Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Delete Your 23andMe Data

eff.org

Post reply on HN
Print view View original

41–50 of 125 posts

Re: How to Delete Your 23andMe Data

#41

Post by dahinds »

dekhn wrote: post #25
dahinds wrote: post #19

Earlier quoted context omitted.

This is false, we've sold data with PII to no one. Or it is misleading: the page you linked to even says, "It is selling de-identified, aggregate data for research, if you give them consent."

Providing another company access to deidentified data is "selling your data", to argue otherwise is just semantics. Note that selling deidentified data (genomic, health, etc) is common in the industry already and 23&Me is hardly unique in this respect.

I would not argue with you on that it is "selling your data". But I also think there are meaningful differences in harm levels for different kinds of "selling your data", and fully identified data has more potential harms than de-identified data where you have to assume that an adversary is willing to violate contracts and/or the law to learn about particular individuals.

There is considerable confusion about the distinction between aggregated data and de-identified individual-level data. I would say that I don't consider sufficiently aggregated data to be "your data" in a particularly meaningful personal sense of "your", even though there are still some re-identification risks from these types of datasets.

I was contesting the statement that "The data has already been sold... [and] the damage is already done" which I still think is highly misleading.

Re: How to Delete Your 23andMe Data

#42

Post by wyldfire »

Cheer2171 wrote: post #15
throwaway48476 wrote: post #10

Earlier quoted context omitted.

But it creates legal grounds for lawsuits if they don't.

Sure, you can sue the hollowed out shell of a bankrupt limited liability corporation that will soon have no assets for a court to sieze for whatever paltry damages a court finds.

Ideally the court can compel the purchaser(s) to destroy the data.

Re: How to Delete Your 23andMe Data

#43

Post by echelon »

tptacek wrote: post #40
echelon wrote: post #34

Earlier quoted context omitted.

This would be wholly illegal, but companies could screen candidates prior to extending offers to them. After they get your primary details and history, they can look you up in the gene database. They could look for a whole host of genetic markers, including but not limited to: - Markers like ADHD and other neurodivergence and performance signals - Disease likelihoods to reduce their insurance burden. Cardiovascular,…

Being able to usefully mine this information out of SNPs is science fiction.

There is abundant literature on SNP data disease correlation.

Here's an example (fictional preview) report from Promethease, which you can run on your SNP data you download from 23andme:

https://files.snpedia.com/reports/promethease_data/genome_Mi...

eg.

> 1.42x risk of Autism

> 1.3x to 11.5x Increased risk of autoimmune thyroid disease

> 1.3x higher risk of ER+ breast cancer

> 2 - 3x higher prostate cancer risk if routinely exposed to the pesticide fonofos

> 1.5x - 2x increased risk for cervical cancer, HNSCC, and breast cancer

> 2x risk of Alzheimer's disease

> Lack of empathy? You have a SNP in the oxytocin receptor which may make you less empathetic than other people.

> Increased risk of Multiple Sclerosis.

> HLA-DRB11501 carrier; higher multiple sclerosis risk Rs3135391(C;T) is highly correlated with the HLA-DRB11501 allele. There is a 3x higher risk of multiple sclerosis associated with the (C;T) genotype.

> 1.4x higher risk of lupus increased risk of Systemic lupus erythematosus.

(And on and on...)

This is stuff that 23andme can't legally show you, and many of the studies are small and inconclusive. But many of the disease markers are noteworthy.

Just click through to the literature, eg.

https://www.snpedia.com/index.php/Rs429358

Re: How to Delete Your 23andMe Data

#44

Post by progmetaldev »

echelon wrote: post #36
a2dam wrote: post #32

Earlier quoted context omitted.

The Genetic Information Nondiscrimination Act makes it illegal to adjust health (but not life) insurance premiums or discriminate for employment based on genetic information. Couples who do genetic testing before having kids have the same protections and they're very effective.

Companies do illegal things all the time . And let me flip this situation: are there any laws that prevent advertisers from looking at genetic data to target cohorts? If I were an unethical advertiser, I'd want to advertise to customers with less risk aversion, higher neuroticism, higher sense of FOMO. You could do some truly sickening stuff. Target higher mortality groups, certain personality types, cross reference…

I'm not sure if there are any current laws that prevent this, but there are quite a few laws that would prevent an advertising company from getting this information. Like most things, if we're going by a company that doesn't work within the law, we're already going to lose.

What's to stop someone within an advertisement company from reaching out to someone in healthcare IT, and offering a large amount of money for this information? Trying to link this physical data to an online presence is probably not worth the risk and amount of money and time (at this current point in time).

All my searching currently shows that there are only laws to protect against using genetics in employment and insurance, within the US. It doesn't look like there are any other protections in the US, other than unrelated laws like HIPAA compliance. I wouldn't even try to pretend to be able to figure out other countries' laws around this (and probably don't understand US law any further than not being able to find information easily available with search tools).

Re: How to Delete Your 23andMe Data

#47

Post by dekhn »

dahinds wrote: post #41
dekhn wrote: post #25

Earlier quoted context omitted.

