Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

23andMe is out of bankruptcy and it still hasn’t substantially changed its ways

washingtonpost.com

Post reply on HN
Print view View original

61–70 of 91 posts

Re: 23andMe is out of bankruptcy and it still hasn’t substantially changed its ways

#61

Post by chha »

FirmwareBurner wrote: post #53
vintermann wrote: post #51

Earlier quoted context omitted.

Well, GDPR compliance is one thing. It could be very expensive if you have European customers and get caught doing this.

If they don't have any offices or assets in Europe, then the EU can't do anything against them for breaking GDPR.

Sure they can. GDPR article 2 (2) says:

«This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union;»

So the GDPR applies. The EU can of course sanction violators outside, but given the current political climate it is likely to be more difficult than before.

Re: 23andMe is out of bankruptcy and it still hasn’t substantially changed its ways

#62

Post by FirmwareBurner »

chha wrote: post #61
FirmwareBurner wrote: post #53

Earlier quoted context omitted.

If they don't have any offices or assets in Europe, then the EU can't do anything against them for breaking GDPR.

Sure they can. GDPR article 2 (2) says: «This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union;» So the GDPR applies. The EU can…

>Sure they can. GDPR article 2 (2) says:

No they can't. That says only about where the law applies, it doesn't say about prosecution of entities not residing in the EU. EU's legal arm can't extent outside the boarders of the EU, without an outright military invasion, it's toothless to foreign entities.

>So the GDPR applies.

I never said it doesn't apply. I said how is the EU gonna prosecute an entity that doesn't reside in the EU?

Extraditions are tough to negotiate even for serious stuff like murder. No foreign judge will take GDPR violations seriously to do that.

Re: 23andMe is out of bankruptcy and it still hasn’t substantially changed its ways

#63

Post by lotsofpulp »

Terr_ wrote: post #47
cm2187 wrote: post #46

Earlier quoted context omitted.

The paradox is that the better insurance companies are at pricing risk, the more irrelevant their business becomes. If they can predict your disease with 100% reliability, and charge you based on that, then what is the point of buying insurance if you are going to be charged either nothing or the full cost of the treatment, just like if you were not insured. Except of course in the US, with scammy hospitals charging…

I think that conflates accurate probabilities with predicting discrete future events. For example, suppose you can accurately determine that someone has exactly a 5% chance of developing a problem that will cost exactly $X to treat. Find 10,000 of those people, and insurance is still useful for spreading the risk and financing the treatments.

Health problems and healthcare is not that simple. Almost everyone will experience healthcare issues in their life, so the insurance becomes more of a subsidy mechanism to time shift costs from one population to another (which at some point becomes indistinguishable from taxpayer funded healthcare, just with a different administrator).

Also, legislation requires health insurance to pay for all healthcare, so there is no point paying to insure against specific ailments.

Re: 23andMe is out of bankruptcy and it still hasn’t substantially changed its ways

#64

Post by chha »

FirmwareBurner wrote: post #62
chha wrote: post #61

Earlier quoted context omitted.

Sure they can. GDPR article 2 (2) says: «This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union;» So the GDPR applies. The EU can…

>Sure they can. GDPR article 2 (2) says: No they can't. That says only about where the law applies, it doesn't say about prosecution of entities not residing in the EU. EU's legal arm can't extent outside the boarders of the EU, without an outright military invasion, it's toothless to foreign entities. >So the GDPR applies. I never said it doesn't apply. I said how is the EU gonna prosecute an entity that doesn't res…

Sorry for that, guess I'm just too used to the common misconception some people have that the GDPR doesn't apply if a company isn't established in the EU.

In this case 23andMe is on the Data Privacy Framework list, so they have volunteered to follow the GDPR while still being based in the US. This is basically the same as a number of other GDPR cases, including the GDPR fine against Clearview AI. Fining 23andMe if they violate GDPR should be trivial in that case.

Re: 23andMe is out of bankruptcy and it still hasn’t substantially changed its ways

#65

Post by chha »

grues-dinner wrote: post #45
ks2048 wrote: post #11

I do worry about my data with them, but when I think about the worst-case scenario - you will not get insured (or have high rates) because you have {some genetic condition}.. it seems just as likely that they will simply require my DNA to apply for insurance. (or get my DNA from a blood test within their system, etc.). The obvious solution is with legislation for transparency and better health care system.

