Hacker News Reader

Comment by enomar | Hacker News Reader

I'd like to hear from those that wouldn't do this. What are your reasons for not trusting this site?

Well, today they're 23andme, arguably in fairly rough waters (which is probably the reason for this promotion in the first place).

Tomorrow they could be sold to the highest bidder, who might not feel they were bound to the terms of service of their predecessor. It could be an insurance company, for instance. And based on your name, your genetic data and a whole bunch of other factors they might decide to deny you or one of your descendants coverage.

That's just one scenario, I'm sure there are plenty of others with various degrees of chance of becoming reality.

For an insurer to deny coverage based on genetic information has been against the law in the US for almost 2 years http://www.genome.gov/10002077.

Also, there are health benefits to sharing your genetic information and comparing it with others since the extent of genetic variation within the general population is not currently well understood becuase of limited data. Over time it is also likely that knowledge of your genetic information will become directly more relevant to your health, though, this is not currently the case. I agree that some form anonymizing procedure should be in place.

From the 23andme website:

"You should be careful about sharing your genetic information with others. Currently, very few businesses or insurance companies request genetic information, but this could change in the future. While the Genetic Information Nondiscrimination Act was signed into law in the United States in 2008, the protection it will provide against discrimination by employers and health insurance companies for employment and coverage issues has not been clearly established."

So it's a law but there has not been any test of this. Let's hope the law holds up.

How do you know why an insurer denies you coverage?

The way you prove any corporate crime. Evidence would have to be obtained that the insurer acquired genetic information and then terminated coverage for individuals it perceived as high risk. This would likely involve many people from within the company. You would have to count on one of them to provide the evidence.

Part of me thinks the nature of the information would open a raft of legal trouble if they were to use it contrary to the initial terms of service.

Also, while your name may be on the credit card used to pay for the test, and even on the test package with the saliva, since this is being done via the mail there is no way to prove it's really your DNA.

Were an insurance company to deny you based on this you could claim that you just put your name on it for convenience sake, but it really was for a friend who was concerned about using their real name because of possible abuse of DNA information.

Wouldn't they be tied to the agreement that you had when you signed up for the data? I always thought that you'd have to agree with new "terms-of-use" whenever they change

Just to give you an example, I just bought at an auction the complete contents of a defunct company. Amongst the stuff I got was their servers and their bookkeeping. I never entered in to any agreement with the people whose data is stored on those servers, and yet I have all of it.

A 'survival clause' that would guarantee destruction of your data in case the company goes out of business would be a minimum here.

But instead, 23andme says in their privacy policy:

"We may use Genetic and Phenotypic Information to conduct 23andMe-authorized scientific research and development. Any Phenotypic Information you provide is done on a voluntary basis. We may provide third party organizations access to this information for scientific research, but without your name or any other Account Information."

And that's the kicker, so your full genome gets sold to some 3rd party (you don't even get to know who) and all they do is strip off the 'meta data' regarding your person.

And AOL and NETFLIX have already shown that anonymization of data is a myth.

Looks like they do have a 'survival clause' in their privacy statment:

Business Transitions

In the event that 23andMe goes through a business transition such as a merger, acquisition by another company, or sale of all or a portion of its assets, your personal information and non-personal information will likely be among the assets transferred. You will be notified in advance via email and prominent notice on our website of any such change in ownership or control of your personal information. We will require an acquiring company or merger agreement to uphold the material terms of this privacy statement, including honoring requests for account deletion.

Good for them, that's a step in the right direction, but once your data is then in the hands of party #2 the whole thing starts all over again.

And what about all those companies that have received copies of your genetic data from 23andme in the meantime, and their survival clauses?

I don't think it is possible to do this in a watertight way.

edit, long after the edit term expired, how would that survival clause be handled in the case of a bankruptcy?

The potential upside of this type of research is worth the risk of loss of anonymity. I would post my genome to a public website if it would help advance medical science.

[Disclosure: I participated in public health genomics research in grad school.]

I agree with your sentiment in general, not your specific arguments though. First, they're only talking about research, not about selling data. Secondly, I don't think your comparison to AOL and Netflix is valid. AOL users were identifiable by googling their own name etc. How is one supposed to identify you when all there is is your DNA and nothing else, which has never been saved anywhere else at all?

Your DNA is half your parents', and your childrens DNA is half yours. Given a sufficiently large number of datapoints you can work out the DNA of those in between. And given a few 'confirmed' identities you could use that more complete picture to work out the identities of the rest, even if you did not know their names.

Your DNA is your identity. It just hasn't been tied to the meta data of your name, address and social security number, but again, with a bunch of confirmed identities of relatives that is a job that is probably doable.

In a far off future, where enough DNA data is publicly (!) available, that may be the case. Until then, to which data set should any company compare my DNA to find out who I am?

23andme is collecting data at a fair rate, there are other companies like them. Pooling the data between all those companies is going to allow you to fill in a bunch of 'blanks'. At some point that will reach critical mass and you can map the remainder.

I'm not good enough at math to give you the percentage of a certain population in order to be able to infer the rest, maybe someone else here can do that.

