The Next Wave: The million-dollar asset that no one can buy

For Nancy Wansato Maroa, a Kenyan consumer, the recent collapse of genetic testing company 23andMe should be a wake-up call. The company's database of 65 million customer profiles, once considered a goldmine, turned out to be a ticking time bomb. When the US-based company filed for bankruptcy, its customer data became the focal point of a heated debate. The question on everyone's mind was: can sensitive information like genetic and health records be sold alongside the rest of the business?

For over a decade, venture capitalists and founders have clung to the notion that high-growth startups with proprietary technology can recover part of their investments even in the face of insolvency. They believed that an administrator could sell the company's code, platform, or data to a strategic buyer and recover at least part of the investment. However, this assumption has been proven wrong time and time again. When a tech startup fails, its assets are worth only what a buyer can legally use. Delivery trucks depreciate, custom software can become a liability, and if a company's data practices, licenses, or regulatory compliance are flawed, even technology developed at significant cost may become unsellable.

The collapse of 23andMe exposed the limits of the assumption that user data is the foundation for future revenue. More than 25 US state attorneys general, together with the US Trustee Program, intervened in the company's bankruptcy proceedings, arguing that any transfer of sensitive information required close judicial scrutiny. The court appointed a Consumer Privacy Ombudsman to assess whether any proposed sale would honour the privacy commitments made to customers. This is not a unique case; in Kenya, the Office of the Data Protection Commissioner (ODPC) has progressively narrowed the circumstances in which organisations may rely on broad or implied consent when collecting and sharing personal data. Decisions such as Nancy Wansato Maroa v Vivo Energy and Artcaffe have established that organisations must clearly explain why personal data is being collected and identify any third parties with whom it may be shared. Consent that does not meet those standards may be deemed invalid.

For an insolvency practitioner, the rules governing data protection can turn a seemingly valuable customer database into an unusable asset. In Kenya, the Data Protection Act, 2019, has made it clear that organisations must prioritize the protection of personal data. The consequences of non-compliance are severe, and companies like 23andMe have learned the hard way that data privacy is the ultimate gatekeeper. As the global economy continues to shift, one thing is clear: companies that fail to prioritize data protection will find themselves at a significant disadvantage.

In the next wave of startup valuations, data protection will be the key differentiator. Companies that prioritize transparency and compliance will be the ones that thrive, while those that ignore the rules will be left behind. As a result, venture capitalists and founders will need to reassess their assumptions about the value of proprietary technology. The myth of the valuable database has been exposed, and it's time to face the reality of the consequences of non-compliance.