Things like financial and medical data should be required to have an audit log that you can see, in real-time and subscribe to updates for, including extraction into "anonymised" formats, along with a description of that process, format and a justification for why it is robust against deanonymisation. If data is handled well, there is nothing to fear here. Fiddly, perhaps. Expensive, probably. But personal data proce…

> Deliberately extracting personal data into un-audited environments without good reason (eg printing a label for shipping), should be punished with GDPR-style global turnover-based penalties and jail for those responsible.

There already are, but only for Europeans through the GDPR.

Re: 23andMe is out of bankruptcy and it still hasn’t substantially changed its ways

#66

Post by [deleted] »

kstrauser wrote: post #7
seanvelasco wrote: post #4

i'm curious, what's the worst-case scenario if one were to put their whole DNA data exposed publicly? would a future civilization re-make your image? or are there societal benefits?

For example, long-term care, and disability insurance aren’t blocked at the federal level from discrimination based on DNA. If they suspect you might get bad arthritis some day, they can block you from insurance (barring state laws saying otherwise).

[deleted]

Re: 23andMe is out of bankruptcy and it still hasn’t substantially changed its ways

#68

Post by vintermann »

FirmwareBurner wrote: post #62
chha wrote: post #61

Earlier quoted context omitted.

Sure they can. GDPR article 2 (2) says: «This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union;» So the GDPR applies. The EU can…

>Sure they can. GDPR article 2 (2) says: No they can't. That says only about where the law applies, it doesn't say about prosecution of entities not residing in the EU. EU's legal arm can't extent outside the boarders of the EU, without an outright military invasion, it's toothless to foreign entities. >So the GDPR applies. I never said it doesn't apply. I said how is the EU gonna prosecute an entity that doesn't res…

EU will presumably stop you from doing business in the EU, if you break EU laws and ignore judgments. Companies don't want that. Grindr LLC, a US company with no EU corporate presence as far as I know, was fined 6.5 million for breaching GDPR by an Oslo Court, upheld in appeals. They paid that fine. If they didn't, they'd probably be kicked out of the app stores from Norway (if not from all of EU). Apple and Google do have an EU presence. Even if they didn't, they wouldn't start a war over 23andMe.

We generally don't need to worry about EU judgments against US companies being enforced, or vice versa. It doesn't get far enough that we need to think about how it's going to be enforced as a practical matter.

Re: 23andMe is out of bankruptcy and it still hasn’t substantially changed its ways

#69

Post by cm2187 »

Terr_ wrote: post #47
cm2187 wrote: post #46

Earlier quoted context omitted.

The paradox is that the better insurance companies are at pricing risk, the more irrelevant their business becomes. If they can predict your disease with 100% reliability, and charge you based on that, then what is the point of buying insurance if you are going to be charged either nothing or the full cost of the treatment, just like if you were not insured. Except of course in the US, with scammy hospitals charging…

I think that conflates accurate probabilities with predicting discrete future events. For example, suppose you can accurately determine that someone has exactly a 5% chance of developing a problem that will cost exactly $X to treat. Find 10,000 of those people, and insurance is still useful for spreading the risk and financing the treatments.

At 5% you are still loosely predicting a disease, but with progress in generics you may be one day predicting with a 80% accuracy. The insurance premium will converge to cost of treatment.

Re: 23andMe is out of bankruptcy and it still hasn’t substantially changed its ways

#70

Post by sidewndr46 »

lotsofpulp wrote: post #63
Terr_ wrote: post #47

Earlier quoted context omitted.

I think that conflates accurate probabilities with predicting discrete future events. For example, suppose you can accurately determine that someone has exactly a 5% chance of developing a problem that will cost exactly $X to treat. Find 10,000 of those people, and insurance is still useful for spreading the risk and financing the treatments.

Health problems and healthcare is not that simple. Almost everyone will experience healthcare issues in their life, so the insurance becomes more of a subsidy mechanism to time shift costs from one population to another (which at some point becomes indistinguishable from taxpayer funded healthcare, just with a different administrator). Also, legislation requires health insurance to pay for all healthcare, so there is…

This isn't really true in the US, I have specific policies that insure me against other types of illness. They pay directly to me in the form of a predetermined cash settlement in the event of a diagnosis.
Post reply on HN