customers. Is that1495right?1496    Mr. Selsavage. That's correct.1497    Senator Britt. Okay. Of that, how many are kids?1498    Mr. Selsavage. How many are kids?1499    Senator Britt. Yes.1500    Mr. Selsavage. Senator, I don't know that number.1501    Senator Britt. So you don't know. From what I read on your1502website, obviously, parents can agree to have their child's DNA1503tested. Is that correct?1504    Mr. Selsavage. That is correct.1505    Senator Britt. So you don't know? Of the 15 million people,1506you don't know how many of those profiles are under 18?1507    Mr. Selsavage. I don't have that information with me today,1508but I'd be happy to take that back for----1509    Senator Britt. Do you have a guess?1510    Mr. Selsavage. I don't have a reasonable guess, Senator.1511    Senator Britt. Sir, I think we have to be vigilant when it1512comes to children and their DNA. We have talked today about all1513of the potential risks that can occur from privacy to security1514risk, obviously, blackmail, amongst a number of things. Would1515you commit to me today that in the sell, you will sell no1516child's DNA under the age of 18, that you will delete that1517account?1518    Mr. Selsavage. Congressman--or Senator, I will take that1519back and will review that.1520    Senator Britt. I think you absolutely should. And on that1521note, when it comes to bankruptcy, Professor, tell me, you1522know, when you look at a privacy ombudsman in this space, when1523you are looking at minors, children, what type of protection is1524currently in place, and what do we need to be doing as1525Congress? And actually, I would like to open this up to1526everybody to ensure that children are protected in this space.1527    Professor Gotberg. My understanding is that there are1528specific laws protecting children's information. I'm not an1529expert on those laws, but whatever laws exist outside of1530bankruptcy are enforced inside of bankruptcy as well.1531    Senator Britt. Do you all have another--I would love your1532thoughts.1533    Professor Cohen. You know, for human subjects research, we1534have special rules for the children population, and that might1535be a place to look for some comparisons.1536    Senator Britt. Do you have anything, Mr. Klein?1537    Mr. Klein. Well, as a father, I can say that I think we all1538struggle with how much of our children's data or how much of1539our children's lives to digitize, and so there's also a degree1540of parental responsibility. And when it comes to health, these1541are very tough choices sometimes for all of us.1542    Senator Britt. Absolutely. Thank you, Mr. Chair.1543    Senator Hawley [presiding]. Senator Padilla.1544    Senator Padilla. Thank you.1545    Now, colleagues, the witnesses today have explained that1546our bankruptcy process is primarily designed to maximize1547creditor payouts and ensure that a business, where possible,1548can continue to operate. It is not designed for other goals,1549but it is often called upon to fulfill other goals. Here, the1550bankruptcy process is not just required to protect consumer1551privacy, but also to protect our national security interests.1552    Professor Klein, what protections are built into the1553bankruptcy process to prevent foreign adversaries from taking1554advantage of the process to access sensitive information? Other1555concerns are generally raised, but, you know, we are talking1556about a specific area of the law, bankruptcy law here, whether1557we are talking about personally identifiable information or1558national security sensitive information?1559    Mr. Klein. Thank you for the question, Senator. And this is1560one area where there actually have been encouraging changes. We1561are not defenseless. In the FIRRMA law back in 2018, the1562Congress did give the Committee on Foreign Investment in the1563U.S. the ability to reach into the bankruptcy process and block1564sales and transactions, something that it previously hadn't had1565within its jurisdiction. As you all know, that body in the1566executive branch is one of our main protections against key1567intellectual property, sensitive data, and so forth, slipping1568out the back door to foreign adversaries.1569    Senator Padilla. And how much of the sensitive information,1570if any, can potential buyers access before a sale becomes1571final? They are obviously doing due diligence in the process of1572making these decisions.1573    Mr. Klein. That is a great question, Senator. I would refer1574that to the bankruptcy experts on the panel.1575    Senator Padilla. Anybody?1576    Professor Gotberg. So can you repeat your question?1577    Senator Padilla. How much access to this very sensitive1578information, whether it is personal sensitive information or1579national security sensitive information can a potential buyer1580access before a sale becomes final? Or is this an area where--1581--1582    Professor Gotberg. So there----1583    Senator Padilla [continuing]. Legislative action is needed?1584    Professor Gotberg. Within a bankruptcy proceeding, there is1585an allowance for due diligence. I think the procedures for that1586will be determined by the bankruptcy court and may differ from1587case to case. To the extent