Hacker News Reader

Comment by aub3bhat | Hacker News Reader

So on one side journalists lament lack of new drug development & just the shoddy state of healthcare tech, while as soon as any new data that can potentially unlock new drug targets (23andMe) or provider better support (Google DeepMind Health) is introduced, Such efforts are quickly demonized with spread of Fear, Uncertainty and Doubt.

Rather than asking important questions such as at which level the "aggregate" data is shared, or what safeguards exists, the blog post and source "Gizmodo" article is quick to jump gun and spread fear (You are the product / you are being sold!!!). These posts are targeted to derive same emotional response that drive anti-vaxxers / anti-GMO nuts.

View on HN

I just want to pay for a service or product and have that be the end of my interaction with the company as well as the end of the company's use, possession, and monetization of my data. When I buy a stick of gum I deprive the store of that stick of gum in exchange for money. On the Internet I'm purchasing something but the company gets to hold on to and share it indefinitely. It not only benefits from the money exchange but also continues to use the very product they sold me to continue to beef up their profit. Taking my money is apparently just a nice bonus but not what they're really after. I wish the privacy cost was stated in as clear terms at transaction time as the monetary cost, and I believe that users should receive royalties when their data is used for any continued access.

Your genetic data is nearly worthless, even to you, unless the aggregated database exists. The real cost is in the analysis and interpretation not the collection of the data. Thus, for your own benefit (i.e., clear knowledge of your genetic risks), they must monetize your data (i.e., find someone to pay them to perform the analysis, whether drug company or charity, e.g., American Heart Association). As long as they are up front about what they are doing and protecting your identity, your interests and theirs are fairly aligned. I know a study funded by a famous non-profit (you have heard of them, I am sure) that advances the field of study substantially, but it is not yet published (and I am not directly involved).

>Your genetic data is nearly worthless, even to you, unless the aggregated database exists.

It's not about stealing from X or Y individual -- it's about privatizing and locking down an immensely useful and valuable global resource -- that "aggregated database".

> Your genetic data is nearly worthless, even to you...

Apparently Genentech disagreed 60 million times, and twelve other drug/genetics companies disagreed possibly the same number of times.

For only 800k instances of you.

for your own benefit (i.e., clear knowledge of your genetic risks)

It's not at all clear to me that knowledge of my genetic risks is beneficial to me, on balance.

Knowledge of risk is only beneficial if it means something can be done to mitigate that risk. For many diseases this is not the case. However such knowledge could certainly work against me in other ways, such as being denied employment or insurance.

And the privacy of my genetic data is not worth anything to those other parties, but it's sure worth something to me.

What makes you think that's ever existed?

Have you ever entered your phone number or member number at a business for a discount? You think they aren't tracking that? What about just tracking you by some hash of you CC info?

I'm sure there were 19th century New York shopkeepers that noticed a particular influx of specific immigrant nationalities in their shops, and may have inquired further and tailored their goods slightly.

Every good business owner has used info about their customers to improve their business. It's impossible to have a transaction without leaving some information.

This, like most "new" things enabled by technology, is a matter of scale. We need considered and appropriate limitations to protect us, not knee-jerk reactions that actually cause harm because we haven't considered everything.

Personal liberty is important, but it doesn't trump all considerations. If we can actually utilize the information to help research new treatments and further our knowledge of the human body, allowing the collection, and careful protection and anonymozation of the data is for the greater good, and worth the risk Imo.

This is a good thing to legislate though.

Do you really compare DNA and phone numbers? If you want to pay more for insurance, give some company your DNA and install a GPS tracker in your car (provided by the insurance company)... Anyways, for phone numbers, if I don't need to be contacted by a company, I give one of my free number that never rings... they can still track me but...

> > > I just want to pay for a service or product and have that be the end of my interaction with the company as well as the end of the company's use, possession, and monetization of my data.

> Do you really compare DNA and phone numbers?

