8 ms·
Already downloaded and deleted my data. It’s so wild that some new buyer could just buy peoples’ genetic data at a fire sale.
by alexfromapex 2y ago
Already downloaded and deleted my data. It’s so wild that some new buyer could just buy peoples’ genetic data at a fire sale.
- transcriptase 2y agoI do wonder whether the data is actually deleted or they just do like every other large tech company and set a “deleted = true” flag that hides it from the user, since actually deleting it and all of its replicates across data centres, backup images, and tape storage is from what I’ve been told, virtually impossible even if the will was there.
- kshacker 2y agoOur industry's dark secrets getting exposed like this ... yeah you are right, we don't even need a whistleblower for this :)
- bbor 2y agoIt is the law in California, and it is certainly possible at scale, just not cheap or trivial. Presumably, given the intense focus of the state government on their company in particular, they have long since implemented a compliant deletion mechanism! The question, of course, is whether that same functionality is applied to residents of other states wishing to delete their data…
- someothherguyy 2y agohttps://en.wiktionary.org/wiki/soft_deletion https://en.wiktionary.org/wiki/soft_deletion
- silisili 2y agoIt's absurd to me how soft deletion took over the entire industry and 'DELETE FROM' became taboo.
- raverbashing 2y agoToo many fat fingers, too many relations that were not suppose to break (or were supposed to be disjoint but weren't), too much regulatory uncertainty, both for deleting and keeping the data, etc etc
- silisili 2y agoThe regulatory aspect is one I get. The problem is that it infected the mindset of almost every company. Those that worked at companies who needed it brought the mindset everywhere. And like many technologies, people who study what big companies do mimic it everywhere, even where it's not needed. So your simple stupid SaaS company has some simple object that a user wants to delete that ends up living in a db somewhere... forever.
- msie 2y agoNot really, soft deletion has saved many people's bacon.
- al_borland 2y agoThat doesn’t mean soft delete should be the only option. With some of our processes, we soft delete for a period of time (2-4 weeks) to account for mistakes. Then, if on one tries to recover it after that time, it does the actual delete. This seems like a reasonable compromise to me. It offers a safety net, while still getting the job done. With as many data breaches as we see these days, I want my data gone. If someone gets a dump of the DB, a delete flag doesn’t matter. This was the primary reason I never got a DNA test, even though I want to see what my results would be. I never trusted the companies to store that data long term. If I could get a test where a company didn’t store the results after they were provided to me, I’d get one tomorrow.
- johnisgood 2y agoThe AT&T leak was huge. :D There was also a leak in either 23andMe or some other company handling DNAs not too long ago (months, maybe 2 years >.>).
- carimura 2y agoit very likely may not be per their own words. They are "bound by various legal and regulatory obligations that may necessitate retention of certain information". This came straight from their privacy team.
- Unroasted6154 2y agoIt possible with crypto shredding. You store everything encrypted with one key by customer. When you want to delete you erase the key. The data becomes unusable everywhere (backups included). Then a job periodically garbage collects data without a key, but that's more for cost saving. Big companies do this but it requires some technical maturity. If you operate in Europe you have to implement proper data deletion. I would be more worried about small companies that large ones tombe honest.
- Quekid5 2y agoYou still have to backup those keys somewhere... and if you don't do it the same way as for the data then your backups are effectively worthless.
- ripped_britches 2y agoYea was going to say this. I would be surprised if any major company does this for normal uses.
- Unroasted6154 2y agoThat's how GAFAMs size companies do it. They need to comply with European regulations for data deletion, and there are very few other options.
- muti 2y agoMuch less data to back up so it can be stored in a way that is replicated for redundancy but still mutable. Separating the key and data is what allows for sending data to tape backup etc
- Quekid5 2y agoIf your (backup-via-redundancy) keys are mutable, you do not have a backup. What happens in the case of a ransomware attack, for example? You've also added (possibly substantial) latency to every single operation that operates on user data.
- tdeck 2y agoSoft deletion doesn't satisfy the company's obligation under the CCPA.
- sofixa 2y agoIt was wild to send your genetic data to a private company that could do whatever it wanted with it for a gimmick (3% Irish? who cares, if you're interested go look up archival records of your ancestors).
- dplgk 2y agoMy half aunt who never knew who her father (my grandfather) was found my family through 23 and me relative matching. That's life changing, not gimmicky.
- greggsy 2y agoInterested to know whether the collection statements can persist, or if they can just send a generic ‘we’ve updated our privacy policy’ email.
- 1oooqooq 2y agodeleting your data just change "for alexfromapex, sibling of x, son of y and z" to "maybe belong to owner of email alexfromapex@gmail, sibling of x, son of y and z"... that's the beauty of soft deletion plus shadow/inferred profiles.