Hacker News Reader

Comment by krisdol | Hacker News Reader

I just want to pay for a service or product and have that be the end of my interaction with the company as well as the end of the company's use, possession, and monetization of my data. When I buy a stick of gum I deprive the store of that stick of gum in exchange for money. On the Internet I'm purchasing something but the company gets to hold on to and share it indefinitely. It not only benefits from the money exchange but also continues to use the very product they sold me to continue to beef up their profit. Taking my money is apparently just a nice bonus but not what they're really after. I wish the privacy cost was stated in as clear terms at transaction time as the monetary cost, and I believe that users should receive royalties when their data is used for any continued access.

View on HN

What makes you think that's ever existed?

Have you ever entered your phone number or member number at a business for a discount? You think they aren't tracking that? What about just tracking you by some hash of you CC info?

I'm sure there were 19th century New York shopkeepers that noticed a particular influx of specific immigrant nationalities in their shops, and may have inquired further and tailored their goods slightly.

Every good business owner has used info about their customers to improve their business. It's impossible to have a transaction without leaving some information.

This, like most "new" things enabled by technology, is a matter of scale. We need considered and appropriate limitations to protect us, not knee-jerk reactions that actually cause harm because we haven't considered everything.

Personal liberty is important, but it doesn't trump all considerations. If we can actually utilize the information to help research new treatments and further our knowledge of the human body, allowing the collection, and careful protection and anonymozation of the data is for the greater good, and worth the risk Imo.

This is a good thing to legislate though.

> Have you ever entered your phone number or member number at a business for a discount?

But I can choose not to.

"May I have your email for our records?"

"Thanks for asking, but you may not."

> Personal liberty is important, but it doesn't trump all considerations. If we can actually utilize the information to help research new treatments and further our knowledge of the human body, allowing the collection, and careful protection and anonymozation of the data is for the greater good, and worth the risk Imo.

That's fine, and it brings to mind organ donation, but this should be absolutely crystal clear. If I'm giving them my DNA, I want to know exactly how it can be used, how it will be anonymized, to whom they can sell it, whether I can opt out at some point, etc.

Personal liberty absolutely ought to trump considerations here; one reason I haven't sent a DNA sample to 23andMe, etc., is because I can't control what happens to my data after that point, and I'm not even sure if I can find out.

> If I'm giving them my DNA, I want to know exactly how it can be used, how it will be anonymized, to whom they can sell it, whether I can opt out at some point, etc. ... one reason I haven't sent a DNA sample to 23andMe, etc., is because I can't control what happens to my data after that point, and I'm not even sure if I can find out.

https://www.23andme.com/privacy/#drawer-researchparticipatio...

Customers can opt in or opt out of our research at any time. If you opt out, we will discontinue using your information for research within 30 days.

Do you destroy this information once the owner has chosen to opt out?

The reason I, and I suspect many others, avoid these types of services is the risk of this information being inherited or possessed by an entity that would use this information in ways to which I do would not consent nor approve. This information would not only affect me personally, but also my children.

Germans are more privacy-aware than most for a good reason. I dread a future where an evil government gets a hold of this data and the technology to effectively use it.

> Personal liberty absolutely ought to trump considerations here;

Not before we actually know what those considerations are. It's prudent to error on the side of caution, but erroring on the side of caution doesn't mean we ignore the issue after that. If there's serious public good that can be brought about, we should investigate that and explore ways it can be achieved acceptably.

> one reason I haven't sent a DNA sample to 23andMe, etc., is because I can't control what happens to my data after that point, and I'm not even sure if I can find out.

Yes, and I agree with this outlook. When I said it would be a good thing to legislate, I meant that we should investigate ways we can implement clear rules such that we can all benefit from the useful medical information while protecting privacy as much as possible. We already do this to some degree in the US with HIPAA laws, which facilitates the sharing of client medical information between medical professionals but also comes with a bunch of very specific safeguards and requirements.

>> > one reason I haven't sent a DNA sample to 23andMe, etc., is because I can't control what happens to my data after that point, and I'm not even sure if I can find out.

https://www.23andme.com/privacy/

Research participation

23andMe offers customers the opportunity to participate in a new way of conducting research (at home and online). Participating in our research is completely voluntary. Customers can choose not to consent to research and doing so will not impact their 23andMe experience.

Do you really compare DNA and phone numbers? If you want to pay more for insurance, give some company your DNA and install a GPS tracker in your car (provided by the insurance company)... Anyways, for phone numbers, if I don't need to be contacted by a company, I give one of my free number that never rings... they can still track me but...

> > > I just want to pay for a service or product and have that be the end of my interaction with the company as well as the end of the company's use, possession, and monetization of my data.

> Do you really compare DNA and phone numbers?

I think you've let the prior context of the discussion influence your interpretation of my point. My comment had two two main points. First, that we've never really had a system where transactions did not convey some additional information about us, our preferences, and the market (what's more, "my data" is an interesting and often under-explored topic, IMO. If data wants to be free, and you go spreading it around, do you really have a singular claim to it anymore?). Second, there are competing interests of the individual and society when we are talking about aggregating data that might yield substantial benefits for people in general (as in the human race). We've made considerations about this before, such as with vaccination.

I'm not making a case that a private company should be able to keep all info about your genetic makeup and profit from it privately. I am taking a position that we should carefully consider the possible benefits of aggregating genetic info, the possible downsides in loss of privacy and other possible problems, see if there are ways we can increase the benefits and/or decrease the downsides, and try to make an informed decision, with the minimum FUD possible.

