4 ms·

I will be waiting until I can analyze my DNA myself, without handing it over to a company that is going to do whatever it wants to with it. We are not yet able

by ve55 8y ago

I will be waiting until I can analyze my DNA myself, without handing it over to a company that is going to do whatever it wants to with it. We are not yet able to fully appreciate how valuable DNA is, and yet everyone seems delighted to pay companies to take it from them. Perhaps they will be less delighted when they are convicted of a crime based off of a false positive, have their DNA shared with Facebook to Improve Their User Experience ™, or have their DNA made public after yet another security breach where it is left on an unsecured server. Remember that your DNA is very valuable, literally. Those who have noticed recent progress in genomics should realize how valuable it would be to a competent advertising company, allowing them to profile and predict users with significantly higher personal accuracy, even if all they are doing is performing basic GWASs (https://en.wikipedia.org/wiki/Genome-wide_association_study https://en.wikipedia.org/wiki/Genome-wide_association_study).

est31 8y ago
People can get your DNA without your consent already, as your DNA gets onto every object you touch. The most valuable part about sending stuff to a DNA company is your consent, especially considering that sequencing costs have a super-moore's law like cost reduction. Once they have your consent they can share it, sell it, rent it, to recruiters for ad targeting, insurances, etc etc. Without consent they'd get onto dubious legal territory, if e.g. Amazon took gene samples from refunds. But maybe it'll just become part of their TOS, you not being able to opt out unless you don't want to refund your stuff to Amazon. Not sure if the ability to sequence DNA yourself is really beneficial to privacy, after all that allows people to sequence the DNA of many people around them.
- ve55 8y ago
  It would be nice to have better special regulations specifically concerned with DNA usage and collection, just as we do for health information like HIPAA, just as we should for facial recognition as well.
  - lixtra 8y ago
    So DNA-data is not HIPAA yet?
    - hipaaCompliant 8y ago
      Protected HIPAA data is whether or not you have HIV. The color of your eyes and hair isn't protected, so, at least in part, DNA isn't 100% private information. But think deeply about this. Is your shit, and snot, and piss, and menstrual blood, and fingernail clippings extremely secretive effluence? Do you put it through a paper shredder like it's your credit card info? No one incinerates all of their bodily waste. If you shave your face in a hotel, guess what. Your DNA is in the maid's hands.
    - Real_S 8y ago
      HIPAA is miles away from protecting DNA. GDPR, however, does cover genetic data.
    - nkrumm 8y ago
      HIPAA does not explicitly call out genetic/genomic information as one of the oft-cited 18 elements of protected information [1]. However, genetic/genomic information is considered to fall under the 18th element, and HHS states that it must be treated as PHI [2,3]. In fact, HIPAA is very broad in its definition of PHI: "The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)." [4] Finally, it's worth pointing out that some states (e.g, WA) have enacted their own legislation that specifically calls out genetic testing and data as PHI [5]. In addition, there is the GINA act, which provides some protections as well [6] [1]: https://cphs.berkeley.edu/hipaa/hipaa18.html [2]: https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hipaa-protect-genetic-information/index.html [3]: https://www.law.cornell.edu/cfr/text/45/160.103 [4]: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html [5]: https://app.leg.wa.gov/billsummary?BillNumber=6284&Initiative=false&Year=1999 [6]: https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrimination_Act
- deleted 8y ago
  [deleted]
bitforger 8y ago
I wonder, though, if your parents get sequenced, is that not also valuable information about you?
- ve55 8y ago
  We've definitely established that it's valuable to some extent, unfortunately making it even more difficult to 'opt out'.
marcell 8y ago
FWIW, 23andMe will actually delete your data if you send in a GDPR deletion request. I worked there, and half the company put in a 1-2 month effort into making sure deletions worked correctly, including residual data.
- DennisP 8y ago
  Will they do that if you're not European?
  - dontbenebby 8y ago
    How do GDPR rights work for non citizens? (Ex: in America even non-citizens have constitutional rights while visiting. (This had to be decided at the SC level after some Italian immigrants were roughed up in the 20s and it was argued that's ok since they weren't citizens) Can I book a vacation to Amsterdam, then demand deletion while on EU soil?
    - pgeorgi 8y ago
      GDPR is in effect as soon as one party is within the boundaries of the EU. GDPR covers everybody while in the EU, but doesn't cover EU citizens while abroad and everybody all the time when dealing with a EU company.
    - stordoff 8y ago
      Article 3 of the GDPR defines territorial scope: > This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: > (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or > (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. As I understand it, because 23andMe also provides its service within the EU, the GDPR applies. If they solely offered their service in the US, it's more tricky. Just being in the EU does not _necessarily_ mean the GDPR applies. Consider the following two examples[1]: > A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR. BUT: > An app developer established in Canada with no establishment in the Union monitors the behaviour of data subject in the Union and is therefore subject to the GDPR, as per Article 3(2)b. The developer uses a processor established in the US for the app optimisation and maintenance purposes. > In relation to this processing, the Canadian controller has the duty to only use appropriate processors and to ensure that its obligations under the GDPR are reflected in the contract or legal act governing the relation with its processor in the US, pursuant to Article 28. [1] https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_3_2018_territorial_scope_en.pdf https://edpb.europa.eu/sites/edpb/files/consultation/edpb_gu...
cjbprime 8y ago
Counterargument: Consented mass datasets of DNA annotated with useful data (e.g. health records) are valuable. Your DNA by itself is pretty much worthless. There's a reason you pay 23andme to sequence it rather than them paying you.
- bobbylarrybobby 8y ago
  Why would they pay you? Plenty of people not give them their DNA, but pay them for the privilege
  - ct520 8y ago
    Why would a company pay people for their DNA, hmmm. http://www.wave3.com/2019/04/01/residents-concerned-about-dna-for-cash-transactions-louisville/ http://www.wave3.com/2019/04/01/residents-concerned-about-dn...
- astazangasta 8y ago
  Your DNA by itself IS informative to you; there are plenty of public SNP databases you can use for making useful comparisons. The basic "what ethnicity are you?" result that is the bread-and-butter of these companies can be ascertained by comparison with the 1000 Genomes database, which has detailed information on haplogroups. You can probably also get raw SNP calls from a genotyping service. Human SNP genotyping costs about $300 a sample at-cost and can maybe be had for less. Few of these resources are commercialized for the general public, but they are certainly accessible if you just want the raw data. In other words, the add-on from 23andMe is mostly convenience - they spare you the effort of having to locate these services and engage with them, and they spare you the effort of having to do your own informatic analysis.
  - cjbprime 8y ago
    I didn't say it wasn't useful to you. I said it wasn't valuable to others by itself. (At least to anywhere near the extent that people seem to imagine.)
mhb 8y ago
Perhaps they will be less delighted when they are convicted of a crime based off of a false positive Also a true positive.
scruple 8y ago
I learned recently that the state of California collects DNA and blood samples from every newborn, post-1983, and stores it long-term somewhere. It's made available to law enforcement and researchers through some process or other. You cannot opt-out but you can request that the samples be destroyed. They'll even send you a letter assuring you that it's been destroyed. How kind of them.
tbabb 8y ago
It basically doesn't matter if you share your DNA or not-- if your siblings or extended family share their DNA, then a malicious actor knows almost as much about you as they want to. This is how Osama bin Laden was found, as well as the golden state killer [1]. Maybe justified in those cases, but if it's abuse you're worried about, nothing but extremely stringent laws have a hope of protecting you. Probably not even that. [1] https://www.washingtonpost.com/news/true-crime/wp/2018/04/27/golden-state-killer-dna-website-gedmatch-was-used-to-identify-joseph-deangelo-as-suspect-police-say https://www.washingtonpost.com/news/true-crime/wp/2018/04/27...

