8 ms·
Remember That DNA You Gave 23andMe?
- avalys 2y agoWhat is a specific plausible scenario of something that could be done with “my DNA” that I should be concerned about here?
- 0-_-0 2y agoI'd like to know that as well
- goosejuice 2y agoDNA replaced latent fingerprints to place individuals at the scene of a crime. We know fingerprints have led to wrongful conviction. Partial DNA profiles can lead prosecutors to individuals who were not involved. Legal changes that allow insurance companies to use genetic information to increase or deny coverage. Not just to you but your entire lineage.
- phkahler 2y agoInsurance companies denying coverage, or charging more. Being added to a database searched by police - this has its own hazards even for non criminals. There are certainly other possibilities, but once the cat is out of the bag you can't avoid them.
- bitnasty 2y agoTargeted ads
- thomassmith65 2y agoIn a decade or two, death could be a real concern. It's probably already possible, given sufficient resources, to tailor-make a virus that targets a specific person, family, or ethnic group. Presumably it will get easier to develop designer virii, as time marches on, not more difficult.
- layer8 2y agoSo, biological ransomeware? “Send $amount Bitcoins to $address and we’ll send you the antidote.”
- thomassmith65 2y ago"YOUR PERSONAL CELLS HAVE BEEN INFECTED WITH MUUSE-7A! THE ANTLERS WILL CONTINUE TO GROW UNTIL YOU SEND 3BTC TO THE FOLLOWING WALLET ADDRESS"
- zero-sharp 2y agoGattaca here we come. Can't wait until I start getting denied for service/opportunity X because some computer somewhere used DNA from a distant relative to determine I'm a risk.
- cebert 2y agoWe need more legislation and legal protections in this area.
- n3storm 2y agobut that will end up business drive! don't you dare or lot of stakeholders will have to take the bus!
- deleted 2y ago[deleted]
- KingOfCoders 2y ago[flagged]
- ryanschaefer 2y agoWhat laws are present in the EU that individuals in US could look to to write to our representatives about?
- dns_snek 2y agoGDPR would be the obvious one, particularly the bits about them not being allowed to refuse service if you don't agree to data processing that isn't strictly necessary to provide the service (e.g. sharing data with insurance companies)
- deleted 2y ago[deleted]
- jamescun 2y agoUK citizen and 23andMe customer here. How likely is the sale of UK/EU customer data, or is it worth submitting a GDPR deletion request anyway? Get my data deleted before it's sold.
- EDEdDNEdDYFaN 2y agogdpr might help you with data in a web database or data warehouse but if they have anything outside of that you're still screwed. I doubt a failing company has the time, energy, or resources to comprehensively clean up your data everywhere. Definitely submit the request but don't expect it to prevent your info from being resold
- KingOfCoders 2y agoGDPR covers all personal data, that would include any DNA. It also includes the prevention of creating profiles without your consent. But as 23andme is an US company, it is not under the jurisdiction of the GDPR. The legal situation isn't clear, the EU would claim some jurisdiction, but I (IANAL) think it's more like you go to the US, walk into a Walgreen and give up your data.
- leinelissen 2y agoNotably, the GDPR applies depending on customer jurisdiction rather than company jurisdiction. If they’re serving EU (or UK) customers, the GDPR definitely applies.
- Ylpertnodi 2y agoHappy to be told the uk falls under the actual gdpr....do they (i thought after brexit, the uk wasn't covered...and they have their own version)?
- rsynnott 2y agoFrom the ICO website: > The GDPR is retained in domestic law as the UK GDPR, but the UK has the independence to keep the framework under review. The UK GDPR. It’s like the GDPR, only with a Union Jack and a bulldog slapped on the side. Now, in practice, companies seem significantly less scared of the ‘UK GDPR’ than its full-fat European progenitor (probably for good reason; even before brexit, ICO was one of the less aggressive regulators, with its largest GDPR fine ever only being 20mn pounds), and of course the EU has a number of _newer_ consumer protections in this general area (DMA, DSA, AI Act etc) which the UK has _not_ implemented, but, for the moment at least, the UK still has some degree of data protection.
- webninja 2y agohttps://12ft.io/https://www.theatlantic.com/health/archive/2024/09/23andme-dna-data-privacy-sale/680057/ https://12ft.io/https://www.theatlantic.com/health/archive/2...
- dangitman 2y ago[dead]
- accrual 2y agoI checked the "destroy my sample after analysis" checkbox. So the analysis is there but not the actual sample. Maybe this is somewhat better?
- neilv 2y agoYou're confident that the sample was destroyed?
- accrual 2y agoIf they say they will destroy it, then I later find it wasn't destroyed and it was used in some way that was harmful to me, doesn't that make the company massively liable? That's the only reassurance I have. It would be like illegally collected evidence. Sure, you may have some evidence (my DNA), but it's not admissible because you're not supposed to have had access to it.
