Hacker News Reader

Comment by missosoup | Hacker News Reader

Yes but no.

https://time.com/5349896/23andme-glaxo-smith-kline/

While 23andMe has technically adhered to the original terms of service, they've been sharing your data without your consent with their new parent firms like pharma giant GSK (the same one described in this article) which purchased partial ownership of the company and therefore ownership of the data. You see, giving data to your parent firm is not technically giving data to a third party. This was the business model all along. The 'customers' were the product, and the real customers were pharmaco.

Getting the products (you) to pay for the cost of their own sequencing so the data is effectively free was a stroke of genius. Not only are you giving away incredibly valuable data about yourself only a tiny fraction of which is returned back to you in the form of a report, you're paying for the cost to collect it. It's brilliant.

You've been duped by the dupe that everyone saw coming.

View on HN

I don't see how that article supports the claim that you are making. From the article

> A 23andMe spokesperson told TIME that data privacy is a “top priority” for the company, emphasizing that customer data isn’t used in research without consent, and that GlaxoSmithKline will only receive “summary statistics from analyses 23andMe conducts so that no single individual can be identified.”

Also, if I buy some shares in Amazon I don't get have all their client data.

Amazon is a publicly traded company. How does that compare to 23andMe?

There are obvious loopholes to the statement “no single individual can be identified”.

Shareholders are still shareholders even if the company is not publicly traded/listed. GSK is a shareholder of 23andMe - not it's parent company. 23andMe is not a subsidiary of GSK. GSK does not even own a majority share in 23andMe:

https://www.gsk.com/media/5349/annual-report-2018.pdf

> 23andMe in which the Group holds 14.5%.

You can also find a list of subsidiaries of GSK in there and you will note that 23andMe is not listed among them.

GSK invested $300 million into 23andMe and created an exclusive collaboration agreement [1]. To be clear, these things happened together, one doesn't exist without the other.

If a publicly traded-company has more than 5% of outstanding shares owned by a single entity, they have to file an SEC Form 13D. This is a typical cut-off to indicate an activist investor [2]. Far less than the 14.5% GSK owns. Without knowing who owns the other 85.5% of 23andMe (or visibility into their board and voting structure), we have no idea who controls the company.

You would need to spend about $44 billion to own 5%, or 24.8 million shares, of Amazon. I'm still not clear on how GSK's purchase of 14.5% of 23andMe along with the exclusive agreement that came with it is the same as buying a single share of Amazon stock.

[1] https://www.cnbc.com/2018/07/24/glaxosmithkline-23andme-team...

[2]https://www.investopedia.com/terms/s/schedule13d.asp

> To be clear, these things happened together, one doesn't exist without the other.

Buying 14.5% of a company does not come with an automatic collaboration agreement nor would a collaboration agreement come with 14.5% of a company's stock unless there is specific terms for that in some contract which establishes both. And there very well may have been - but both a collaboration agreement and 14.5% ownership can exists without such a contract.

> I'm still not clear on how GSK's purchase of 14.5% of 23andMe along with the exclusive agreement that came with it is the same as buying a single share of Amazon stock.

The argument that was made and that I was responding to was that GSK is 23andMe's parent firm and therefore not legally a 3rd party ... and I'm not sure how I much clearer I can say a shareholder is a shareholder.

If you want to argue that the exclusive collaboration agreement (which is not the same thing as 14.5% ownership) somehow defeats 23andMe's privacy policy then please, argue for it. Maybe it does - but you have not done anything more than allude to it doing so.

> You would need to spend about $44 billion to own 5%, or 24.8 million shares, of Amazon.

And spending that much will not entitle me to an exclusive collaboration agreement with Amazon nor will it make me somehow not a 3rd party of Amazon and therefore allow Amazon to give me all their client data without violating any privacy policies as the person I was responding to claimed.

> Without knowing who owns the other 85.5% of 23andMe (or visibility into their board and voting structure), we have no idea who controls the company.

We don't - but board members and owners are not the same as parent companies and I don't see how that somehow defeats their privacy policy either but if you think it can please clarify.

And I was responding to this comment: "if I buy some shares in Amazon I don't get have all their client data."

The point is that GSK wouldn't have invested $300 million without the exclusive collaboration agreement. That is why it's different than buying a publicly traded stock. GSK is not just a random shareholder, they are a significant owner (may even have board seats) with an exclusive collaboration agreement. You are splitting those things up to make your argument, but they are linked together.