I think you've let the prior context of the discussion influence your interpretation of my point. My comment had two two main points. First, that we've never really had a system where transactions did not convey some additional information about us, our preferences, and the market (what's more, "my data" is an interesting and often under-explored topic, IMO. If data wants to be free, and you go spreading it around, do you really have a singular claim to it anymore?). Second, there are competing interests of the individual and society when we are talking about aggregating data that might yield substantial benefits for people in general (as in the human race). We've made considerations about this before, such as with vaccination.

I'm not making a case that a private company should be able to keep all info about your genetic makeup and profit from it privately. I am taking a position that we should carefully consider the possible benefits of aggregating genetic info, the possible downsides in loss of privacy and other possible problems, see if there are ways we can increase the benefits and/or decrease the downsides, and try to make an informed decision, with the minimum FUD possible.

> Have you ever entered your phone number or member number at a business for a discount?

But I can choose not to.

"May I have your email for our records?"

"Thanks for asking, but you may not."

> Personal liberty is important, but it doesn't trump all considerations. If we can actually utilize the information to help research new treatments and further our knowledge of the human body, allowing the collection, and careful protection and anonymozation of the data is for the greater good, and worth the risk Imo.

That's fine, and it brings to mind organ donation, but this should be absolutely crystal clear. If I'm giving them my DNA, I want to know exactly how it can be used, how it will be anonymized, to whom they can sell it, whether I can opt out at some point, etc.

Personal liberty absolutely ought to trump considerations here; one reason I haven't sent a DNA sample to 23andMe, etc., is because I can't control what happens to my data after that point, and I'm not even sure if I can find out.

> Personal liberty absolutely ought to trump considerations here;

Not before we actually know what those considerations are. It's prudent to error on the side of caution, but erroring on the side of caution doesn't mean we ignore the issue after that. If there's serious public good that can be brought about, we should investigate that and explore ways it can be achieved acceptably.

> one reason I haven't sent a DNA sample to 23andMe, etc., is because I can't control what happens to my data after that point, and I'm not even sure if I can find out.

Yes, and I agree with this outlook. When I said it would be a good thing to legislate, I meant that we should investigate ways we can implement clear rules such that we can all benefit from the useful medical information while protecting privacy as much as possible. We already do this to some degree in the US with HIPAA laws, which facilitates the sharing of client medical information between medical professionals but also comes with a bunch of very specific safeguards and requirements.

>> > one reason I haven't sent a DNA sample to 23andMe, etc., is because I can't control what happens to my data after that point, and I'm not even sure if I can find out.

https://www.23andme.com/privacy/

Research participation

23andMe offers customers the opportunity to participate in a new way of conducting research (at home and online). Participating in our research is completely voluntary. Customers can choose not to consent to research and doing so will not impact their 23andMe experience.

> If I'm giving them my DNA, I want to know exactly how it can be used, how it will be anonymized, to whom they can sell it, whether I can opt out at some point, etc. ... one reason I haven't sent a DNA sample to 23andMe, etc., is because I can't control what happens to my data after that point, and I'm not even sure if I can find out.

https://www.23andme.com/privacy/#drawer-researchparticipatio...

Customers can opt in or opt out of our research at any time. If you opt out, we will discontinue using your information for research within 30 days.

Do you destroy this information once the owner has chosen to opt out?

The reason I, and I suspect many others, avoid these types of services is the risk of this information being inherited or possessed by an entity that would use this information in ways to which I do would not consent nor approve. This information would not only affect me personally, but also my children.

Germans are more privacy-aware than most for a good reason. I dread a future where an evil government gets a hold of this data and the technology to effectively use it.

Have you ever had more than a minor annoyance result from some company's use of your data? I understand the instinct and ick factor, but I've rarely seen an actual practical consequence.