Providing another company access to deidentified data is "selling your data", to argue otherwise is just semantics. Note that selling deidentified data (genomic, health, etc) is common in the industry already and 23&Me is hardly unique in this respect.

I would not argue with you on that it is "selling your data". But I also think there are meaningful differences in harm levels for different kinds of "selling your data", and fully identified data has more potential harms than de-identified data where you have to assume that an adversary is willing to violate contracts and/or the law to learn about particular individuals. There is considerable confusion about the dis…

I believe we're talking about de-identified individual-level data being sold or shared (https://www.23andme.com/about/individual-data-consent/) in this thread.

I don't think 23andme has been casual or callous with people's data; they are probably a step above the average firm that handles this sort of data. The consent process is well-documented.

My complaint has always been about 23&Me has always been Anne Wojciki's naivete about the utility of genomic data for health treatment, as well as whether her company needed to work with the government (she wrote a useful retrospective that helped shed light: https://hbr.org/2020/09/23andmes-ceo-on-the-struggle-to-get-...).

Most of us who worked in genomics at the time were sort of dumbfounded by her approach and wanted to know what magic she had that let her get as far as she did with the company and its product.

I don't have any problem with the family history side of the product; that's how my dad found out that he had a number of unexpected children (IVF through donated sperm) who were able to connect with him years after their conception. And I really wish disease genetics had turned out to be far more straightforward as I've long been fascinated with how complex phenotypes arise from genomes.

Re: How to Delete Your 23andMe Data

#48

Post by progmetaldev »

echoangle wrote: post #30
echelon wrote: post #22

Earlier quoted context omitted.

Enough to be denied insurance, have job offers rescinded, or be targeted by scams. And they don't even have to have your DNA. Just a close enough relative will do.

> have job offers rescinded, or be targeted by scams Can you expand on this? I understand the insurance thing due to genetic diseases and so on, but which jobs would I be denied for based on genetic information which wouldn’t be checked anyways? I can only come up with stuff like colorblindness but that would probably be checked anyways if it were a strict requirement for the job so keeping the DNA secret wouldn’t he…

I see most comments concentrated on employment. For a scam, think of someone that has been told they have a specific genetic disease, and that information is available in their DNA "data". As a scammer, I can start to send you information about alternative health treatments specific to your disease, that have no scientific backing to them. Since I'm a scammer, I can write anything I want to, like stating that the information is backed by FDA approval and even put statements like that in the fine print to build up my credibility. You could also try and sell fake services that wipe your released DNA information from databases online. There's a lot of potential for scams if you can link what people think is private (DNA), and their email/personal information.

When I was younger, I read a lot of ethics course material, and spent a lot of time thinking about how someone could get around existing laws or technology, and most of it boils down to most people believing what they're told with a bit of coaxing (building that credibility; social engineering). Luckily, I never went ahead using this information, and have actually turned down projects where my morals were put into question, but I think it prepared me to be more conscious of scams and shady advertising. I work for a digital advertising agency, and use an adblocker during my development work so I can see how a site is useful or mostly worthless when someone turns ad networks/tracking off. One of the benefits of working for a smaller company.

Re: How to Delete Your 23andMe Data

#49

Post by tptacek »

echelon wrote: post #43
tptacek wrote: post #40

Earlier quoted context omitted.

Being able to usefully mine this information out of SNPs is science fiction.

There is abundant literature on SNP data disease correlation. Here's an example (fictional preview) report from Promethease, which you can run on your SNP data you download from 23andme: https://files.snpedia.com/reports/promethease_data/genome_Mi... eg. > 1.42x risk of Autism > 1.3x to 11.5x Increased risk of autoimmune thyroid disease > 1.3x higher risk of ER+ breast cancer > 2 - 3x higher prostate cancer risk if r…

You said "IQ, agreeableness, neurodegeneration, schizophrenia [fine, whatever], personality type". Science fiction.

Re: How to Delete Your 23andMe Data

#50

Post by robwwilliams »

echelon wrote: post #36
a2dam wrote: post #32

Earlier quoted context omitted.

The Genetic Information Nondiscrimination Act makes it illegal to adjust health (but not life) insurance premiums or discriminate for employment based on genetic information. Couples who do genetic testing before having kids have the same protections and they're very effective.

Companies do illegal things all the time . And let me flip this situation: are there any laws that prevent advertisers from looking at genetic data to target cohorts? If I were an unethical advertiser, I'd want to advertise to customers with less risk aversion, higher neuroticism, higher sense of FOMO. You could do some truly sickening stuff. Target higher mortality groups, certain personality types, cross reference…

I am trying to think of how genotypes would be used for advertising.

1. Ancestry, but that is about as reliable as a photo and puts a company at far greater legal risk.

2. Actionable SNPs associated with a metabolic oddities. Hmm, that might work for a small number of cases but would probably produce huge backlash.

3. We know who your daddy is. Oh great, thanks so much. I hate you.

Any advertiser going these routes will be running right into a brick wall.

Can you think of plausible scenarios that make someone a buck without legal repercussions and hate mail?

Post reply on HN