Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Delete Your 23andMe Data

eff.org

Post reply on HN
Print view View original

31–40 of 125 posts

Re: How to Delete Your 23andMe Data

#31

Post by consumer451 »

echelon wrote: post #22
brian-armstrong wrote: post #18

The distinction isn't super important, but 23andMe doesn't have your whole genome, just some specific locations from it. Roughly 750k base pairs or so. https://www.quora.com/How-much-of-the-genome-does-23andMe-se...

Enough to be denied insurance, have job offers rescinded, or be targeted by scams. And they don't even have to have your DNA. Just a close enough relative will do.

> Enough to be denied insurance...

Not just you, but your children who never had anything to do with 23andMe as well!

Re: How to Delete Your 23andMe Data

#32

Post by a2dam »

echelon wrote: post #22
brian-armstrong wrote: post #18

The distinction isn't super important, but 23andMe doesn't have your whole genome, just some specific locations from it. Roughly 750k base pairs or so. https://www.quora.com/How-much-of-the-genome-does-23andMe-se...

Enough to be denied insurance, have job offers rescinded, or be targeted by scams. And they don't even have to have your DNA. Just a close enough relative will do.

The Genetic Information Nondiscrimination Act makes it illegal to adjust health (but not life) insurance premiums or discriminate for employment based on genetic information. Couples who do genetic testing before having kids have the same protections and they're very effective.

Re: How to Delete Your 23andMe Data

#33

Post by dahinds »

ziddoap wrote: post #24
dahinds wrote: post #19

Earlier quoted context omitted.

This is false, we've sold data with PII to no one. Or it is misleading: the page you linked to even says, "It is selling de-identified, aggregate data for research, if you give them consent."

> It is selling de-identified, aggregate data Just a note that re-identifying aggregate data is a whole field of study that is decently successful.

Indeed, but here "re-identification" generally means the sort of attack where you have an aggregated genomic dataset, and you already have access to full genomic data for a target individual, and you use the genomic dataset to infer something about that target that you didn't know, like whether or not they participated in that study. Not to entirely minimize this sort of attack, but the NIH decided it was a sufficiently low risk that most of the sorts of datasets it applies to (like GWAS) are routinely shared with no access controls.

Re: How to Delete Your 23andMe Data

#34

Post by echelon »

echoangle wrote: post #30
echelon wrote: post #22

Earlier quoted context omitted.

Enough to be denied insurance, have job offers rescinded, or be targeted by scams. And they don't even have to have your DNA. Just a close enough relative will do.

> have job offers rescinded, or be targeted by scams Can you expand on this? I understand the insurance thing due to genetic diseases and so on, but which jobs would I be denied for based on genetic information which wouldn’t be checked anyways? I can only come up with stuff like colorblindness but that would probably be checked anyways if it were a strict requirement for the job so keeping the DNA secret wouldn’t he…

This would be wholly illegal, but companies could screen candidates prior to extending offers to them. After they get your primary details and history, they can look you up in the gene database. They could look for a whole host of genetic markers, including but not limited to:

- Markers like ADHD and other neurodivergence and performance signals

- Disease likelihoods to reduce their insurance burden. Cardiovascular, cancer, neurodegeneration, etc.

- Markers for intelligence and tenacity. Personality type. Conversely, dishonesty, neuroticism, etc.

They could screen for literally any hypothetical condition that could in theory impact performance, risk, cost, etc. By excluding candidates with "low genetic scores", they might think they're saving margin.

There is a ton of literature beyond what 23andMe is legally allowed to report on with respect to the SNP data they collect. These studies report on a wide range of phenotypical states and behaviors that could impact job performance. The stack of research is deep.

> And what’s the scam angle when the DNA is known?

Look for any markers that indicate IQ, agreeableness, neurodegeneration, schizophrenia, personality type, etc. It gives scammers a hypothetically better hit rate.

And again, they don't need your DNA to do this. Just a relative's.

Re: How to Delete Your 23andMe Data

#35

Post by analog31 »

echoangle wrote: post #30
echelon wrote: post #22

Earlier quoted context omitted.

Enough to be denied insurance, have job offers rescinded, or be targeted by scams. And they don't even have to have your DNA. Just a close enough relative will do.