But given a population size 'n' if you get a random distribution of individuals and you know their genes and you know have a graph of relationships (say through facebook or some other means of tracing links between people) you should be able to make a formula that tells you what kind of 'coverage' you can expect based on how large a sample.

I'd argue that this is what makes 23andme interesting. Without that capability, it's a toy for rich people.

First of all, today, this is not full genome information, just your genotype. Second, if we want good molecular medicine, information like this is essential (some might argue the only way) to get good sampling and do the appropriate research.

Addendum since I can't reply to the comment. They don't quite have the technology on hand today to do full genome analysis today. I am not sure there is enough material to do whole genome sequencing with current technology (I could be wrong).

> this is not full genome information, just your genotype.

That's what they give you. But you give them your full genome.

First, to clear up some misunderstandings, your genome is your genotype. They mean the same thing. Also, what 23andme is offering isn't a complete sequence of your genetic code (at least not for $100). The current estimated price is for a complete sequence is about $10,000 to $100,000 (it's come down a lot recently, but it is still beyond the finances of most people). What they are actually doing is mapping certain known locations in the human genome, known as SNPs (single-nucleotide polymorphisms), and seeing what variation you have there. Some diseases are due to a changes in a single gene (for example cystic fibrosis is due to a mutation in a membrane channel), so one SNP they map is the location of the typical mutations in this gene. Other diseases have high correlations to certain combinations of nearby SNPs, and so these can be predictive. It is basically like a world map where the genetic code is on the level of city blocks, but all you have on your map is the location of random streets around the world.

Yes, you're right, sorry about the confusion. The point I was trying to make was they give you the 'limited' version, but you give them everything. They may not sequence it all today but they could do so in the future (I'm assuming they keep copies), and they could sell your samples to parties that can sequence it all (today or in the future).

From their privacy policy (https://www.23andme.com/legal/privacy/) it seems they destroy the sample after generating the SNP map (Personal Info section, Genetic Info subsection paragraph 1).

You're right. I missed that, they contract out the sequencing though.

You seem to be pretty knowledgeable here, how much information is still present in those SNP maps (in terms of bits per person)? Would an SNP map still uniquely identify an individual ?

It depends on how many SNPs (read as 'snip') they map and how much variation is at each site. It basically boils down to a combinatorial counting problem, although there is the complication that variation across close SNPs might not be independent (especially if they are on the same gene, or are related in some phenotypic way).

This is also the basis for DNA forensics/paternity tests. If you sample enough SNP locations you should theoretically have a unique signature (this is where you get the courtroom statistic of 1 in 3 million)

A bit after the fact, but apparently they have the option to 'biobank' your saliva, which means they store it for the longer term. It would be interesting to know how many people use that option.

Remember that one of the key investors is Sergey Brin, so "Don't be evil" would apply to 23andMe. Sergey is married to the co-founder of 23andMe, Anne Wojcicki.

"Don't be evil" is at this point no more than a marketing slogan and I really don't see how it would apply to 23andme.

Read their privacy policy first, then decide if you think that 23andme does not explicitly hold open the door to do 'evil'.

edit: afterthought, in fact, any company associated with Google in that way would probably be the last party to give even more private information to, they have enough, if not too much, already.

Out of honest curiosity, is it a matter of principle for you, or do you really feel harmed by anything companies have done with your private data? Is it a worry about future harm?

It's mostly about potential, not about stuff done to me.

The EU now requires fingerprints to be given with your passport application, and the Netherlands, the country where I live has added a little goodie, they're going to keep one nice big fat file with all the prints in them, in case your future self commits some crime (of course, ostensibly that's not what it is for, it is to prevent the (scary sounds) terrorists from getting passports).

Stuff like this tends to end bad, and the easiest way to avoid bad endings is to be very careful at the beginning.

I can imagine all kinds of ways in which data like this could be misused, every year there are huge breaches of the public trust with sensitive data, be it credit cards, social security numbers, 'anonymized' releases, rogue employees and so on.

It's only a matter of time before some big time problem will arise out of a DNA database and I think to caution people to not send out their data without due consideration of the possible consequences is irresponsible. What surprises me most is how the hacker community seems to be fairly gung ho about this, and rushes to take advantage of this 'bargain'.

I'm considering not renewing my passport simply because I don't want to be a 'potential suspect' in every future crime on european soil. Of course, that will make me even more of a suspect for every past crime but that's just too bad.

Sending my DNA off to some commercial third party for 'analysis' and resale (at least they're nice about that bit, they mention it in their policy) is one of the last things I would do.

Thanks for your well-articulated comments in this thread. I am glad someone is sticking up for the opposing view.

People don't want them to grow a clone from their DNA and then having the clone replace them like in that the 6th day schwarznegger movie.

I'd actually be happy if people started randomly cloning me. Increased reproductive success and I didn't even have to do anything!

I'd file that one - for now - under the 'less likely' scenarios.

Right alongside the 'genetic bullet' and the 'genocide by gene' folders.

Reply on news.ycombinator.com