I've asked this question before and it is typically answered with nothing more than hypothetical "nightmare" scenarios.

there are plenty of situations that only exist in nightmare scenarios. that doesn't make them any less scary. someone brought up seat belts further up, and it's a decent example. why wear a seat belt? it only protects you in nightmare scenarios

Wearing a seatbelt protects you in very real and measurable ways. Crashes happen many thousands of times per year. You can't say the same about your anonymous data being used.

Fatal car crashes are common, and car crashes that would have been fatal without a seatbelt are extremely common.

A seat belt protects you from real & practical scenarios, not just nightmare scenarios.

You wouldn't know what the practical consequences are because you are entirely in the dark where the data goes.

That is kind of the point.

By "practical consequence" I mean "something that has actually happened to you or someone you are aware of," not the worst case scenario of a dystopian vision.

If you get mysteriously denied a job, insurance, etc, you won't necessarily know. In fact, since you give out so much data about yourself so often, it's likely impossible for you to know who sold you out exactly or that you were sold out at all.

(As an aside, it is already illegal in the US to deny someone a job or insurance because of their DNA)

It's not illegal to deny life insurance, AFAIK. And in many cases that's more important than health insurance.

If I'm stricken with a terminal illness, health insurance won't do much for me. Life insurance could mean the difference between my family being OK or really struggling.

I'm not sure how that's relevant on meta data. Life insurance typically requires that you disclose up front if you have a terminal illness, and even if you do they can give you a graded life insurance policy.

FYI the Genetic Information Nondiscrimination Act of 2008 prohibits the use of genetic information in health insurance and employment.

Have you ever had more than a minor annoyance from not wearing a seatbelt?

You could say the same about, for example, the NSA wiretapping your calls and listening in on them. Until you get caught in some bizarre situation as a result, you'll be happily oblivious. But your rights are still being violated.

That data (your profile) is yours, and yours alone. No one has the right to package it and sell it without your consent. Now, it is possible that you may feel gregarious and offer up your data; but that would be by choice.

The amount of harm that a government can do to you is virtually unlimited. The amount of harm most companies can do to you is very small and effectively restricted by the law, even in the very unlikely event that they have some incentive to harm their customers.

The insurance industry's entire profit model is based on harming their customers -- underpaying claims

My impression was their profit model was collecting premiums from a very large number of customers, while only paying out a relatively small number of claims.

Adding to this comment, that's exactly why your rates go up when you get in an accident. Your "trustworthiness" has gone down and the insurance company might have to spend more on you in the long run.

So the logic is that insurance companies intentionally cause accidents for their members, in order to increase premiums and increase their costs?

That doesn't make any sense.

No. My point was that insurance company's profit model is making most of their money off people who don't have accidents and spending some of that on people who do. To recoup the loss after an accident, the insurance company will raise your rate. They're spending more on you, so they want some more from you.

Causing accidents to increase premiums would be pointless and actually cause them to lose money (premiums are almost never more than the actual cost of an accident).

Think of it this way: You have 5 people who pay $100 a month. After 3 months ($1500 profit), Alice causes an accident that costs $500. The insurance company pays for $400 of that and raises Alice's premium by $25. Now, their profit for those 3 months is $1100, but they're also now making $125 a month. That $400 insurance payout is paid for from Alice, Bob, Charlie, David, and Eve's insurance payments totaling $80/person/(3months).

Raised copays are the reason some people don't submit claims. It's a question of "Do I want to pay $300 now, or an extra $25 a month for 2 or 3 years?"

But to say that their profit model is based around causing accidents or paying as little as possible is a complete lie. Sure, insurance companies can be greedy, but their profit model is making money off people who don't have accidents. Paying lesser amounts is just an added "bonus" they get when accidents happen. It's greedy, but that's not the profit model.

Sorry, I was reading in context to tamana's comment above. I know how the industry works, I was thinking that you were trying to explain more on their point, but I see I was wrong. Thanks.

> I wish the privacy cost was stated in as clear terms at transaction time as the monetary cost

Privacy Center link directly from the home page: https://www.23andme.com/privacy/

Full Policy https://www.23andme.com/about/privacy/#Full

This information isn't hard to find--you have to first not assume it doesn't exist I guess.