- neilv 2y agoIIUC, there are hard rules about admissibility of evidence, and you're aware when an attempt is made to use evidence that way, and have an opportunity to argue it, in a very enforceable way. Are there analogous rules around the DNA sent to 23andMe, would you have an enforceable opportunity to block uses of that, and would you even know when they're using it that way?
- a0123 2y agoI'll bet everything I have they haven't destroyed the sample. Honest and sincere question: why would you even use their service in the first place?
- bitnasty 2y agoI assume anytime a company says they will delete my data that they will just remove the ability for me to access it.
- Mistletoe 2y agoI’m glad I at least downloaded my data so I can have it forever and upload it where I like. I don’t regret having 23andme genotype it. I knew the pros and cons when I did it and the pros outweighed the cons for me.
- mchannon 2y agoThe US Government already has my DNA. Because of 23andme, I was able to discover I had one copy of delta-32, and that’s pretty cool. I was also able to find out where I came from and connect with distant relatives. To those who are tightly connected with their huge family, you’re privileged. I’d be sad if this resource went away but I don’t fear it being used for nefarious purposes. I can rest assured the US government is already miles ahead toward that end.
- ungreased0675 2y agoYou don’t worry about an additional potentially malicious actor having your information because one already has it?
- mchannon 2y agoIf I was worried I wouldn't have furnished my DNA to a corporation with very little accountability in the first place. I got enough out of the deal (instead of nothing from the government) that it was in my mind an acceptable tradeoff. No one's about to start cloning me. Your DNA is not secret. You leave it everywhere you go. You have no reasonable expectation of privacy for your litter when you litter. It's only a matter of time and of tech before everybody has a copy of everybody's DNA.
- jpeeler 2y agoThat is the crux of the entire privacy argument. Why strive for privacy when "I have nothing to hide?" Also, how sure are you that having a copy of everyone's DNA data will become widespread? At a minimum, perhaps if you delay making the data easy to extract one can at least hold out hope that privacy laws will catch up. Of course, there's zero guarantee in that happening either. Lastly, security through obscurity is not something to be relied upon. But it can work for a period of time.
- dahart 2y agoThere is a list of reasons several agencies in US government like the FBI collects DNA from some people, but they don’t have DNA for all US citizens and I don’t expect the government to have my DNA. What nefarious purposes do you imagine the government has? Is matching suspected criminals against the crime database a nefarious purpose? Would you care if 23AndMe sold your DNA & analysis to a private for-profit medical insurance data provider who could recommend hiking your price or denying coverage, based on your genetic markers, without having to tell the insurance company why and without having to share your DNA? This is one of the private business nefarious purposes I worry about, based on having a friend who worked in credit processing saying that they were looking for legal ways to sell purchasing habits to medical insurance companies.
- wenc 2y agoOne of the concerns I had when I did 23andMe many years ago was that someone in the future would be able to recreate me Jurassic-Park-style. Now I'm not an expert, but based on my reading of how they collect data, turns out 23andMe doesn't actually have my DNA sequence data. They do what is called "genotyping"[1] which is much cheaper than full "sequencing" [2], but which only probes for a limited set of known variants. So it's only partial information. Since then 23andMe has launched a more expensive 23andMe+ Total Health offering, which does full sequencing, but like most people, I never subscribed to that package. In fact I had no occasion to interact with the company after the first result, which may be why they are struggling financially. DNA testing is something most people might do at most once in their lives -- then they lose interest. [1] https://customercare.23andme.com/hc/en-us/articles/202904610-How-Does-23andMe-Genotype-My-DNA https://customercare.23andme.com/hc/en-us/articles/202904610... [2] https://customercare.23andme.com/hc/en-us/articles/202904600-Difference-Between-DNA-Genotyping-Sequencing https://customercare.23andme.com/hc/en-us/articles/202904600...
- bilsbie 2y agoIt wouldn’t be you in any case. Basically the same as an identical twin.
- Auracle 2y agoAlso, why would they bother? Maybe if you were a celebrity of some sort, maybe, but even then..
- Teever 2y agoI see a near future scam where people seek out genetic material of the wealthy to create children so that they can sue them for child support. Imagine someone doing this to the judge that ruled they owe child support for their child from a previous marriage out of spite.
- layer8 2y agoThey could sell the organs back to you when you need one. Or the whole body for a brain transplant. (This was a plot point in a sci-fi story I vaguely remember.)
