> We will not sell, lease, or rent your individual-level information (i.e., information about a single individual's genotypes, diseases or other traits/characteristics) to any third-party or to a third-party for research purposes without your explicit consent.
(https://www.23andme.com/about/privacy/)
I would really hope other sites like ancestry.com have the same policy.
Similar to Google, 23&me as a viable business operation is predicated on monetizing genetic information. They're performing testing at a loss in order to collect as much as possible.
Consequently, whatever their policy may be, I have little faith they'll make a privacy-centric decision for me as an individual when faced with a business choice. Their valuation essentially depends on their not doing so!
Also, when you say "I have little faith they'll make a privacy-centric decision when faced with a business choice", you make it sound like you think they'll intentionally violate their privacy policy in order to make money, but, and IANAL so maybe I'm wrong, I thought privacy policies like this were in fact legally binding, and if they decide to start selling PII info we can sue them?
This has never been tested in court and so the "bindingness" of privacy policies is ambiguous (see http://lawprofessors.typepad.com/contractsprof_blog/2010/08/...). Even in the best-case, if you wanted to have standing to sue for a privacy policy violation, you'd have to prove not just that it happened, but that you were materially harmed by it, which is a tough hurdle to clear.
But that's all moot anyway, since privacy policies can be changed at any time. If a company wants to violate their existing policy, they just change it first.
"We promise to anonymizing your data, but we will sell it" is a huge gray area.
Are there legal standards for anonymizing data? To what degree? What type of protections are required for the un-anonymized data 23&me holds on their servers? What about any mapping data that allows anonymous products to be deanonymized? What obligations is 23&me under in regards to any future data products they offer with remixed data? What happens if their data products are found to expose individuals via third party information unmasking or statistical attacks? Am I entitled to be made aware of products 23&me sells that include my anonymizing data? If not, and it's custom deals struck in a backroom, how am I able to ensure any anonymization meets my standards? Etc.
In general, I don't mean to say that 23&me has a bad privacy policy. They simply have one written by lawyers in the interest of the company's value and flexibility, while at the same time allay fears over information disclosure.
Personally, I'd like a higher standard for somewhere that stores my genetic information. Especially if a company's interests are at odds with mine ('If you're not paying, you are the product,' etc).
Phrasing like, "We may provide additional notice and ask for your consent if we wish to share your information with our commonly owned entities in a materially different way than discussed in this Privacy Statement" creeps the hell out of me.
Especially if they end up getting re-absorbed into the Google family as a backdoor to collecting genetic information with less risk to Alphabet.