Anne Wojcicki’s winning bid to reclaim control of 23andMe (MEHCQ) doesn’t necessarily end the fight over what happens to the DNA of 15 million people collected by the bankrupt consumer genomics company.

A nonprofit controlled by Wojcicki, TTAM Research Institute, has outbid large-cap drugmaker Regeneron (REGN) amid mounting opposition to a proposed sale. Wojcicki was the co-founder and former CEO of 23andMe.

A hearing to discuss approval of the purchase is set for Wednesday. A bankruptcy judge's approval is required to go ahead with the transaction.

The winning bid came days after members of Congress questioned Wojcicki about the fate of the DNA data, and more than half of states across the country sued 23andMe's bankruptcy estate to stop the sale of its consumers' biological samples, health-related traits, and medical records.

On Tuesday regulators from the United Kingdom and Canada fined 23andMe $2.3 million for a data breach in 2023 that exposed DNA on thousands of customers, and health, race, gender and family information on 7 million people.

The regulators said they had been in contact with the US Trustee's office that is overseeing 23andMe's bankruptcy.

Brian Focht, a data privacy lawyer, said the sensitivity of the data is a good reason for the court and consumers to view TTAM's proposal with caution.

“This is information that’s immutable. It’s a permanent part of your identity,” Focht said. “You can't change the way that you can change almost everything, including your social security number, your name, and your bank account number.”

Although TTAM's ownership of the data may resolve some of the privacy concerns, a consumer watchdog report filed with the bankruptcy court last Wednesday said a sale of 23andMe to any buyer, including TTAM, creates unique challenges.

That’s because it involves the possible transfer of consumer data that is "significantly more sensitive" than consumer data involved in prior bankruptcy cases.

While Wojcicki has pledged to effectively run TTAM as the same type of business as 23andMe, Focht noted that she was in charge during that period in 2023 when 23andMe disclosed privacy and cybersecurity lapses.

"So it’s probably a bit foolishly optimistic to think that her re-takeover of the company will somehow make all the concerns disappear," he said.

The bankruptcy court's watchdog expressed the same concern in a report filed Wednesday with the court.

Because TTAM is a nonprofit, it said, it could possibly operate outside the scope of many data protection laws, potentially creating a "privacy and security enforcement and accountability vacuum."