by ve55 8y ago

est31 8y ago

People can get your DNA without your consent already, as your DNA gets onto every object you touch. The most valuable part about sending stuff to a DNA company is your consent, especially considering that sequencing costs have a super-moore's law like cost reduction. Once they have your consent they can share it, sell it, rent it, to recruiters for ad targeting, insurances, etc etc. Without consent they'd get onto dubious legal territory, if e.g. Amazon took gene samples from refunds. But maybe it'll just become part of their TOS, you not being able to opt out unless you don't want to refund your stuff to Amazon. Not sure if the ability to sequence DNA yourself is really beneficial to privacy, after all that allows people to sequence the DNA of many people around them.

ve55 8y ago
It would be nice to have better special regulations specifically concerned with DNA usage and collection, just as we do for health information like HIPAA, just as we should for facial recognition as well.
- lixtra 8y ago
  So DNA-data is not HIPAA yet?
  - hipaaCompliant 8y ago
    Protected HIPAA data is whether or not you have HIV. The color of your eyes and hair isn't protected, so, at least in part, DNA isn't 100% private information. But think deeply about this. Is your shit, and snot, and piss, and menstrual blood, and fingernail clippings extremely secretive effluence? Do you put it through a paper shredder like it's your credit card info? No one incinerates all of their bodily waste. If you shave your face in a hotel, guess what. Your DNA is in the maid's hands.
  - Real_S 8y ago
    HIPAA is miles away from protecting DNA. GDPR, however, does cover genetic data.
  - nkrumm 8y ago
    HIPAA does not explicitly call out genetic/genomic information as one of the oft-cited 18 elements of protected information [1]. However, genetic/genomic information is considered to fall under the 18th element, and HHS states that it must be treated as PHI [2,3]. In fact, HIPAA is very broad in its definition of PHI: "The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)." [4] Finally, it's worth pointing out that some states (e.g, WA) have enacted their own legislation that specifically calls out genetic testing and data as PHI [5]. In addition, there is the GINA act, which provides some protections as well [6] [1]: https://cphs.berkeley.edu/hipaa/hipaa18.html [2]: https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hipaa-protect-genetic-information/index.html [3]: https://www.law.cornell.edu/cfr/text/45/160.103 [4]: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html [5]: https://app.leg.wa.gov/billsummary?BillNumber=6284&Initiative=false&Year=1999 [6]: https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrimination_Act
deleted 8y ago
[deleted]

bitforger 8y ago

I wonder, though, if your parents get sequenced, is that not also valuable information about you?

ve55 8y ago
We've definitely established that it's valuable to some extent, unfortunately making it even more difficult to 'opt out'.

marcell 8y ago

FWIW, 23andMe will actually delete your data if you send in a GDPR deletion request. I worked there, and half the company put in a 1-2 month effort into making sure deletions worked correctly, including residual data.

DennisP 8y ago
Will they do that if you're not European?
- dontbenebby 8y ago
  How do GDPR rights work for non citizens? (Ex: in America even non-citizens have constitutional rights while visiting. (This had to be decided at the SC level after some Italian immigrants were roughed up in the 20s and it was argued that's ok since they weren't citizens) Can I book a vacation to Amsterdam, then demand deletion while on EU soil?
  - pgeorgi 8y ago
    GDPR is in effect as soon as one party is within the boundaries of the EU. GDPR covers everybody while in the EU, but doesn't cover EU citizens while abroad and everybody all the time when dealing with a EU company.
  - stordoff 8y ago
    Article 3 of the GDPR defines territorial scope: > This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: > (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or > (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. As I understand it, because 23andMe also provides its service within the EU, the GDPR applies. If they solely offered their service in the US, it's more tricky. Just being in the EU does not _necessarily_ mean the GDPR applies. Consider the following two examples[1]: > A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR. BUT: > An app developer established in Canada with no establishment in the Union monitors the behaviour of data subject in the Union and is therefore subject to the GDPR, as per Article 3(2)b. The developer uses a processor established in the US for the app optimisation and maintenance purposes. > In relation to this processing, the Canadian controller has the duty to only use appropriate processors and to ensure that its obligations under the GDPR are reflected in the contract or legal act governing the relation with its processor in the US, pursuant to Article 28. [1] https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_3_2018_territorial_scope_en.pdf https://edpb.europa.eu/sites/edpb/files/consultation/edpb_gu...

cjbprime 8y ago

Counterargument: Consented mass datasets of DNA annotated with useful data (e.g. health records) are valuable. Your DNA by itself is pretty much worthless. There's a reason you pay 23andme to sequence it rather than them paying you.

bobbylarrybobby 8y ago
Why would they pay you? Plenty of people not give them their DNA, but pay them for the privilege
- ct520 8y ago
  Why would a company pay people for their DNA, hmmm. http://www.wave3.com/2019/04/01/residents-concerned-about-dna-for-cash-transactions-louisville/ http://www.wave3.com/2019/04/01/residents-concerned-about-dn...
astazangasta 8y ago
Your DNA by itself IS informative to you; there are plenty of public SNP databases you can use for making useful comparisons. The basic "what ethnicity are you?" result that is the bread-and-butter of these companies can be ascertained by comparison with the 1000 Genomes database, which has detailed information on haplogroups. You can probably also get raw SNP calls from a genotyping service. Human SNP genotyping costs about $300 a sample at-cost and can maybe be had for less. Few of these resources are commercialized for the general public, but they are certainly accessible if you just want the raw data. In other words, the add-on from 23andMe is mostly convenience - they spare you the effort of having to locate these services and engage with them, and they spare you the effort of having to do your own informatic analysis.
- cjbprime 8y ago
  I didn't say it wasn't useful to you. I said it wasn't valuable to others by itself. (At least to anywhere near the extent that people seem to imagine.)

mhb 8y ago

Perhaps they will be less delighted when they are convicted of a crime based off of a false positive Also a true positive.

scruple 8y ago

I learned recently that the state of California collects DNA and blood samples from every newborn, post-1983, and stores it long-term somewhere. It's made available to law enforcement and researchers through some process or other. You cannot opt-out but you can request that the samples be destroyed. They'll even send you a letter assuring you that it's been destroyed. How kind of them.

tbabb 8y ago

It basically doesn't matter if you share your DNA or not-- if your siblings or extended family share their DNA, then a malicious actor knows almost as much about you as they want to. This is how Osama bin Laden was found, as well as the golden state killer [1]. Maybe justified in those cases, but if it's abuse you're worried about, nothing but extremely stringent laws have a hope of protecting you. Probably not even that. [1] https://www.washingtonpost.com/news/true-crime/wp/2018/04/27/golden-state-killer-dna-website-gedmatch-was-used-to-identify-joseph-deangelo-as-suspect-police-say https://www.washingtonpost.com/news/true-crime/wp/2018/04/27...