* Disclosure, former 23andMe employee.

The 23andMe data is amazingly useful for academic research too. I am familiar with a study (but not involved), soon to be published, that used their data to identify genetic variants responsible for a particular problem with pregnancy. The price was phenomenally lower than a more typical genome wide association study (GWAS) of which there are several publicly funded efforts. The results are much cleaner than previous studies simply due to the large number of individuals involved. The privacy controls are very stringent too.

No issue with the fact that it's a convenience sample?

They've also been offering to pharma companies the ability to help find cohorts of patients to make clinical trials much cheaper.

Say we have a drug we think works in a sliver of patients with muscular dystroph; we can either go screen tons of diagnosed patients to find the cohort we think will respond, or we can go ask 23andMe to send some patients with the required genetic profile our way.

Actually from everyone I talked too, 23andMe is pretty useless since they do very shallow sequencing, the amount of actual correlation is fairly low, and false positives and false negatives is actually quite high.

They don't do sequencing at all. What they're doing is using DNA SNP chips which will identify your genotype in the several million positions that tend to vary from person to person.

Although the variant data is sparse, the utility of the data depends on the study design and what is being studied. In the one case that I am familiar with, the data turns out to be very powerful, but there are some things about the study that may be unique.

I don't feel particularly happy seeing a private profit oriented corporation having the DNA data and the results of analysis for millions of people and establishing a market dealing with this data.

In the end it's your life, your defects that could be on sale and determine your worth in a capitalist society. This is scary because you fate is determined by your birth and some algorithmus that may or may not be correct and some statistical chance that you suffer of certain diseases.

From a capitalistic "I want to minimize costs and maximize profit" perspective it's a perfect fit but the results on society are scary.

On the other hand there are clear benefits to have the possibility to prevent the harm caused by diseases or to adjust your life on informed data about possible risks.

However if you life insurance can buy that data from 23andme or your employer you are fucked and all the talk of equality before the law is moot because some DNA data from you prevents you from closing contracts due to "risk mitigation".

I don't know why anyone would belittle criticism in this direction - it's something that needs to be debated.

I thought about using 23andme but this problems stopped me from doing so. This shouldn't be a for profit but these are the times.

ADA already 'prevents' job based discrimination based on DNA.* https://www.ada.gov/

An employer buying DNA on potential job candidates is opening themselves up to a world of litigation for little real gain. Similarly, health insurance may no longer discriminate based on prior health conditions due to the dreaded 'Obama Care'.

We can debate if that's enough, or if these things should be rolled back. However, at a practical level it's currently a non issue.

PS: While most of this is not a significant disability. If people treat DNA condition X as an issue then it fall under "or a person who is perceived by others as having such an impairment. "

Laws can change. Health insurance can't discriminate now, but what happens if Obamacare was repealed, or if the ADA was amended?

An ugly mess happens. Which is why I think people would be asking themselves those questions before repealing Obamacare / breaking ADA. I think there's a limit to which politicians can pull tricks on people beyond which society's self-preservation instinct kicks in and people vehemently repeal harmful ideas. I doubt you can create a dystopian future with a single vote; it needs to be done very sneakily so that people won't notice until it's too late.

All you need is a big enough crisis to get people to support suspension of the normal checks and balances. That can happen very quickly, in the right circumstances.

Obamacare / ACA didn't set that policy, the Genetic Information Nondiscrimination Act of 2008 was passed almost unanimously by Congress and signed into law by George W Bush. It's a very popular, bipartisan policy.

ACA dated back to 1990, GINA acted as clarification in terms of genetic predisposition to developing a disease in the future (potential problems) and specifically excluded life, disability, or long-term care insurance. Which arguably made the situation worse.

Obamacare prevented insurance companies from treating active genetic disorders as preexisting conditions.