- steelframe 2y agoThe article makes a point that 23andMe isn't bound by HIPAA, but even if it were, I wouldn't consider that adequate. The bar for collecting and holding PII, particularly medical, needs to be much, much higher than it is today. A doctor I recently visited whipped out his iPhone and asked if I was okay with him recording our conversation so that some fly-by-night rando AI company could vacuum up our private conversation and spit out some LLM-generated summary of our visit. "Not to worry," he insisted, "they're HIPAA compliant!" I probably should have walked out of the office right then and there, but instead I simply told him no, not under any circumstances may he record our private conversation and send it off to some third party over the Internet. He seemed a bit taken aback because I guess I am the only patient he's had push back on it. He tried saying that the service "really helped him" or something like that. It seemed like he was trying to make me feel bad for "making his job harder." I simply replied that HIPAA compliance didn't prevent the last 5 or 6 letters I've received from both hospitals and insurance companies about "cybersecurity events" leading to the compromise of my PII. And not just any PII, mind you. It was my medical information, supposedly "protected" by HIPAA. These were major insurance companies and hospitals. And you want me to believe that some fly-by-night AI startup is going to somehow be a safe place for a goddamned fscking full audio recording of our private visit, just because they claim to be HIPAA compliant? Are you kidding me? I've made it a point to start writing my representatives in government about these issues. They need to wake up and start doing something meaningful to protect the people who are being bamboozled by all the yahoos who play fast-and-loose with their privacy, especially medical PII.
- tengbretson 2y agoHIPAA has nothing to do with PII you voluntarily disclose.
- cmsonger 2y agoPaid them for a sample kit. Never used it after I carefully read the ToS and thought about what might happen.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- carimura 2y agoWhat options do we have to delete our data? Anyone looked in detail? [edit] From their website: Data retention 23andMe will retain some information to comply with legal obligations, including your DNA, sex, and date of birth So apparently you can permanently delete your data, except for, oh just your DNA.... [edit 2] From NYT (https://archive.is/ynvDR https://archive.is/ynvDR) However, 23andMe uses a laboratory that must follow regulations under the Clinical Laboratory Improvement Amendments, or CLIA. This means that some data, including your DNA, sex and date of birth will be retained in order to comply with these regulations. The company will no longer use that information, though. You can read more about the company’s deletion processhere.
- freeqaz 2y agoThat's absurd. I wonder why? Because they need it to make their family tree work? Does anybody know why?
- jayknight 2y agoHere are the CLIA retention regulations. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-493/subpart-J/section-493.1105 https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-...
- justinclift 2y agoDoesn't seem like it's that then. Tissue. Preserve remnants of tissue for pathology examination until a diagnosis is made on the specimen. Depending on what "until a diagnosis is made" would mean in the 23andMe context.
- hedora 2y ago…because it would be illegal for them not to keep it? I wonder which law supposedly says this.
- matrix2003 2y ago
- voisin 2y agoIs there any way to use privacy laws to have 23andMe wipe your data?
- louthy 2y agoIf you’re in the EU or UK, yes. File a GDPR request for removal of all data relating to you.
- slowmotiony 2y agoThey'll definitely do it. They promise.
- louthy 2y agoWe can only use the laws that exist. Bad actors will act bad regardless.
- robterrell 2y agoRemoving just your data probably isn't enough? Despite my curiosity, for privacy reasons I made the decision to not use 23andMe. (Basically - feels like information an insurer will inevitably want to use against me.) My wife did, however, and over the years our kids did too, for various reasons (an interest in genealogy, a kid with celiacs looking to trace the genetic component, etc). Recently I was very surprised to look at the app on my wife's phone and see that they have a shadow account for me with a lot of details filled in, due to my wife/kids/siblings/cousins having used the service. I should not be suprised -- this is how they caught the golden state killer, after all.
- smcin 2y agoWhen you say your wife "used 23andMe", do you mean she merely signed up for ancestry features (e.g. 23andMe Family Tree) without submitting her own genetic data (i.e. to see what happened when a relative submitted theirs), or that she also submitted her own genetic data?
- 2y ago
- barbazoo 2y agohttps://archive.ph/mjaHb https://archive.ph/mjaHb
- pluc 2y agoThis is turning out to be a really bad Christmas gift.
- y-curious 2y agoLooking to open a service that lets you gift someone a billboard with their first pet's name and mother's maiden name. I feel inspired
- bjoli 2y agoA relative id mine sent her DNA to 23andMe or something like it. I was angry then, and I still haven't forgiven her.
- Shank 2y agoWhy is it your business what your family members do with their bodies?
- teeray 2y agoIf you can infer things about living relatives from a DNA sample (preexisting conditions, for example), then you should need their consent to release that sample. It’s not only your information.
- inglor_cz 2y agoThis is a genuinely interesting ethical question. While our phenotypes (bodies) are separate, our genotypes are very much a shared resource (at least for read access); an extra special case are monozygotic twins, where if you obtain sample from one of them, you just mapped both. Fortunately we don't see applications like "personalized poisons" yet, but it is likely inevitable. If, say, an insurance company denies you some policy because of what they learnt from your relative's DNA, you suffered a concrete harm from that sampling decision.