that there is no protections1588outside bankruptcy law, I don't know that there's--you know,1589bankruptcy law does not produce additional protections that1590wouldn't otherwise exist.1591    Senator Padilla. So a potential area for needed1592congressional action is what I am hearing. Since we have an1593expert before us, at what point in a bankruptcy process can1594CFIUS get involved? And do you have any recommendations about1595whether they should be involved earlier in the process?1596    Professor Gotberg. So I'm afraid you will have to explain1597what CFIUS is to me.1598    Senator Padilla. All right, Then we have an expert here. It1599is okay. It is okay. We will do a followup with you because my1600time is limited. I want to get to another topic, which is1601national security and biotechnology. I recently served as a1602member of the National Security Commission on Emerging1603Biotechnology, and our findings in a recent report found that1604the United States has historically not treated biological data1605as a strategic asset like our agricultural base, our oil1606reserves, despite its importance in advancing biotechnology and1607AI.1608    Back to Professor Klein. What is your assessment of the1609CCP's effort to sweep up as much biological data that they can1610of Americans and of our allies and partners abroad to advance1611their own domestic biotechnology ambitions?1612    Mr. Klein. Well, I think we've seen, Senator--and thank you1613for the question--their ambitions are comprehensive. They want1614to dominate in critical sectors. They want to use information1615like this to enhance their military prowess, and potentially,1616and very worryingly, given the tension between our countries,1617to conduct asymmetric, unconventional attacks, potentially1618including biologic attacks.1619    I'm sure you all saw that just in the past 2 weeks, the1620Eastern District of Michigan U.S. Attorney's Office has1621indicted two separate sets of Chinese national defendants on1622smuggling biologic materials into the United States. We've also1623seen the report on the Reedley Biolab out of the House Select1624Committee where a person of Chinese nationality, citizenship,1625was in California running an unregistered biolab. We don't know1626exactly what was going on there.1627    Some of these reports are very disturbing. We don't have a1628complete picture, but we know that the system, as the 9/111629Commission put it, is blinking, if not red, at least dark1630orange, and we need to have the imagination--and I'm glad this1631Committee's doing it, to foresee how they might conduct1632unconventional attacks against our homeland in the event of an1633armed conflict.1634    Senator Padilla. Do you have any recommended actions for1635this Committee or Congress as a whole to take to better protect1636our biological data while striking the important balance of1637promoting scientific research that depends on these datasets?1638    Mr. Klein. Yes, thank you, Senator. And bankruptcy is one1639vector. We're all covering down on that today. Cyber security,1640cyber attacks is another major vector. We know that it is very1641hard for companies to defend against a nation-state level1642attack, but we can at least make it harder for them. We can at1643least force them to expend their very best, most exquisite1644exploits to try to get in and spread those techniques that they1645have as thin as possible.1646    But I will also flag one other vector, insider threat. This1647is something that those of us who have led organizations in the1648Government dealing with classified material worry about every1649day, but it's also true in the private sector. Companies do not1650have the same comprehensive security clearance standards or1651personnel vetting standards that government organizations are1652supposed to.1653    There are some private sector actors that are starting to1654help, for example, defense industrial-based companies do this,1655but if an insider who has authorized credentials inside a1656company wants to take out a bulk dataset, whether it's genomic1657data or weapons designs, what does that company have in place1658to prevent that exfiltration? That's another very problematic1659vector.1660    Senator Padilla. Okay. Thank you so much.1661    Thank you, Mr. Chair.1662    Senator Hawley. Mr. Selsavage, if I could just start with1663you. So how many customers do you have approximately?1664    Mr. Selsavage. Between 14 and 15 million customers.1665    Senator Hawley. Between 14 and 15 million. I think you told1666Senator Britt just a minute ago that a goodly number of those1667are minors. Is that correct?1668    Mr. Selsavage. What I said was I don't have the number of1669customers that are----1670    Senator Hawley. You have the genetic data of a good many1671minors. Is that correct?1672    Mr. Selsavage. We have genetic data for a particular number1673of minors, and I will be providing--happy to provide----1674    Senator Hawley. People under the age of 18. Is that1675correct?1676    Mr. Selsavage. That is how I am defining a minor.1677    Senator Hawley. So your customers--I just want to make sure1678I understand your business model. Your customers give you their1679genetic information