The company said: “Any buyer will be required to comply with applicable law with respect to the treatment of customer data.”
And let's hold them to that. There's no way a release of someone's DNA isn't a violation of the GDPR, the CCPA, or something similar. And I'd expect it'd also be protected under various health regulation related laws too.