- absisbdbjs 2y agoIronically, I think it’s this kind of attitude that creates an environment where the parent is rightfully upset. We are not isolated units. Almost all our choices have impact on others. Lack of a shared culture creates societies where people are rightfully scared what the next isolated unit will do with their sensitive data. It’s possible to live in a high trust society.
- purple_ferret 2y agobecause if they murder someone, they'll be easily traceable if they leave genetic data behind
- h4ch1 2y agoSending a private corporation your DNA is a bad idea the second you hear about it no matter what the "benefits" are. Why would people, especially those who frequent HN and are aware of the data privacy debacles throughout history even trust them with something like this?
- nextlevelwizard 2y agoHindsight is always 20/20. My excuse is that I was young and even now I don’t see this as a huge disaster. But maybe I am just naive.
- mrweasel 2y agoI think that depends on when you used their service. In the last 5 years, then yes, probably very naive. 23andMe was founded at a different point in time, where things looked more optimistic, funding was a different game and we worried less about companies misusing our personal information. It might not be a huge disaster, but to me the issue is that the company can't make any real promises about how they might profit from the DNA of it's customers in the future. It's not a problem unique to 23andMe, I will never sign up to another social network, because of Facebooks behavior. I'll never sign up to another service such as Gmail, Outlook, YouTube or Reddit, because I've seen what those companies did and how they behaved I can no longer trust any online service. The trust that existed in the early 2000s is gone, the idea that if we didn't like something we could just leave and delete everything is gone. I don't envy someone trying to bootstrap a new service, the previous generation of companies have poisoned the well.
- consteval 2y agoIn my opinion this type of stuff won't become a big problem for another couple decades. When DNA is used for more and more stuff. Just keep in mind the Golden State Killer lost his DNA in the 70s, and was prosecuted in the 2010s. Using DNA from a third cousin who used an online DNA service. Maybe don't kill anyone and you're fine, maybe not. Time will tell.
- drowntoge 2y agoAny sufficiently large corporation possesses the resources to gain trust by portraying itself as the 'nice guys,' unlike the others, which is often convincing enough to fool many. The conviction that every corporation is inherently evil or can turn evil at any point in the future never seems to fail, but many people just aren't that skeptical.
- robertclaus 2y agoHaving worked at startups, my guess is that 23andMe doesn't even have the data a malicious company would want. Best case someone will buy them with some evil plan and realize the data is useless anyways.
- ZitchDog 2y agoIt's not just people who gave them data who should be worried. If a close relative gave their info to 23andme, they probably have enough data to associate your DNA with that relative. For instance my mom did 23andme and now 50% of my DNA is in this private commercial database without my consent and this data is completely unencumbered by HIPAA privacy restrictions.
- layer8 2y agoAll humans share 99% of their genome, so it’ll be more than 50%. ;)
- consteval 2y agoFood for thought, they found the Golden State Killer using the DNA of a third cousin. So in a familial pool of hundreds of people, if even 1 gives up DNA then you could (with effort) find out anyone else. Provided they're in a good spot on the tree, you can't do much with a 5th cousin. Of course the Golden State Killer was extenuating circumstances. He killed about a dozen people and sexually assaulted over 50 women in the 70s. But, it makes you wonder about the future of criminology.
- dcchambers 2y agoIt's hard to feel bad for people that willingly gave their DNA samples to a private company. Come on y'all, use some common sense.
- ProllyInfamous 2y agoWhat about feeling bad for people whose family members submitted their own similar DNA — specifically an identical twin?
- CatWChainsaw 2y agoWhile I agree with you that anyone worried about privacy was a bit short-sighted to use 23AndMe, it's the same deal with everything, everywhere. Your favorite social media platform surveils all your posts/pictures/videos and is probably training an AI model on them by now, even though when you signed up for Friendster in the 1940s all of today's AI developments were distant sci-fi fever dreams. Outlook and Gmail feast on your emails. Your car is sharing everything you do with the manufacturer and the dealer and probably the government. Your washer is using up huge amounts of data for some reason, and you likely didn't even set up the app it has for reasons unfathomable. Data is money, so of course companies will pull out every stop to harvest it, monetize it, deprive you of control over it, and ransom you with it.
- EasyMark 2y agoIt really isn’t. Lots of people are much more trusting than most tech people that I know who know exactly how easy it is to replicate data, keep data forever, and in general misuse data. Techies and ad people have known for decades.
- yoav 2y agoGovernments hunted down my family in the 30s without DNA, so I don’t think random PE firm is going to be able to do anything too evil with my 10 year old cheek cells or partial sequence that they couldn’t do without it. Honestly my name and face give me away. Finding out that I had all the known markers for Parkinson’s 30 years before symptoms are expected to show up gave me an unbelievable head start and changed the trajectory of my life in several ways. I read the TOS at the time. Would do again even with the data leak.