> have job offers rescinded, or be targeted by scams Can you expand on this? I understand the insurance thing due to genetic diseases and so on, but which jobs would I be denied for based on genetic information which wouldn’t be checked anyways? I can only come up with stuff like colorblindness but that would probably be checked anyways if it were a strict requirement for the job so keeping the DNA secret wouldn’t he…

>>> And what’s the scam angle when the DNA is known?

A person with apparent authority, telling people something about themselves, that they believed to be hidden, is a tactic for gaining psychological control. A strong-minded person should be able to withstand it under normal circumstances, but we're not all strong-minded under all circumstances. Hence the power of things like personality tests, police interrogations, and so forth.

Re: How to Delete Your 23andMe Data

#36

Post by echelon »

a2dam wrote: post #32
echelon wrote: post #22

Earlier quoted context omitted.

Enough to be denied insurance, have job offers rescinded, or be targeted by scams. And they don't even have to have your DNA. Just a close enough relative will do.

The Genetic Information Nondiscrimination Act makes it illegal to adjust health (but not life) insurance premiums or discriminate for employment based on genetic information. Couples who do genetic testing before having kids have the same protections and they're very effective.

Companies do illegal things all the time.

And let me flip this situation: are there any laws that prevent advertisers from looking at genetic data to target cohorts? If I were an unethical advertiser, I'd want to advertise to customers with less risk aversion, higher neuroticism, higher sense of FOMO. You could do some truly sickening stuff. Target higher mortality groups, certain personality types, cross reference with familial mortality data and have a field day...

There are untold ways this could be abused that I'm almost certain the law doesn't fully protect against.

Re: How to Delete Your 23andMe Data

#38

Post by dahinds »

dekhn wrote: post #26
EA-3167 wrote: post #23

Earlier quoted context omitted.

To what extent and using what method is it "de-identified"? Plenty of such schemes are very easy to circumvent, especially with a large enough pool of data. Given the nature of genetics in particular positively identifying a single case can be used to unmask whole families. In particular depending on the anonymization this would be a task suited to 'AI' very well.

https://www.23andme.com/about/individual-data-consent Basically, if you imagine this as a table of "user's name, date of birth, and address" keys mapping to genomic and other data, the key was replaced with a random identifier that could not be trivially joined to recover the user name, date of birth, and address. These systems are not robust against motivated and capitalized adversaries.

I can go to a data broker and purchase access to de-identified EMR data for most of the U.S. population. There are much more useful de-identified datasets around than ours, if someone is motivated to try to re-identify those datasets. That data is all bought and sold without anyone's consent and this is all fine under HIPAA.

Re: How to Delete Your 23andMe Data

#39

Post by dekhn »

dahinds wrote: post #38
dekhn wrote: post #26

Earlier quoted context omitted.

https://www.23andme.com/about/individual-data-consent Basically, if you imagine this as a table of "user's name, date of birth, and address" keys mapping to genomic and other data, the key was replaced with a random identifier that could not be trivially joined to recover the user name, date of birth, and address. These systems are not robust against motivated and capitalized adversaries.

I can go to a data broker and purchase access to de-identified EMR data for most of the U.S. population. There are much more useful de-identified datasets around than ours, if someone is motivated to try to re-identify those datasets. That data is all bought and sold without anyone's consent and this is all fine under HIPAA.

I wasn't trying to convince anybody otherwise. I think the noise about 23&Me's data to be pretty uninteresting. I published my own genome (through PGP) for anybody to download, and I know that people have identified me from my post https://news.ycombinator.com/item?id=7641201 and other comments.

Re: How to Delete Your 23andMe Data

#40

Post by tptacek »

echelon wrote: post #34
echoangle wrote: post #30

Earlier quoted context omitted.

> have job offers rescinded, or be targeted by scams Can you expand on this? I understand the insurance thing due to genetic diseases and so on, but which jobs would I be denied for based on genetic information which wouldn’t be checked anyways? I can only come up with stuff like colorblindness but that would probably be checked anyways if it were a strict requirement for the job so keeping the DNA secret wouldn’t he…

This would be wholly illegal, but companies could screen candidates prior to extending offers to them. After they get your primary details and history, they can look you up in the gene database. They could look for a whole host of genetic markers, including but not limited to: - Markers like ADHD and other neurodivergence and performance signals - Disease likelihoods to reduce their insurance burden. Cardiovascular,…

Being able to usefully mine this information out of SNPs is science fiction.
Post reply on HN