> You've been duped by the dupe that everyone saw coming.

Not only that, this is one of the benevolent aspects of 23&Me that people saw coming. It's only a matter of time before this information trickles to insurance companies.

But wait, it gets better. The data is now permanently out there which means it's only a question of time until it leaks to insurance companies and bad actors, but the data is not only about the individual who submitted their DNA but everyone related to them.

I'm sure GP's children will love them for selling out their data to future employers and insurers.

This would be a concern if DNA was something secret like a password, but it isn't, it falls off you all the time in the form of hair and skin cells, so if there was something valuable in your DNA, your employers could get it easily anyway. And if your DNA was useful to insurers you would pay yourself for them to get it, because knowing that your risk of dying from certain disease is higher is also required for preventing that.

In general trying to keep DNA secret to prevent discrimination is a losing game, a better strategy is preventing discrimination itself, which we already have to do for DNA variations that have visible manifestation. Moreover if the number of people who need protection from discrimination increases, we'll get better at preventing it, which would be useful for the people who are being discriminated now.

> your employers could get it easily anyway

I really hope that would be illegal here in the EU. It being physically possible (or even easy) doesn't make it okay. Not having the dataset easily available is one safety layer to prevent discrimination. No, it sadly doesn't help in all cases. Its unlikely there will ever be something that can, unless maybe you believe in perfectly implemented government policy reeducating us or controlling our behavior.

I'm curious what "bad actors" you imagine with a DNA dataset. Targeted viral agents to hunt and kill only shadowgovt's? If someone wanted to do that, raiding my trash for a half-eaten sandwich is a lot easier way to get the data they want then hoping I upload it to 23andme.

I think they were probably referring to the more mundane use of insurance companies buying the data and raising premiums for people with genetic risk factors. Which IMO seems very plausible.

It's not impossible, but if it happens, it'll be a hell of a lawsuit. That scenario is specifically carved out as unacceptable in US law.

And we know that no law going against the citizen's own interests ever passed.

Absolutism doesn't really help in crafting good policy. The threat that bad things could possibly, maybe happen isn't a good reason to stop chasing disease cures.

If we knew the ways vaccination programs would be abused, should we have refrained from inoculating so much of the world against polio?

It absolutely is and it's also the reason the FDA has a process you have to follow before doing human testing before potentially killing people with a new treatment you're trying to develop.

Yes, exactly. There's a process to follow to minimize risk in human testing. Human testing isn't categorically banned.

Correct, because we thought about the cost and risk of early human trials. Which isn't the case here. You're happy to forego any protection of the people involved.

I think the case is that people have put quite a bit of thought into costs and risks of big-data aggregation of DNA and come to different conclusions on what risks are realistic and what the consequences of those risks are.

They clearly haven't since they didn't even bother asking their users.

It would be hard for them to be more clear about it.

https://www.23andme.com/about/consent/

"Which of my personal information is used for research?"

"Your genetic data and any other personal information you enter into the website, except for your Registration Information (name, contact information, and credit card information), may be analyzed in the research."

It really seems people are complaining because 23andme didn't demand they sign a consent for something they had already explicitly signed a consent to. I, for one, assumed large third-party pharmaceutical companies would have access to the data when I volunteered it. Is there significant risk people misunderstood that? How?

https://www.youtube.com/watch?v=HKQDSgBHPfY

DEF CON 25 - John Sotos

"Genetic Diseases to Guide Digital Hacks of the Human Genome"

US health insurers cannot even possess genetic information for underwriting purposes.

https://en.m.wikipedia.org/wiki/Genetic_Information_Nondiscr...

You have no idea how many ways there are to adhere to the letter of that law while ignoring the intent. There are entire multinational businesses built specifically to facilitate these kinds of data exchanges while keeping it technically legal.

The health insurer doesn't need the genome. It just needs a number from 1 to 10 from a 'de-identified' source to multiply their scores by.

Fair, but they still can't rate my plan with that number.

ACA plan premiums can only be set based on 5 factors: age, location, tobacco use, individual vs. family enrollment, and plan.

Sure, for now. We would all be naiive to believe that insurance companies wouldn't lobby to be able to use other such information continually if they had it until they can use it to charge you more.

Such a strange concept that we say that insurance can't be rated according to significant risk factors.