for you to run various tests on. Is that1680right?1681    Mr. Selsavage. Yes, that is correct.1682    Senator Hawley. And I mean, that is pretty sensitive stuff,1683isn't it, somebody's genetic information? Is there anything1684more personal than that?1685    Mr. Selsavage. I would agree with you, Senator, that1686genetic data is sensitive information.1687    Senator Hawley. And so now you are just going to sell all1688of it, 15 million people, bunches of kids, maybe millions. It1689is just going to be sold in the open market?1690    Mr. Selsavage. Senator, you know, the good news, as I1691mentioned, is that the two bidders are buyers for the company.1692One is Regeneron, which is an American company.1693    Senator Hawley. That is the big pharma company?1694    Mr. Selsavage. Big--it is a----1695    Senator Hawley. It doesn't make me feel any better.1696    Mr. Selsavage. It is a large pharmaceutical company.1697    Senator Hawley. All right. So you are going to take 151698million Americans' genetic information, and you are going to1699sell it to somebody. And your message to us is today, trust us,1700it will be fine. Maybe it is a big pharma company. Maybe we1701will get lucky. Maybe they will treat it right. I thought your1702privacy code, your privacy commitment said that consumers had a1703right not to have their information shared with anybody else1704without their consent. I mean, I have got your privacy1705statement right here. It says that without their consent, you1706can't share their information. You are about to sell it.1707    Mr. Selsavage. Senator, that consent is, you know,1708essentially for, you know----1709    Senator Hawley. Not real?1710    Mr. Selsavage [continuing]. Not shared for research1711purposes, and we are not selling it for research purposes.1712    Senator Hawley. Ah, so when you tell the consumer, give us1713your personal information, and we will take money from you, and1714we won't give it to anybody without your consent, it is not1715real. It just means, you know, maybe kind of depends on the1716day.1717    Mr. Selsavage. Senator, you know, I will say that our1718customers' data is their own. They have the right at all times1719to access that information. They can edit it----1720    Senator Hawley. Well, sure they can, but you are about to1721sell it to who knows who. They can't control it. You said to1722Senator Moody that consumers have complete control of their1723data, complete. How can they have complete control if you are1724about to sell it without their consent?1725    Mr. Selsavage. Senator, they can delete that data anytime1726up until the sale and after.1727    Senator Hawley. Oh, Okay. Okay. They can delete the data.1728Have you fixed the ability of customers to go on your website1729and delete it? Because right after you announced your sale,1730your deletion page went down. I hold in my hand here an article1731from The Wall Street Journal. ``23andMe's site goes down as1732customers struggle to delete their data.'' Can they even get1733onto your site to delete their data?1734    Mr. Selsavage. They can, Senator, and----1735    Senator Hawley. You fixed this?1736    Mr. Selsavage. That was an issue that--yes, we fixed1737immediately after----1738    Senator Hawley. It is up and running now? Customers can go1739on?1740    Mr. Selsavage. Customers can go on, and they can delete1741their data----1742    Senator Hawley. What happens when they go onto your site to1743delete their data?1744    Mr. Selsavage. When a customer logs into their account at174523andMe, they go to their settings page, and they--there's a1746section there where just click ``delete my data.'' It confirms1747that they want to delete their data, and it's deleted1748automatically.1749    Senator Hawley. Is that true? Let's take a look. Let's take1750a look.1751    Mr. Selsavage. Okay.1752    Senator Hawley. When they go onto your page, they get an1753opportunity. It says ``permanently delete the data.'' So they1754click the button that says ``permanently delete the data,'' and1755then they get a notification that says ``Your account is no1756longer accessible.'' If they can't access their account1757anymore, how do they know their data has been deleted?1758    [Poster is displayed.]1759    Mr. Selsavage. Because we send them a notification that1760their information has been deleted.1761    Senator Hawley. You send it once. And how long does that1762take?1763    Mr. Selsavage. You know, our policies State that, you know,1764we will delete their data within 30 days, and in most cases,1765we--it is automatic and happens much more quickly.1766    Senator Hawley. And when you deleted it, it is deleted,1767deleted. It is gone forever?1768    Mr. Selsavage. All the genetic data is deleted forever,1769and--yes.1770    Senator Hawley. Really? Because that is not what your1771privacy statement says in the fine print. Let's read it. What1772your statement says is ``We retain personal information for as1773long as necessary to provide the services and fulfill the1774transactions you have requested to comply with our legal1775obligations, resolve disputes, enforce agreements,'' et cetera,1776et cetera. And then it goes on, ``23andMe and/or our contracted1777genotyping