4 ms·

Can one even truly delete their DNA from 23andMe? Wouldn't deleting someone's DNA require deleting not only the existing record, but also the record from all hi

Can one even truly delete their DNA from 23andMe? Wouldn't deleting someone's DNA require deleting not only the existing record, but also the record from all historical back-ups too? What is to say 23andMe just doesn't flip a bit in their database and claim one's DNA is (soft) deleted?

vintermann 1y ago
Well, GDPR compliance is one thing. It could be very expensive if you have European customers and get caught doing this.
- FirmwareBurner 1y ago
  If they don't have any offices or assets in Europe, then the EU can't do anything against them for breaking GDPR.
  - chha 1y ago
    Sure they can. GDPR article 2 (2) says: «This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union;» So the GDPR applies. The EU can of course sanction violators outside, but given the current political climate it is likely to be more difficult than before.
    - FirmwareBurner 1y ago
      >Sure they can. GDPR article 2 (2) says: No they can't. That says only about where the law applies, it doesn't say about prosecution of entities not residing in the EU. EU's legal arm can't extent outside the boarders of the EU, without an outright military invasion, it's toothless to foreign entities. >So the GDPR applies. I never said it doesn't apply. I said how is the EU gonna prosecute an entity that doesn't reside in the EU? Extraditions are tough to negotiate even for serious stuff like murder. No foreign judge will take GDPR violations seriously to do that.
      - chha 1y ago
        Sorry for that, guess I'm just too used to the common misconception some people have that the GDPR doesn't apply if a company isn't established in the EU. In this case 23andMe is on the Data Privacy Framework list, so they have volunteered to follow the GDPR while still being based in the US. This is basically the same as a number of other GDPR cases, including the GDPR fine against Clearview AI. Fining 23andMe if they violate GDPR should be trivial in that case.
      - vintermann 1y ago
        EU will presumably stop you from doing business in the EU, if you break EU laws and ignore judgments. Companies don't want that. Grindr LLC, a US company with no EU corporate presence as far as I know, was fined 6.5 million for breaching GDPR by an Oslo Court, upheld in appeals. They paid that fine. If they didn't, they'd probably be kicked out of the app stores from Norway (if not from all of EU). Apple and Google do have an EU presence. Even if they didn't, they wouldn't start a war over 23andMe. We generally don't need to worry about EU judgments against US companies being enforced, or vice versa. It doesn't get far enough that we need to think about how it's going to be enforced as a practical matter.
        culopatin 1y ago
        You really think they are getting access to their data and looking for some German dude’s data in every server they have? At most 23andMe gets some 250 item questionnaire that some poor soul with a red stapler in a basement has to answer, some middle manager puts a signature on it, sends it saying “yeah we good” and that’s it. Unless there is enough noise for someone to sue, no one is looking at that shit hard enough. Even if they are, 6.5 million in fines is chump change.
        Novosell 1y ago
        Meta has been fined €1.2b for breaching GDPR, though it seems to still be appealing. The fine is revenue adjusted.
        vintermann 1y ago
UltraSane 1y ago
The only truly reliable way to do this is to have a per-customer encryption key used to encrypt ALL data for that customer. Then you can simply delete the key to delete the customer data.
- deleted 1y ago
  [deleted]

vintermann 1y ago

Well, GDPR compliance is one thing. It could be very expensive if you have European customers and get caught doing this.

FirmwareBurner 1y ago
If they don't have any offices or assets in Europe, then the EU can't do anything against them for breaking GDPR.
- chha 1y ago
  Sure they can. GDPR article 2 (2) says: «This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union;» So the GDPR applies. The EU can of course sanction violators outside, but given the current political climate it is likely to be more difficult than before.
  - FirmwareBurner 1y ago
    >Sure they can. GDPR article 2 (2) says: No they can't. That says only about where the law applies, it doesn't say about prosecution of entities not residing in the EU. EU's legal arm can't extent outside the boarders of the EU, without an outright military invasion, it's toothless to foreign entities. >So the GDPR applies. I never said it doesn't apply. I said how is the EU gonna prosecute an entity that doesn't reside in the EU? Extraditions are tough to negotiate even for serious stuff like murder. No foreign judge will take GDPR violations seriously to do that.
    - chha 1y ago
      Sorry for that, guess I'm just too used to the common misconception some people have that the GDPR doesn't apply if a company isn't established in the EU. In this case 23andMe is on the Data Privacy Framework list, so they have volunteered to follow the GDPR while still being based in the US. This is basically the same as a number of other GDPR cases, including the GDPR fine against Clearview AI. Fining 23andMe if they violate GDPR should be trivial in that case.
    - vintermann 1y ago
      EU will presumably stop you from doing business in the EU, if you break EU laws and ignore judgments. Companies don't want that. Grindr LLC, a US company with no EU corporate presence as far as I know, was fined 6.5 million for breaching GDPR by an Oslo Court, upheld in appeals. They paid that fine. If they didn't, they'd probably be kicked out of the app stores from Norway (if not from all of EU). Apple and Google do have an EU presence. Even if they didn't, they wouldn't start a war over 23andMe. We generally don't need to worry about EU judgments against US companies being enforced, or vice versa. It doesn't get far enough that we need to think about how it's going to be enforced as a practical matter.
      - culopatin 1y ago
        You really think they are getting access to their data and looking for some German dude’s data in every server they have? At most 23andMe gets some 250 item questionnaire that some poor soul with a red stapler in a basement has to answer, some middle manager puts a signature on it, sends it saying “yeah we good” and that’s it. Unless there is enough noise for someone to sue, no one is looking at that shit hard enough. Even if they are, 6.5 million in fines is chump change.
        Novosell 1y ago
        Meta has been fined €1.2b for breaching GDPR, though it seems to still be appealing. The fine is revenue adjusted.
        vintermann 1y ago

UltraSane 1y ago

The only truly reliable way to do this is to have a per-customer encryption key used to encrypt ALL data for that customer. Then you can simply delete the key to delete the customer data.

deleted 1y ago
[deleted]