Live data from Hacker News

23andMe updates their TOS to force binding arbitration

stackdiary.com

31–40 of 252 posts

Re: 23andMe updates their TOS to force binding arbitration

#32
post #26

My mother innocently used this service, and filled out the form identifying all relatives by name. The results she received were entirely unenlightening, 50% of my DNA is now in their sketchy database, and I have no way to opt-out of anything. I truly despise this organization.

This 2021 New Yorker article: How Your Family Tree Could Catch a Killer ( https://www.newyorker.com/magazine/2021/11/22/how-your-famil... ) was incredibly illuminating and changed my perspective on our sense of privacy. With a surprisingly small fraction of the world's population sequenced, we can still match a sample to a person whose sequence we don't have . To quote the article: "Genetic genealogy, it turned out,…

And now a nation state hacker can use the same database to identify U.S. citizen descendants (to what generation?). Good luck with "illegals" style espionage

Re: 23andMe updates their TOS to force binding arbitration

#33
post #26

My mother innocently used this service, and filled out the form identifying all relatives by name. The results she received were entirely unenlightening, 50% of my DNA is now in their sketchy database, and I have no way to opt-out of anything. I truly despise this organization.

This 2021 New Yorker article: How Your Family Tree Could Catch a Killer ( https://www.newyorker.com/magazine/2021/11/22/how-your-famil... ) was incredibly illuminating and changed my perspective on our sense of privacy. With a surprisingly small fraction of the world's population sequenced, we can still match a sample to a person whose sequence we don't have . To quote the article: "Genetic genealogy, it turned out,…

This feels like a "think of the children" type of appeal.

I personally don't have any murderous history to hide. But there are unintended consequences with all of these losses of privacy. As a peer comment has rightly pointed out, nation state adversaries now have these same profiles.

Maybe they can find a common DNA profile for an efficient bio-weapon. Oops.

I escaped an authoritarian regime as a child, thanks to the same mother. I hold no ill will towards her, but I am deeply aware of the issues that bad actors can create with by compiling huge databases of otherwise unnecessary information.

Re: 23andMe updates their TOS to force binding arbitration

#34
post #12

My mother innocently used this service, and filled out the form identifying all relatives by name. The results she received were entirely unenlightening, 50% of my DNA is now in their sketchy database, and I have no way to opt-out of anything. I truly despise this organization.

What does "innocently" mean in this context?

[deleted]

Re: 23andMe updates their TOS to force binding arbitration

#35
post #7

The more TOS I read through, the more it seems we need a "common law" solution. (I use the term "common law" loosely here) Something like a couple of pre-defined categories for software services (e.g. info provider, social network, real-world interface) with pre-set rules (e.g. the client cannot attempt to break the social network; the owner of the social network cannot re-sell data to a third party). We have somethi…

The easy answer should be TOS that are not non lawyer readable or not under N paragraphs are not binding. When you buy a house you don’t give 1 signature. You literally sign every friggen page including multiple places on the same page, TOS shouldn’t be different

Re: 23andMe updates their TOS to force binding arbitration

#36
post #31

Earlier quoted context omitted.

It costs nothing to preserve you rights. To opt out, email legal@23andme.com notice you do not agree to arbitration.

What benefit would you get out of doing that?

I'd assume you are able to sue them through court.

Re: 23andMe updates their TOS to force binding arbitration

#38
post #31

Earlier quoted context omitted.

It costs nothing to preserve you rights. To opt out, email legal@23andme.com notice you do not agree to arbitration.

What benefit would you get out of doing that?

The ability to join a class action. You may get very little or nothing, but litigators will extract for 23andme’s data security failures. Private actions fill a gap when regulators and statute are inadequate.

If there is no cost, business as usual continues.

(I have opted out and intend to join a class action; I also own customer IAM in my day job, and am aware of the effort that would’ve prevented the root cause)

Re: 23andMe updates their TOS to force binding arbitration

#39

My mother innocently used this service, and filled out the form identifying all relatives by name. The results she received were entirely unenlightening, 50% of my DNA is now in their sketchy database, and I have no way to opt-out of anything. I truly despise this organization.

23andMe claims that no DNA information was revealed, and I'm having trouble finding a primary source that claims that the SNP info was taken. From a more detailed article:

> ... which exposed sensitive personal information that included things relevant to ancestry trees, birthdays and general geographic locations. In some cases, the company said that the hack could have exposed the pictures and display names of affiliated family members also using the company’s services through the accounts that were primarily breached. 23andMe insists that no actual genetic material or DNA records were exposed

> ... A 23andMe spokesperson told Engadget that hackers accessed the DNAR profiles of roughly 5.5 million customers this way, plus Family Tree profile information from 1.4 million DNA Relative participants.

>DNAR Profiles contain sensitive details including self-reported information like display names and locations, as well as shared DNA percentages for DNA Relatives matches, family names, predicted relationships and ancestry reports. Family Tree profiles contain display names and relationship labels, plus other information that a user may choose to add, including birth year and location. When the breach was first revealed in October, the company said its investigation “found that no genetic testing results have been leaked.”

https://www.engadget.com/23andme-hack-now-estimated-to-affec...

Presumably the journalist at Stackdiary translated "DNAR profile" into "genetic profile," which is a term with no standard definition, but if it had one, I would have guessed it would mean at least some DNA info.

23andMe could be lying or ignorant of what happened, but that would also mean that there would also be another news cycle when further disclosure was mandated.

Post reply on HN