The Information Commissioner’s Office has been forced to admit defeat over its action against US genetic testing company 23&Me after conceding – albeit in a note buried deep in its website – that the £2.31m fine issued over a 2023 security breach is “not recoverable”.
The move followed a joint investigation by the ICO and the Office of the Privacy Commissioner of Canada that revealed the firm had failed to protect the personal information of more than 150,000 UK residents after a large-scale cyber-attack in 2023.
Family trees, health reports, names and postcodes were among the sensitive data hacked from the California-based company. It only confirmed the breach months after the attack started and once an employee saw the stolen data advertised for sale on the social media platform Reddit.
The fine represented a significant reduction compared to the sum the ICO was previously considering when it issued its Notice of Intent. At the time, the proposed fine was £4.59m. Even so, given the company’s financial state, there were concerns over whether it would ever have to cough up.
The ICO insisted that UK GDPR’s extra-territorial scope meant that it could exercise its enforcement powers to pursue formal recovery actions that could lead to insolvency, but whether this covers US organisations is a moot point.
At the time, 23&Me had filed for Chapter 11 bankruptcy protection, and subsequently its assets were bought by the non-profit TTAM Research Institute founded by its former CEO, and now operates as a non-profit under TTAM’s ownership.
The latest twist in the saga has been uncovered by Mishcon de Reya senior data protection specialist Jon Baines, who wrote on LinkedIn: “I just noticed an interesting little snippet on the Information Commissioner’s Office’s website, while looking for something else. A tiny little note on a tiny little spreadsheet in a corner of the ICO website just marks [the 23&Me fine] as ‘not recoverable’.”
He added: “Whether it was the asset purchase that shed the liability, or whether the company simply refused to pay (with the ICO writing it off) is not clear, but this does show that it is one thing for a regulator to assert extra-territorial powers, and another thing for them to actually enforce those powers.”
Related stories
‘Tricky at best, pointless at worst’; ICO fines 23andMe
Collapsed 23andMe warned over UK customer data sale
UK and Canada join forces to probe 23andMe breach
ICO set to relax PECR rules to boost online advertising
Be the first to comment on "ICO waves white flag in battle to recover 23&Me fine"