3 ms·

23andMe says they don't sell your data. > We will not sell, lease, or rent your individual-level information (i.e., information about a single individual's gen

23andMe says they don't sell your data. > We will not sell, lease, or rent your individual-level information (i.e., information about a single individual's genotypes, diseases or other traits/characteristics) to any third-party or to a third-party for research purposes without your explicit consent. (https://www.23andme.com/about/privacy/ https://www.23andme.com/about/privacy/) I would really hope other sites like ancestry.com have the same policy.

Analemma_ 9y ago
The thing is, if 23andMe ever goes bankrupt and/or gets sold to another company, that privacy policy won't mean squat. This isn't a theoretical concern either: data aggregators like Experian are constantly vacuuming up the corpses of failed startups for their data. Considering that once your generic profile is compromised, it's forever (not just for you, but for all your relatives and descendants) and there's nothing you can do, do you want to risk that 23andMe will exist, with no management changes that might undo the policy, indefinitely?
- remline 9y ago
  Yes, I think RadioShack is probably the most famous example for sceptics. The US legal system really is that bad.
ethbro 9y ago
Although Analemma_'s concerns of post-company sales are also on my mind, my major concern is alignment of interests. Similar to Google, 23&me as a viable business operation is predicated on monetizing genetic information. They're performing testing at a loss in order to collect as much as possible. Consequently, whatever their policy may be, I have little faith they'll make a privacy-centric decision for me as an individual when faced with a business choice. Their valuation essentially depends on their not doing so!
- eridius 9y ago
  FWIW 23&me reserves the right to sell anonymized aggregate data. Also, when you say "I have little faith they'll make a privacy-centric decision when faced with a business choice", you make it sound like you think they'll intentionally violate their privacy policy in order to make money, but, and IANAL so maybe I'm wrong, I thought privacy policies like this were in fact legally binding, and if they decide to start selling PII info we can sue them?
  - Analemma_ 9y ago
    > I thought privacy policies like this were in fact legally binding... This has never been tested in court and so the "bindingness" of privacy policies is ambiguous (see http://lawprofessors.typepad.com/contractsprof_blog/2010/08/is-a-websites-privacy-policy-a-binding-contract.html http://lawprofessors.typepad.com/contractsprof_blog/2010/08/...). Even in the best-case, if you wanted to have standing to sue for a privacy policy violation, you'd have to prove not just that it happened, but that you were materially harmed by it, which is a tough hurdle to clear. But that's all moot anyway, since privacy policies can be changed at any time. If a company wants to violate their existing policy, they just change it first.
    - eridius 9y ago
      If they change their privacy policy, doesn't that only apply to data given to them after the change?
      - ethbro 9y ago
        "We've updated our terms of service. By continuing to use our site you agree to these updated terms. Y/n?"
  - ethbro 9y ago
    I have a marked lack of faith in contractual language's ability to safeguard privacy in cutting edge technical matters, where there is any gray area. "We promise to anonymizing your data, but we will sell it" is a huge gray area. Are there legal standards for anonymizing data? To what degree? What type of protections are required for the un-anonymized data 23&me holds on their servers? What about any mapping data that allows anonymous products to be deanonymized? What obligations is 23&me under in regards to any future data products they offer with remixed data? What happens if their data products are found to expose individuals via third party information unmasking or statistical attacks? Am I entitled to be made aware of products 23&me sells that include my anonymizing data? If not, and it's custom deals struck in a backroom, how am I able to ensure any anonymization meets my standards? Etc.

Analemma_ 9y ago

The thing is, if 23andMe ever goes bankrupt and/or gets sold to another company, that privacy policy won't mean squat. This isn't a theoretical concern either: data aggregators like Experian are constantly vacuuming up the corpses of failed startups for their data. Considering that once your generic profile is compromised, it's forever (not just for you, but for all your relatives and descendants) and there's nothing you can do, do you want to risk that 23andMe will exist, with no management changes that might undo the policy, indefinitely?

remline 9y ago
Yes, I think RadioShack is probably the most famous example for sceptics. The US legal system really is that bad.

ethbro 9y ago

Although Analemma_'s concerns of post-company sales are also on my mind, my major concern is alignment of interests. Similar to Google, 23&me as a viable business operation is predicated on monetizing genetic information. They're performing testing at a loss in order to collect as much as possible. Consequently, whatever their policy may be, I have little faith they'll make a privacy-centric decision for me as an individual when faced with a business choice. Their valuation essentially depends on their not doing so!

eridius 9y ago
FWIW 23&me reserves the right to sell anonymized aggregate data. Also, when you say "I have little faith they'll make a privacy-centric decision when faced with a business choice", you make it sound like you think they'll intentionally violate their privacy policy in order to make money, but, and IANAL so maybe I'm wrong, I thought privacy policies like this were in fact legally binding, and if they decide to start selling PII info we can sue them?
- Analemma_ 9y ago
  > I thought privacy policies like this were in fact legally binding... This has never been tested in court and so the "bindingness" of privacy policies is ambiguous (see http://lawprofessors.typepad.com/contractsprof_blog/2010/08/is-a-websites-privacy-policy-a-binding-contract.html http://lawprofessors.typepad.com/contractsprof_blog/2010/08/...). Even in the best-case, if you wanted to have standing to sue for a privacy policy violation, you'd have to prove not just that it happened, but that you were materially harmed by it, which is a tough hurdle to clear. But that's all moot anyway, since privacy policies can be changed at any time. If a company wants to violate their existing policy, they just change it first.
  - eridius 9y ago
    If they change their privacy policy, doesn't that only apply to data given to them after the change?
    - ethbro 9y ago
      "We've updated our terms of service. By continuing to use our site you agree to these updated terms. Y/n?"
- ethbro 9y ago
  I have a marked lack of faith in contractual language's ability to safeguard privacy in cutting edge technical matters, where there is any gray area. "We promise to anonymizing your data, but we will sell it" is a huge gray area. Are there legal standards for anonymizing data? To what degree? What type of protections are required for the un-anonymized data 23&me holds on their servers? What about any mapping data that allows anonymous products to be deanonymized? What obligations is 23&me under in regards to any future data products they offer with remixed data? What happens if their data products are found to expose individuals via third party information unmasking or statistical attacks? Am I entitled to be made aware of products 23&me sells that include my anonymizing data? If not, and it's custom deals struck in a backroom, how am I able to ensure any anonymization meets my standards? Etc.