3 ms·

FWIW 23&me reserves the right to sell anonymized aggregate data. Also, when you say "I have little faith they'll make a privacy-centric decision when faced wit

FWIW 23&me reserves the right to sell anonymized aggregate data. Also, when you say "I have little faith they'll make a privacy-centric decision when faced with a business choice", you make it sound like you think they'll intentionally violate their privacy policy in order to make money, but, and IANAL so maybe I'm wrong, I thought privacy policies like this were in fact legally binding, and if they decide to start selling PII info we can sue them?

Analemma_ 9y ago
> I thought privacy policies like this were in fact legally binding... This has never been tested in court and so the "bindingness" of privacy policies is ambiguous (see http://lawprofessors.typepad.com/contractsprof_blog/2010/08/is-a-websites-privacy-policy-a-binding-contract.html http://lawprofessors.typepad.com/contractsprof_blog/2010/08/...). Even in the best-case, if you wanted to have standing to sue for a privacy policy violation, you'd have to prove not just that it happened, but that you were materially harmed by it, which is a tough hurdle to clear. But that's all moot anyway, since privacy policies can be changed at any time. If a company wants to violate their existing policy, they just change it first.
- eridius 9y ago
  If they change their privacy policy, doesn't that only apply to data given to them after the change?
  - ethbro 9y ago
    "We've updated our terms of service. By continuing to use our site you agree to these updated terms. Y/n?"
ethbro 9y ago
I have a marked lack of faith in contractual language's ability to safeguard privacy in cutting edge technical matters, where there is any gray area. "We promise to anonymizing your data, but we will sell it" is a huge gray area. Are there legal standards for anonymizing data? To what degree? What type of protections are required for the un-anonymized data 23&me holds on their servers? What about any mapping data that allows anonymous products to be deanonymized? What obligations is 23&me under in regards to any future data products they offer with remixed data? What happens if their data products are found to expose individuals via third party information unmasking or statistical attacks? Am I entitled to be made aware of products 23&me sells that include my anonymizing data? If not, and it's custom deals struck in a backroom, how am I able to ensure any anonymization meets my standards? Etc.
- eridius 9y ago
  It's not just anonymized, it's aggregated. I suppose the phrasing is slightly ambiguous, but my impression is that they don't sell "anonymized OR aggregated" data but "anonymized AND aggregated".
  - ethbro 9y ago
    It flip flops between the two phrasings depending on what portion of the document you're reading. In general, I don't mean to say that 23&me has a bad privacy policy. They simply have one written by lawyers in the interest of the company's value and flexibility, while at the same time allay fears over information disclosure. Personally, I'd like a higher standard for somewhere that stores my genetic information. Especially if a company's interests are at odds with mine ('If you're not paying, you are the product,' etc). Phrasing like, "We may provide additional notice and ask for your consent if we wish to share your information with our commonly owned entities in a materially different way than discussed in this Privacy Statement" creeps the hell out of me. Especially if they end up getting re-absorbed into the Google family as a backdoor to collecting genetic information with less risk to Alphabet.

Analemma_ 9y ago

> I thought privacy policies like this were in fact legally binding... This has never been tested in court and so the "bindingness" of privacy policies is ambiguous (see http://lawprofessors.typepad.com/contractsprof_blog/2010/08/is-a-websites-privacy-policy-a-binding-contract.html http://lawprofessors.typepad.com/contractsprof_blog/2010/08/...). Even in the best-case, if you wanted to have standing to sue for a privacy policy violation, you'd have to prove not just that it happened, but that you were materially harmed by it, which is a tough hurdle to clear. But that's all moot anyway, since privacy policies can be changed at any time. If a company wants to violate their existing policy, they just change it first.

eridius 9y ago
If they change their privacy policy, doesn't that only apply to data given to them after the change?
- ethbro 9y ago
  "We've updated our terms of service. By continuing to use our site you agree to these updated terms. Y/n?"

ethbro 9y ago

I have a marked lack of faith in contractual language's ability to safeguard privacy in cutting edge technical matters, where there is any gray area. "We promise to anonymizing your data, but we will sell it" is a huge gray area. Are there legal standards for anonymizing data? To what degree? What type of protections are required for the un-anonymized data 23&me holds on their servers? What about any mapping data that allows anonymous products to be deanonymized? What obligations is 23&me under in regards to any future data products they offer with remixed data? What happens if their data products are found to expose individuals via third party information unmasking or statistical attacks? Am I entitled to be made aware of products 23&me sells that include my anonymizing data? If not, and it's custom deals struck in a backroom, how am I able to ensure any anonymization meets my standards? Etc.

eridius 9y ago
It's not just anonymized, it's aggregated. I suppose the phrasing is slightly ambiguous, but my impression is that they don't sell "anonymized OR aggregated" data but "anonymized AND aggregated".
- ethbro 9y ago
  It flip flops between the two phrasings depending on what portion of the document you're reading. In general, I don't mean to say that 23&me has a bad privacy policy. They simply have one written by lawyers in the interest of the company's value and flexibility, while at the same time allay fears over information disclosure. Personally, I'd like a higher standard for somewhere that stores my genetic information. Especially if a company's interests are at odds with mine ('If you're not paying, you are the product,' etc). Phrasing like, "We may provide additional notice and ask for your consent if we wish to share your information with our commonly owned entities in a materially different way than discussed in this Privacy Statement" creeps the hell out of me. Especially if they end up getting re-absorbed into the Google family as a backdoor to collecting genetic information with less risk to Alphabet.