Your genetic data is nearly worthless, even to you, unless the aggregated database exists. The real cost is in the analysis and interpretation not the collection of the data. Thus, for your own benefit (i.e., clear knowledge of your genetic risks), they must monetize your data (i.e., find someone to pay them to perform the analysis, whether drug company or charity, e.g., American Heart Association). As long as they are up front about what they are doing and protecting your identity, your interests and theirs are fairly aligned. I know a study funded by a famous non-profit (you have heard of them, I am sure) that advances the field of study substantially, but it is not yet published (and I am not directly involved).

>Your genetic data is nearly worthless, even to you, unless the aggregated database exists.

It's not about stealing from X or Y individual -- it's about privatizing and locking down an immensely useful and valuable global resource -- that "aggregated database".

> Your genetic data is nearly worthless, even to you...

Apparently Genentech disagreed 60 million times, and twelve other drug/genetics companies disagreed possibly the same number of times.

For only 800k instances of you.

for your own benefit (i.e., clear knowledge of your genetic risks)

It's not at all clear to me that knowledge of my genetic risks is beneficial to me, on balance.

Knowledge of risk is only beneficial if it means something can be done to mitigate that risk. For many diseases this is not the case. However such knowledge could certainly work against me in other ways, such as being denied employment or insurance.

And the privacy of my genetic data is not worth anything to those other parties, but it's sure worth something to me.

Have you ever had more than a minor annoyance result from some company's use of your data? I understand the instinct and ick factor, but I've rarely seen an actual practical consequence.

You could say the same about, for example, the NSA wiretapping your calls and listening in on them. Until you get caught in some bizarre situation as a result, you'll be happily oblivious. But your rights are still being violated.

That data (your profile) is yours, and yours alone. No one has the right to package it and sell it without your consent. Now, it is possible that you may feel gregarious and offer up your data; but that would be by choice.

The amount of harm that a government can do to you is virtually unlimited. The amount of harm most companies can do to you is very small and effectively restricted by the law, even in the very unlikely event that they have some incentive to harm their customers.

The insurance industry's entire profit model is based on harming their customers -- underpaying claims

My impression was their profit model was collecting premiums from a very large number of customers, while only paying out a relatively small number of claims.

Adding to this comment, that's exactly why your rates go up when you get in an accident. Your "trustworthiness" has gone down and the insurance company might have to spend more on you in the long run.

So the logic is that insurance companies intentionally cause accidents for their members, in order to increase premiums and increase their costs?

That doesn't make any sense.

No. My point was that insurance company's profit model is making most of their money off people who don't have accidents and spending some of that on people who do. To recoup the loss after an accident, the insurance company will raise your rate. They're spending more on you, so they want some more from you.

Causing accidents to increase premiums would be pointless and actually cause them to lose money (premiums are almost never more than the actual cost of an accident).

Think of it this way: You have 5 people who pay $100 a month. After 3 months ($1500 profit), Alice causes an accident that costs $500. The insurance company pays for $400 of that and raises Alice's premium by $25. Now, their profit for those 3 months is $1100, but they're also now making $125 a month. That $400 insurance payout is paid for from Alice, Bob, Charlie, David, and Eve's insurance payments totaling $80/person/(3months).

Raised copays are the reason some people don't submit claims. It's a question of "Do I want to pay $300 now, or an extra $25 a month for 2 or 3 years?"

But to say that their profit model is based around causing accidents or paying as little as possible is a complete lie. Sure, insurance companies can be greedy, but their profit model is making money off people who don't have accidents. Paying lesser amounts is just an added "bonus" they get when accidents happen. It's greedy, but that's not the profit model.

Sorry, I was reading in context to tamana's comment above. I know how the industry works, I was thinking that you were trying to explain more on their point, but I see I was wrong. Thanks.

You wouldn't know what the practical consequences are because you are entirely in the dark where the data goes.

That is kind of the point.

By "practical consequence" I mean "something that has actually happened to you or someone you are aware of," not the worst case scenario of a dystopian vision.

If you get mysteriously denied a job, insurance, etc, you won't necessarily know. In fact, since you give out so much data about yourself so often, it's likely impossible for you to know who sold you out exactly or that you were sold out at all.

(As an aside, it is already illegal in the US to deny someone a job or insurance because of their DNA)

It's not illegal to deny life insurance, AFAIK. And in many cases that's more important than health insurance.

If I'm stricken with a terminal illness, health insurance won't do much for me. Life insurance could mean the difference between my family being OK or really struggling.

I'm not sure how that's relevant on meta data. Life insurance typically requires that you disclose up front if you have a terminal illness, and even if you do they can give you a graded life insurance policy.

FYI the Genetic Information Nondiscrimination Act of 2008 prohibits the use of genetic information in health insurance and employment.

Have you ever had more than a minor annoyance from not wearing a seatbelt?

I've asked this question before and it is typically answered with nothing more than hypothetical "nightmare" scenarios.

there are plenty of situations that only exist in nightmare scenarios. that doesn't make them any less scary. someone brought up seat belts further up, and it's a decent example. why wear a seat belt? it only protects you in nightmare scenarios

Wearing a seatbelt protects you in very real and measurable ways. Crashes happen many thousands of times per year. You can't say the same about your anonymous data being used.

Fatal car crashes are common, and car crashes that would have been fatal without a seatbelt are extremely common.

A seat belt protects you from real & practical scenarios, not just nightmare scenarios.

> I wish the privacy cost was stated in as clear terms at transaction time as the monetary cost

Privacy Center link directly from the home page: https://www.23andme.com/privacy/

Full Policy https://www.23andme.com/about/privacy/#Full

This information isn't hard to find--you have to first not assume it doesn't exist I guess.

* Disclosure, former 23andMe employee.

Reply on news.ycombinator.com