Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Delete Your 23andMe Data

eff.org

Post reply on HN
Print view View original

21–30 of 125 posts

Re: How to Delete Your 23andMe Data

#21

Post by nelox »

drdaeman wrote: post #4

Note that despite any requests the genetic data and some personal information (DOB and sex) probably won't be deleted, at least because of CLIA requirements: https://news.ycombinator.com/item?id=41781879 (more details in https://bourniquelaw.com/2024/10/09/data-23-and-me/ , linked from the thread there)

23andMe does not operate as a laboratory itself but contracts with U.S.-based labs that are certified under CLIA and accredited by the College of American Pathologists (CAP). According to their website, all saliva samples are processed in CLIA-certified and CAP-accredited labs, ensuring compliance with federal standards for accuracy and reliability. This certification is crucial, as it aligns with FDA requirements for certain health-related genetic tests. This distinction is significant, as CLIA primarily regulates labs, not the companies that contract them, potentially affecting the applicability of retention requirements to 23andMe’s broader operations.

CLIA’s record retention requirements, as per Section 493.1105, states labs must retain test requisitions, authorizations, and reports for at least 2 years, with longer periods for specific tests like pathology (10 years for slides).

CLIA Laboratory Record Retention Requirements:

- Test requisitions and authorizations: 2 years minimum. - Test reports: 2 years minimum, 10 years for pathology reports. - Cytology slide preparations: 5 years. - Histopathology slides: 10 years. - Pathology specimen blocks: 2 years. - Tissue: Until diagnosis is made.

Notably, these requirements focus on test-related records, such as requisitions (which may include patient details like date of birth and sex) and reports (which for genetic tests would include interpreted results). However, there is no explicit mention of retaining raw genetic data, such as the full genotype data, in the CLIA regulations. This raises questions about whether 23andMe’s assertion to retain raw genetic information is strictly required by CLIA or if it extends beyond the regulation for other reasons, such as research or quality control.

Re: How to Delete Your 23andMe Data

#22

Post by echelon »

brian-armstrong wrote: post #18

The distinction isn't super important, but 23andMe doesn't have your whole genome, just some specific locations from it. Roughly 750k base pairs or so. https://www.quora.com/How-much-of-the-genome-does-23andMe-se...

Enough to be denied insurance, have job offers rescinded, or be targeted by scams.

And they don't even have to have your DNA. Just a close enough relative will do.

Re: How to Delete Your 23andMe Data

#23

Post by EA-3167 »

dahinds wrote: post #19
rglover wrote: post #16

The data has already been sold off to the real customers (i.e., not you and me) [1]. You can (and should) request a deletion, but the damage has already been done. [1] https://gizmodo.com/23andme-is-selling-your-data-but-not-how...

This is false, we've sold data with PII to no one. Or it is misleading: the page you linked to even says, "It is selling de-identified, aggregate data for research, if you give them consent."

To what extent and using what method is it "de-identified"? Plenty of such schemes are very easy to circumvent, especially with a large enough pool of data. Given the nature of genetics in particular positively identifying a single case can be used to unmask whole families. In particular depending on the anonymization this would be a task suited to 'AI' very well.

Re: How to Delete Your 23andMe Data

#24

Post by ziddoap »

dahinds wrote: post #19
rglover wrote: post #16

The data has already been sold off to the real customers (i.e., not you and me) [1]. You can (and should) request a deletion, but the damage has already been done. [1] https://gizmodo.com/23andme-is-selling-your-data-but-not-how...

This is false, we've sold data with PII to no one. Or it is misleading: the page you linked to even says, "It is selling de-identified, aggregate data for research, if you give them consent."

>It is selling de-identified, aggregate data

Just a note that re-identifying aggregate data is a whole field of study that is decently successful.

Re: How to Delete Your 23andMe Data

#25

Post by dekhn »

dahinds wrote: post #19
rglover wrote: post #16

The data has already been sold off to the real customers (i.e., not you and me) [1]. You can (and should) request a deletion, but the damage has already been done. [1] https://gizmodo.com/23andme-is-selling-your-data-but-not-how...

This is false, we've sold data with PII to no one. Or it is misleading: the page you linked to even says, "It is selling de-identified, aggregate data for research, if you give them consent."

Providing another company access to deidentified data is "selling your data", to argue otherwise is just semantics.

Note that selling deidentified data (genomic, health, etc) is common in the industry already and 23&Me is hardly unique in this respect.

Re: How to Delete Your 23andMe Data

#26

Post by dekhn »

EA-3167 wrote: post #23
dahinds wrote: post #19

Earlier quoted context omitted.

This is false, we've sold data with PII to no one. Or it is misleading: the page you linked to even says, "It is selling de-identified, aggregate data for research, if you give them consent."

To what extent and using what method is it "de-identified"? Plenty of such schemes are very easy to circumvent, especially with a large enough pool of data. Given the nature of genetics in particular positively identifying a single case can be used to unmask whole families. In particular depending on the anonymization this would be a task suited to 'AI' very well.

https://www.23andme.com/about/individual-data-consent

Basically, if you imagine this as a table of "user's name, date of birth, and address" keys mapping to genomic and other data, the key was replaced with a random identifier that could not be trivially joined to recover the user name, date of birth, and address.

These systems are not robust against motivated and capitalized adversaries.

Re: How to Delete Your 23andMe Data

#29

Post by dahinds »

EA-3167 wrote: post #23
dahinds wrote: post #19

Earlier quoted context omitted.

This is false, we've sold data with PII to no one. Or it is misleading: the page you linked to even says, "It is selling de-identified, aggregate data for research, if you give them consent."

To what extent and using what method is it "de-identified"? Plenty of such schemes are very easy to circumvent, especially with a large enough pool of data. Given the nature of genetics in particular positively identifying a single case can be used to unmask whole families. In particular depending on the anonymization this would be a task suited to 'AI' very well.

Here "de-identified" means stripped of PII (name, address, phone number, email, etc). You are correct that genetic information is intrinsically identifiABLE (in the sense that it is stable and uniquely distinguishing for individuals). When we've shared individual-level data with a partner, it was with consent of the participants involved, and under a contract that prohibits re-identification.

Re: How to Delete Your 23andMe Data

#30

Post by echoangle »

echelon wrote: post #22
brian-armstrong wrote: post #18

The distinction isn't super important, but 23andMe doesn't have your whole genome, just some specific locations from it. Roughly 750k base pairs or so. https://www.quora.com/How-much-of-the-genome-does-23andMe-se...

Enough to be denied insurance, have job offers rescinded, or be targeted by scams. And they don't even have to have your DNA. Just a close enough relative will do.

> have job offers rescinded, or be targeted by scams

Can you expand on this?

I understand the insurance thing due to genetic diseases and so on, but which jobs would I be denied for based on genetic information which wouldn’t be checked anyways?

I can only come up with stuff like colorblindness but that would probably be checked anyways if it were a strict requirement for the job so keeping the DNA secret wouldn’t help.

And what’s the scam angle when the DNA is known?

Post reply on HN