The state of health insurance in the US would be better described as a "private social health benefit program".

Insurance is effective at protecting people from uncertain financial risks, but the demands of the public have gradually changed the function of health insurance to include many things outside of that.

The question was never "what functions do insurance companies do efficiently?", the question has always been "what health benefits do people deserve?". Unfortunately, these questions have different answers.

Life insurance, disability insurance and long-term care insurance providers can use genetic information to deny coverage[1].

[1] https://www.npr.org/sections/health-shots/2018/08/07/6360262...

Yes, there are saying information want to be free. These data should eventually be public anyway, yes including to insurance company. The solution should be even more transparency, rather than privacy. The sooner we embrace and adapt, the better.

The article says they are just using de-identified, summary data, what's the problem?

Where to start. I could write an entire paper about this.

It's incredibly difficult to truly de-identify data and it's incredibly easy to re-identify it. Making data truly anonymous usually also neuters the data for any kind of predictive models.

23andMe is selling either straight up raw data (which is totally allowed under the investment terms) or tightly grouped 'summary' data which can be trivially re-identified. If they were selling actually anonymous data it would be worth nothing because it would yield no predictions.

Disclaimer: I work in ML/predictive analytics. 'anonymous data' is a marketing term for trivially reidentifiable data. If the data is truly anonymous then its predictive power tends towards 0 as does its market price. You don't think GSK dropped 300 mil on mostly useless data do you?

Why do we care?

Trying to keep genetic identity anonymous is security through obscurity. You have shed thousands of skin cells in the time it took for you to read this. If people want your DNA it's trivial to collect -- and will only get easier and more common.

A better use of our time is to address the ramifications of public DNA and prevent it from being misused.

I can send someone to follow you around to see where you go. Therefore, you do not mind if your GPS data is public?

Now compare the cost of hacking into a database to the cost of obtaining millions of genomes by physically taking genetic material and then sequencing it. Then consider that your DNA is yours for the rest of your life.

Simply because data can be obtained by some means does not make protecting that data useless.

No, that's a bad analogy. Following someone is manpower intensive. A better analogy would be sending someone to observe your hair color -- do you mind if that's public?

As the value of DNA increases, people will collect it. Restaurants, washrooms, your employer, airlines, Uber etc. all could have trivially easy access to your DNA if they choose to.

It's illegal to follow someone around to collect their location data. It's a pretty good analogy.

Just because there is 'trivial' access to certain attributes of people doesn't mean that it's legal to capture those attributes, and even if you do capture them, they're worthless on the legal market. E.g. see SF ban on facial recognition.

Really? Public surveillance is explicitly allowed without warrant.

Like you say, legal barriers can only prevent things that rely on a legal market, like insurance carriers from discriminating against people's genetic makeup. Against genetic weaponization and other state-sponsored uses it would be a bit like banning nuclear bombs -- a great idea for everyone but a foolish one for each individual state.

And that's only if such legal barriers are even constructed which I'm not sure they will be. Look how the privacy battle has turned out thus far.

Maybe you've not been paying attention to the news, but it is very easy to re-identify people with their genetic data.

[1] https://www.telegraph.co.uk/news/2018/04/27/golden-state-kil...

[2] https://www.latimes.com/california/story/2019-11-24/law-enfo...

[3] https://www.usatoday.com/story/tech/nation-now/2018/04/27/an...

Why, in 2019, would you trust such a statement from a faceless corporate behemoth?

Why, after the consistent abuses and lack of accountability across the corporate sphere, would you place any faith in a business's claim that they're just leaving what probably already amounts to billions of dollars of value on the table when there is effectively no penalty for covertly extracting said value at the cost of customer privacy?

Why, after a decade+ of security breaches and poor data handling practices, would you trust a financially motivated, publicly traded company to properly anonimize data?

Easy to say, hard to do. HIPAA isn't enforced nearly as frequently as it should be.

Computer algorithm can identify 99.98 percent of Americans from almost any available data set with as few as 15 attributes, such as gender, ZIP code or marital status.

https://www.nytimes.com/2019/07/23/health/data-privacy-prote...

Hmmm.

I'm going to have to investigate this more thoroughly. If it's true, then I'll delete my data at 23&me (and hope that data deletion actually does what it says).

This is not what the article says, and it is false. No customer data has been shared with GSK.

Reply on news.ycombinator.com