> if you life insurance can buy that data from 23andme or your employer you are fucked

https://www.23andme.com/privacy/#drawer-thirdpartysharing

23andMe will not provide any person's data (genetic or non-genetic) to an insurance company or employer.

We have been long-time supporters of legislative efforts intended to prevent genetic discrimination and to safeguard individuals' genetic privacy. In the US specifically, we were active in the development of the Genetic Information Nondiscrimination Act (GINA) enacted in 2008. GINA is federal legislation that protects Americans from discrimination in health insurance and employment decisions on the basis of genetic information. GINA does not cover life or disability insurance providers.

In addition, we have supported the California Genetic Information Nondiscrimination Act (Senate Bill No. 559), which was enacted in 2011.

I really wanted to use 23andme, but they actually prohibit anonymous usage. I know of no place that offers the service I want, which is at minimum like 23andme with anonymity. Add the old-style medical stuff and/or full sequencing for bonus points.

The ideal would be that I can have a friend pay cash in a physical store to get the kit. There is no account. The package includes an ID code that I may look up on the web site to get results, obviously browsing over Tor from borrowed wireless.

Currently, it looks like I'd have to actually buy the equipment myself and sequence my own DNA at home.

I'll keep mentioning it every time I see it, at risk of sounding like a broken record, but why do these types of comments labeling people as "nut jobs" always float to the top of HN posts? Look through all the comments here. There are plenty of reasonable arguments one way or the other for the sharing data. It's not a done deal with everyone on one side of the debate automatically being nut jobs.

Nope. I voluntarily ticked the box on 23andme when it asked me if I was ok to have my dna shared with research institutions to help improve science. But SHARING is not SELLING. I'm NOT ok with them selling it because I think that is unethical of them to charge for something I thought they would give away freely.

>while as soon as any new data that can potentially unlock new drug targets

Unlock new drug targets is a low bar. Unlock new affordable and publicly available, patent unencumbered drug targets is what we want.

It's more about 23andMe advertising that by being a paying customer you will advance science, when what they're doing is selling your data to pharma companies.

I'm a 23andme customer and the aggregate data being used like this is exactly what I expected and is a big part of the reason I signed up.

There is a lot I don't love about Pharma companies, but when they use this data to develop or better target drugs, they are advancing science.

Wouldn't you prefer if 23andMe to offer the data to all scientists and not only pharma companies paying millions?

> Wouldn't you prefer if 23andMe to offer the data to all scientists and not only pharma companies paying millions?

Why do you assume 23andMe doesn't?

https://mediacenter.23andme.com/academic-research-collaborat...

"The 23andMe Academic Research Collaboration Program allows academic researchers to access de-identified, aggregated data from the 23andMe database."

Or people don't like their DNA being used for something beyond what they paid for? After all, the customers paid 23andme for a service.

Then they can not opt-in to research. But continuing personalized results are also what you pay them (or Promethease) for.

http://i.imgur.com/kh3bOi8.jpg

> spread of Fear, Uncertainty and Doubt

I agree with your comment but, what's with the capitalization of these words?

Its typically abbreviated as FUD.

https://en.m.wikipedia.org/wiki/Fear,_uncertainty_and_doubt

These blog posts are designed to generate clicks sadly.

"Fear, Uncertainty and Doubt"

About what?

Privacy?

The blog entry is focused on monetization, not privacy.

23 also has a deal with Pfizer.

And they have hired people, e.g., from Genentech, that will help them try some drug discovery research themselves.

But does anyone outside the company seriously believe this is going to lead to anything? They are not a therapeutics company.

They are a data broker.

Why not just submit DNA samples directly to a drug company instead of a data broker?

The only thing we can call "shoddy" here is 23andme's original business model: selling genetic test results. The question some are asking is whether they knew that when they started.

With the collected data, they now have value. There will be buyers.

Whether that value is ever passed on to patients is less certain.

Reply on news.ycombinator.com