3 ms·

To be honest, this is more like "requesting the data to be deleted". There's nothing that guarantees that the personal information will be physically wiped out

To be honest, this is more like "requesting the data to be deleted". There's nothing that guarantees that the personal information will be physically wiped out of the hard drives used to store them.

throwaway48476 2y ago
But it creates legal grounds for lawsuits if they don't.
- ahmedfromtunis 2y ago
  Of course. And I'm not saying that they might do it in malice. All I'm suggesting is that tapping some pixels on your backlit rectangular glass won't necessarily translate into pulses of electrons that'll eradicate the 0s and 1s representing your data. I'm sure that corner of the codebase is one of the least visited parts, so bugs may lurk in, or misconfigurations, etc.
- Cheer2171 2y ago
  Sure, you can sue the hollowed out shell of a bankrupt limited liability corporation that will soon have no assets for a court to sieze for whatever paltry damages a court finds.
  - wyldfire 2y ago
    Ideally the court can compel the purchaser(s) to destroy the data.
    - HankB99 2y ago
      > > this is more like "requesting the data to be deleted". > Ideally the court can compel the purchaser(s) to destroy the data. I suppose a court order holds more weight than checking a box on a web site, but I'm not sure how much I'd trust the eventual purchaser. Worse yet, if the seller drops their guard (due to lack of funding for proper security) will someone steal the data? At that point web requests and court orders are moot. I guess I'm seeing a black hat behind every bush. I'm not sure if this kind of data has any value on the black market.
    - red-iron-pine 2y ago
      > Ideally the current US presidential administration is in the process of completely hollowing out the US judicial system. nothing in the courts can be trusted if the SCOTUS can't be trusted. but even with sane leadership there is nothing preventing stuff from being leaked or sold. unless you can physically verify the shred-it guys destroying the disks, it's out there.
  - baranul 2y ago
    Good point. There is no confirming the data was actually deleted, beyond the request to do so. There is nobody to go after, as the new owner does not have to respect the request, unless a court orders them to do so. Even in that case, going after the new owner, it would appear to be time critical. Can users stop the selling or transfer of data, before any court could block it? The correct timing, appears to be that 23andMe would have had an opt-out, blocking the selling or transfer of their data. That also should have included confirmation of data deletion, if requested. Since none of that existed, the options for users are quite limited. In fact, many would have participated in 23andMe Research, so their data was likely going to wherever long before.
  - ashoeafoot 2y ago
    You might get half a office chair , for a lifetime of disadvantages .
    - bravetraveler 2y ago
      With current pricing, may have to settle for a single caster. One functional chair base per atomic family, sorry everyone else.
- pavel_lishin 2y ago
  A lawsuit costs money, and doesn't un-sell the data.
- deepsun 2y ago
  How you lawyer is going to prove the data is not deleted? And what damages are you going to claim in court. Lawyers are not cheap, no lawyer will work on a case less that even $1k. My only hope is donating to privacy fighting organizations like EFF that file class actions.
- dragonwriter 2y ago
  Yeah, and if you spend all the effort and end up winning your lawsuit, you can get a fresh new claim against an already bankrupt entity.
dylan604 2y ago
Also, what prevents new owners from restoring from backups because "we were hacked" or any other reason for retrieving backup data for something that is currently "deleted"?
- switch007 2y ago
  Exactly. Once you give your data, you no longer have any control over it, forever.
patrickwalton 2y ago
I deleted my data a few months ago and it happened fast enough that it didn't seem like there was a human in the loop.
- internetter 2y ago
  yes, but the implementation may, as far as you know, look like if (userRequestsToDeleteAccount || user.deactivated) { user.deactivated = true; showDeletionSuccessfulPage(); } In this implementation, the user believes their data is deleted, but it has not.
  - red-iron-pine 2y ago
    add a "count 400" or something in there to make it seem like something happened.

To be honest, this is more like "requesting the data to be deleted". There's nothing that guarantees that the personal information will be physically wiped out of the hard drives used to store them.

throwaway48476 2y ago

But it creates legal grounds for lawsuits if they don't.

ahmedfromtunis 2y ago
Of course. And I'm not saying that they might do it in malice. All I'm suggesting is that tapping some pixels on your backlit rectangular glass won't necessarily translate into pulses of electrons that'll eradicate the 0s and 1s representing your data. I'm sure that corner of the codebase is one of the least visited parts, so bugs may lurk in, or misconfigurations, etc.
Cheer2171 2y ago
Sure, you can sue the hollowed out shell of a bankrupt limited liability corporation that will soon have no assets for a court to sieze for whatever paltry damages a court finds.
- wyldfire 2y ago
  Ideally the court can compel the purchaser(s) to destroy the data.
  - HankB99 2y ago
    > > this is more like "requesting the data to be deleted". > Ideally the court can compel the purchaser(s) to destroy the data. I suppose a court order holds more weight than checking a box on a web site, but I'm not sure how much I'd trust the eventual purchaser. Worse yet, if the seller drops their guard (due to lack of funding for proper security) will someone steal the data? At that point web requests and court orders are moot. I guess I'm seeing a black hat behind every bush. I'm not sure if this kind of data has any value on the black market.
  - red-iron-pine 2y ago
    > Ideally the current US presidential administration is in the process of completely hollowing out the US judicial system. nothing in the courts can be trusted if the SCOTUS can't be trusted. but even with sane leadership there is nothing preventing stuff from being leaked or sold. unless you can physically verify the shred-it guys destroying the disks, it's out there.
- baranul 2y ago
  Good point. There is no confirming the data was actually deleted, beyond the request to do so. There is nobody to go after, as the new owner does not have to respect the request, unless a court orders them to do so. Even in that case, going after the new owner, it would appear to be time critical. Can users stop the selling or transfer of data, before any court could block it? The correct timing, appears to be that 23andMe would have had an opt-out, blocking the selling or transfer of their data. That also should have included confirmation of data deletion, if requested. Since none of that existed, the options for users are quite limited. In fact, many would have participated in 23andMe Research, so their data was likely going to wherever long before.
- ashoeafoot 2y ago
  You might get half a office chair , for a lifetime of disadvantages .
  - bravetraveler 2y ago
    With current pricing, may have to settle for a single caster. One functional chair base per atomic family, sorry everyone else.
pavel_lishin 2y ago
A lawsuit costs money, and doesn't un-sell the data.
deepsun 2y ago
How you lawyer is going to prove the data is not deleted? And what damages are you going to claim in court. Lawyers are not cheap, no lawyer will work on a case less that even $1k. My only hope is donating to privacy fighting organizations like EFF that file class actions.
dragonwriter 2y ago
Yeah, and if you spend all the effort and end up winning your lawsuit, you can get a fresh new claim against an already bankrupt entity.

dylan604 2y ago

Also, what prevents new owners from restoring from backups because "we were hacked" or any other reason for retrieving backup data for something that is currently "deleted"?

switch007 2y ago
Exactly. Once you give your data, you no longer have any control over it, forever.

patrickwalton 2y ago

I deleted my data a few months ago and it happened fast enough that it didn't seem like there was a human in the loop.

internetter 2y ago
yes, but the implementation may, as far as you know, look like if (userRequestsToDeleteAccount || user.deactivated) { user.deactivated = true; showDeletionSuccessfulPage(); } In this implementation, the user believes their data is deleted, but it has not.
- red-iron-pine 2y ago
  add a "count 400" or something in there to make it seem like something happened.