4 ms·

I have a marked lack of faith in contractual language's ability to safeguard privacy in cutting edge technical matters, where there is any gray area. "We promi

by ethbro 9y ago

I have a marked lack of faith in contractual language's ability to safeguard privacy in cutting edge technical matters, where there is any gray area. "We promise to anonymizing your data, but we will sell it" is a huge gray area. Are there legal standards for anonymizing data? To what degree? What type of protections are required for the un-anonymized data 23&me holds on their servers? What about any mapping data that allows anonymous products to be deanonymized? What obligations is 23&me under in regards to any future data products they offer with remixed data? What happens if their data products are found to expose individuals via third party information unmasking or statistical attacks? Am I entitled to be made aware of products 23&me sells that include my anonymizing data? If not, and it's custom deals struck in a backroom, how am I able to ensure any anonymization meets my standards? Etc.

eridius 9y ago
It's not just anonymized, it's aggregated. I suppose the phrasing is slightly ambiguous, but my impression is that they don't sell "anonymized OR aggregated" data but "anonymized AND aggregated".
- ethbro 9y ago
  It flip flops between the two phrasings depending on what portion of the document you're reading. In general, I don't mean to say that 23&me has a bad privacy policy. They simply have one written by lawyers in the interest of the company's value and flexibility, while at the same time allay fears over information disclosure. Personally, I'd like a higher standard for somewhere that stores my genetic information. Especially if a company's interests are at odds with mine ('If you're not paying, you are the product,' etc). Phrasing like, "We may provide additional notice and ask for your consent if we wish to share your information with our commonly owned entities in a materially different way than discussed in this Privacy Statement" creeps the hell out of me. Especially if they end up getting re-absorbed into the Google family as a backdoor to collecting genetic information with less risk to Alphabet.

by ethbro 9y ago

eridius 9y ago

It's not just anonymized, it's aggregated. I suppose the phrasing is slightly ambiguous, but my impression is that they don't sell "anonymized OR aggregated" data but "anonymized AND aggregated".

ethbro 9y ago
It flip flops between the two phrasings depending on what portion of the document you're reading. In general, I don't mean to say that 23&me has a bad privacy policy. They simply have one written by lawyers in the interest of the company's value and flexibility, while at the same time allay fears over information disclosure. Personally, I'd like a higher standard for somewhere that stores my genetic information. Especially if a company's interests are at odds with mine ('If you're not paying, you are the product,' etc). Phrasing like, "We may provide additional notice and ask for your consent if we wish to share your information with our commonly owned entities in a materially different way than discussed in this Privacy Statement" creeps the hell out of me. Especially if they end up getting re-absorbed into the Google family as a backdoor to collecting genetic information with less risk to Alphabet.