News release
Privacy authorities for Canada and the United Kingdom advocate for data protections in 23andMe bankruptcy proceedings
May 1, 2025
The Office of the Privacy Commissioner of Canada and the UK Information Commissioner’s Office have issued a joint letter to the US trustee overseeing 23andMe’s bankruptcy proceedings to highlight privacy protection requirements under Canadian and UK privacy laws.
Privacy Commissioner of Canada Philippe Dufresne and UK Information Commissioner John Edwards launched a joint investigation in June 2024 into the global data breach at the direct-to-consumer genetic testing company.
23andMe recently filed for Chapter 11 bankruptcy in the United States to facilitate a sale process. The potential sale has sparked concerns from Canadian clients about how their personal information, including DNA samples, genetic information, address, payment details and other information may be shared and used in the future.
On April 28, 2025, the two privacy authorities sent a letter to the trustee overseeing the proceedings to ensure that the handling of any personal information relating to individuals in the UK and Canada is conducted in compliance with the respective data protection laws of the two countries.
At a Chapter 11 proceeding on April 29, a bankruptcy judge ordered the appointment of a consumer privacy ombudsman. The ombudsman’s role will include reviewing the handling of customers’ personal information, including genetic data, to inform the Court’s decisions during the bankruptcy proceedings.
The Office of the Privacy Commissioner of Canada and the UK Information Commissioner’s Office plan to engage with the ombudsman to provide information about requirements under their respective privacy laws.
The bankruptcy of 23andMe may result in the sale or transfer of sensitive personal information for millions of customers worldwide. The letter was issued to ensure that US authorities were made aware of, and reminded that the general obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law, would continue to apply to personal information currently in the care of 23andMe regardless of the company’s future ownership.
The joint investigation is an important example where regulatory collaboration can better serve to address issues of global significance.
Having the two offices leverage their combined resources and expertise supports maximizing their impact in protecting and promoting the fundamental right to privacy of individuals across jurisdictions.
The Offices have informed 23andMe of their provisional findings and intend to issue their final decision in the coming weeks.
Quotes
“23andMe holds the highly sensitive personal information, including DNA, of millions of customers. My Office is closely following the sale of 23andMe to ensure that any personal information relating to individuals located in Canada is handled in compliance with our federal private-sector privacy law. This is of the utmost importance given the significant concerns that Canadians may have about the protection of their personal information going forward, especially given that some of the data has previously been subject to a breach.”
Philippe Dufresne
Privacy Commissioner of Canada“23andMe holds some of the most personal and highly sensitive information possible about its customers, including genetic data, health reports and self-reported health conditions. We have this week written to the US Trustee to call for the protection of this sensitive data during and after the company’s bankruptcy. The UK public need to trust that the bankruptcy proceedings, and any potential sale of the company or its assets, will safeguard their personal data from unauthorised use or misuse. We are here to advocate on their behalf and we will not hesitate to take action against 23andMe or any potential purchaser should data protection legislation not be adhered to.”
John Edwards
UK Information Commissioner
Related links
- Joint letter on privacy protection during bankruptcy proceedings involving 23andMe Holding Co.
- News release – Privacy authorities for Canada and the United Kingdom launch joint investigation into 23andMe data breach (June 10, 2024)
Media contact
Office of the Privacy Commissioner of Canada
communications@priv.gc.ca
UK Information Commissioner’s Office
pressoffice@ico.org.uk
- Date modified: