3 ms·

FWIW, 23andMe will actually delete your data if you send in a GDPR deletion request. I worked there, and half the company put in a 1-2 month effort into making

FWIW, 23andMe will actually delete your data if you send in a GDPR deletion request. I worked there, and half the company put in a 1-2 month effort into making sure deletions worked correctly, including residual data.

DennisP 8y ago
Will they do that if you're not European?
- dontbenebby 8y ago
  How do GDPR rights work for non citizens? (Ex: in America even non-citizens have constitutional rights while visiting. (This had to be decided at the SC level after some Italian immigrants were roughed up in the 20s and it was argued that's ok since they weren't citizens) Can I book a vacation to Amsterdam, then demand deletion while on EU soil?
  - pgeorgi 8y ago
    GDPR is in effect as soon as one party is within the boundaries of the EU. GDPR covers everybody while in the EU, but doesn't cover EU citizens while abroad and everybody all the time when dealing with a EU company.
  - stordoff 8y ago
    Article 3 of the GDPR defines territorial scope: > This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: > (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or > (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. As I understand it, because 23andMe also provides its service within the EU, the GDPR applies. If they solely offered their service in the US, it's more tricky. Just being in the EU does not _necessarily_ mean the GDPR applies. Consider the following two examples[1]: > A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR. BUT: > An app developer established in Canada with no establishment in the Union monitors the behaviour of data subject in the Union and is therefore subject to the GDPR, as per Article 3(2)b. The developer uses a processor established in the US for the app optimisation and maintenance purposes. > In relation to this processing, the Canadian controller has the duty to only use appropriate processors and to ensure that its obligations under the GDPR are reflected in the contract or legal act governing the relation with its processor in the US, pursuant to Article 28. [1] https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_3_2018_territorial_scope_en.pdf https://edpb.europa.eu/sites/edpb/files/consultation/edpb_gu...
- ocdtrekkie 8y ago
  Are there examples you can think of who will not? Generally speaking, I've found almost everyone after implementing data deletion for GDPR compliance allows its use globally. Mostly because the only thing they invite for refusing is more legislation compelling them to do it, and potentially making other demands as well.
- michaelbuckbee 8y ago
  Well soon we'll have the CCPA (California Consumer Privacy Act) and that will help.
- marcell 8y ago
  Yea, they have it available for all accounts. You can download your raw data and then request an account deletion.

DennisP 8y ago

Will they do that if you're not European?

dontbenebby 8y ago
How do GDPR rights work for non citizens? (Ex: in America even non-citizens have constitutional rights while visiting. (This had to be decided at the SC level after some Italian immigrants were roughed up in the 20s and it was argued that's ok since they weren't citizens) Can I book a vacation to Amsterdam, then demand deletion while on EU soil?
- pgeorgi 8y ago
  GDPR is in effect as soon as one party is within the boundaries of the EU. GDPR covers everybody while in the EU, but doesn't cover EU citizens while abroad and everybody all the time when dealing with a EU company.
- stordoff 8y ago
  Article 3 of the GDPR defines territorial scope: > This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: > (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or > (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. As I understand it, because 23andMe also provides its service within the EU, the GDPR applies. If they solely offered their service in the US, it's more tricky. Just being in the EU does not _necessarily_ mean the GDPR applies. Consider the following two examples[1]: > A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR. BUT: > An app developer established in Canada with no establishment in the Union monitors the behaviour of data subject in the Union and is therefore subject to the GDPR, as per Article 3(2)b. The developer uses a processor established in the US for the app optimisation and maintenance purposes. > In relation to this processing, the Canadian controller has the duty to only use appropriate processors and to ensure that its obligations under the GDPR are reflected in the contract or legal act governing the relation with its processor in the US, pursuant to Article 28. [1] https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_3_2018_territorial_scope_en.pdf https://edpb.europa.eu/sites/edpb/files/consultation/edpb_gu...
ocdtrekkie 8y ago
Are there examples you can think of who will not? Generally speaking, I've found almost everyone after implementing data deletion for GDPR compliance allows its use globally. Mostly because the only thing they invite for refusing is more legislation compelling them to do it, and potentially making other demands as well.
michaelbuckbee 8y ago
Well soon we'll have the CCPA (California Consumer Privacy Act) and that will help.
marcell 8y ago
Yea, they have it available for all accounts. You can download your raw data and then request an account deletion.