laboratory will retain your genetic information even1778if you choose to delete your account.''1779    Mr. Selsavage. Senator, you know, 23andMe, it does not1780retain any genetic information regarding the consumer once they1781delete their account. We do----1782    Senator Hawley. It says right here that you will retain1783genetic information, including date of birth and sex, even if1784you choose to delete your account. This is your privacy policy.1785I am just quoting from it.1786    Mr. Selsavage. I'm--Senator, you know, to the best of my1787knowledge, we do not maintain any genetic information.1788    Senator Hawley. It says, ``Even if you choose to delete1789your account, we will retain.'' ``We will retain your genetic1790information, date of birth and sex, even if you choose to1791delete your account.''1792    Mr. Selsavage. There is some information that we do1793retain----1794    Senator Hawley. Aha.1795    Mr. Selsavage [continuing]. But not related to the genetic1796information.1797    Senator Hawley. Right.1798    Mr. Selsavage. But that--you know, such as name, email1799address----1800    Senator Hawley. Oh.1801    Mr. Selsavage [continuing]. And other----1802    Senator Hawley. Ah. So even if--ah. Even if you delete the1803account, you retain their name, you retain their email address,1804you retain their date of birth, you retain their sex, and you1805retain their genetic information even if they choose to delete1806your account. So in other words--don't talk to your suit behind1807you, talk to me. He is not testifying, you are.1808    You do not allow consumers actually to delete permanently1809their data. And when you said a minute ago to Senator Moody, at1810all times consumers have complete control of their data, that1811is just not true, is it? By the terms of your own agreement,1812that just is not true.1813    Mr. Selsavage. Senator, with all due respect, all of the1814genetic data is deleted. We are only maintaining----1815    Senator Hawley. With all due respect, what you are telling1816me is in direct contravention to what your own policy states.1817``Even if you choose to delete your account.'' In fact, what1818you do is you allow your consumers to delete their account1819settings, but their data isn't deleted. You still have it. The1820laboratory still has it. You have their name, you have their1821date of birth, you have their sex, and now you are going to1822sell it.1823    Here is my point. It is a pattern. Your consumers actually1824aren't in control of anything. You are. You control their data.1825You control their genetic information. Now you are about to1826sell it. You promise them we won't ever sell it without your1827consent, but you are doing it. You promise them we will allow1828you to delete it, but you don't. In fact, you have lied to1829them, have you not?1830    Mr. Selsavage. Senator, we have not. We--I assure you that1831we are deleting all of our customers who have requested----1832    Senator Hawley. No, you are not. You are not because your1833policies say they are not, and you are not deleting it because1834if you were, your company wouldn't be worth $300 million.1835    No, don't read from what your guy behind you is shoveling1836talking points to you now. I don't want your talking points. I1837have read your policies. I have seen what they are, and I tell1838you what, it is amazing to me you are not getting your socks1839sued off by your customers. I hope they will. I hope they will1840rush to the courthouse, even as we are here today, to sue you1841into oblivion for lying to them and taking their most personal,1842identifiable information and selling it for a profit and lying1843to them and to the American public.1844    Quite frankly, Mr. Selsavage, what you are doing here has1845all kinds of implications, national security implications, all1846of it, but nothing is worse than taking the personal,1847identifiable information of American consumers and keeping it1848and lying to them about it while you make a huge profit off of1849it. It is unbelievable to me. It is absolutely unbelievable.1850    This concludes our hearing. I want to thank each of the1851witnesses for taking the time to share your experience, your1852expertise, and your perspectives.1853    Written questions can be submitted for the record until1854Wednesday, June 18, at 5 p.m. I will ask the witnesses to1855answer and return questions to the Committee within 2 weeks.1856    The hearing is adjourned.1857    [Whereupon, at 11:58 a.m., the hearing was adjourned.]1858    [Additional material submitted for the record follows.]1859    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]18601861                            A P P E N D I X18621863The following submissions are available at:18641865  https://www.govinfo.gov/content/pkg/CHRG-119shrg61889/pdf/CHRG-1866    119shrg1867    61889-add1.pdf18681869Submitted by Chairman Grassley:18701871 Professors, testimony............................................     218721873Submitted by Ranking Member Durbin:18741875 Center for AI and Digital Policy (CAIDP), letter.................    1018761877 Professors, testimony............................................     218781879                                 [all]