Sure, you can sue the hollowed out shell of a bankrupt limited liability corporation that will soon have no assets for a court to sieze for whatever paltry damages a court finds.
> Ideally the court can compel the purchaser(s) to destroy the data.
I suppose a court order holds more weight than checking a box on a web site, but I'm not sure how much I'd trust the eventual purchaser.
Worse yet, if the seller drops their guard (due to lack of funding for proper security) will someone steal the data? At that point web requests and court orders are moot.
I guess I'm seeing a black hat behind every bush. I'm not sure if this kind of data has any value on the black market.
the current US presidential administration is in the process of completely hollowing out the US judicial system. nothing in the courts can be trusted if the SCOTUS can't be trusted.
but even with sane leadership there is nothing preventing stuff from being leaked or sold.
unless you can physically verify the shred-it guys destroying the disks, it's out there.
The correct timing, appears to be that 23andMe would have had an opt-out, blocking the selling or transfer of their data. That also should have included confirmation of data deletion, if requested. Since none of that existed, the options for users are quite limited. In fact, many would have participated in 23andMe Research, so their data was likely going to wherever long before.