Hacker News Reader

Comment by dcgudeman | Hacker News Reader

So I should get the consent of my entire extended family before I ever submit my DNA to a service for analysis?

With likely very dire results, yes I think you should. If your mothers insurance rate goes up, since you got one of these dna tests for Christmas, she should be involved in the decision to publish this data in the first place.

In the US, Congress has passed a law that explicitly makes that specific practice illegal: https://en.m.wikipedia.org/wiki/Genetic_Information_Nondiscr...

What workarounds insurance companies come up with to circumvent the spirit of the law and how well it can be enforced will be interesting.

And George W. Bush, a Republican, signed this into law. I remember thinking that strange at the time because I would have thought insurance companies would want to be able to use DNA information and the Republicans being more of a "big business" party would have supported that.

Also, I found out last time this discussion came up on HN that the law prevents it being used for regular insurance but does not apply to life insurance.

And life insurance could just simply demand a dna sample from you before underwriting a policy just like they might demand a physical so the whole "concern" is entirely moot.

Insurance is highly regulated, insurance companies have specific legal ways to underwrite policies, the idea that life insurance companies are going to secretly use stolen data of uncertain provenance in their underwriting instead of just making you submit a dna sample is, quite frankly, silly.

What workarounds insurance companies come up with to ... will be interesting

If there's enough money to be made, I'm sure the Usual People will be persuaded to bend the law until it gives way.

I think so, yes. Otherwise you're sending large portions of their personally identifiable information to some sort of database without their consent.

Do you also think I should consult my identical twin for permission before uploading photos of myself to the internet? Why / why not?

Hardly a fair comparison. However the few identical twins I know have been very mindful of how their individual behavior affects the other.

Of course I realised the comparison would be somewhat controversial, it was actually the point of bringing it up. However, if you have the time I would appreciate it if you tried to articulate why you think the comparison is unfair, instead of just a general dismissal.

Your (twin’s) photo is unlikely to be used for:

* Identifying future medical risk factors

* Solving 30-year-old cold cases where DNA is the only evidence

* Identifying parentage in adoption cases

But my (twin's) photos could likely be used used for:

* Linking them to the location of a crime using Clearview AI and similar scraping facial recognition services

* Creating fake but believable defamatory photos and videos, such as deepfakes

* Being scraped and used in fake profiles by spambots and other nefarious actors

* Being exploited as a tool in identify theft and identify fraud, via various kinds of social engineering.

Do you not consider some of these scenarios worthy of a similar amount of consideration?

I consider them to be unavoidable, barring some extreme off-the-grid efforts. Your photo is out there. Your DNA doesn’t have to be.

I'd argue not, since a single photography contains much, much less information than a full DNA fingerprint.

Not for identifying or incriminating you it doesn't given the practical risk of how the information can be used.

That's a fair point. However, I'm not entirely sure I buy the premise. With the advent of deepfakes and internet scraping facial recognition, I think a public photo collection of your entire likeness could be considered least somewhat at risk for abuse, when compared to the risk that a confidential fingerprint with ~25% of your genes is leaked and then used against you.

Your data, your rules. I put my 23andme raw data in github (https://github.com/sbassi/MiGenomaSbassi) for the world to see and use without asking anybody in my family.

I strongly disagree. I consider it comparable to something like financial administration. In which an "expense" or "exchange" has two sides. Me, paying you, you receiving the money.

It is not up to me to decide to just release such data. Because it encodes other people's data too. If I were to release my financial records because "it's my data", i'd be exposing a lot of people, organisations and companies who I had interaction with.

But it is up to me to decide to release my financial records. All the parties I've dealt with have to expect the possibility (unless there is some signed agreement that prevents disclosing them).

With DNA I'm not so sure.

I'm pretty sure that if <insert ecommerce platform here> were to leak all their financial transactions, that is considered a large data-breach and would be considered a privacy infringement.

I am aware that "an ecommerce platform" is something else than "your personal finance", but the principle is the same: X shouldn't release other people's financial transactions just because those were done with X.

The federal Genetic Information Nondiscrimination Act does prohibit insurers from asking for or using your genetic information to make decisions about whether to sell you health insurance or how much to charge you. But those privacy protections don't apply to long-term-care policies, life insurance or disability insurance.

https://www.npr.org/sections/health-shots/2018/08/07/6360262...

The point is, it's not just your data. It's shared with other people who may not want it being publicised to all and sundry.

That's ridiculous. Should I not use my surname because I identify my parents, my brothers and some of my cousins? I think bodily autonomy applies here.

You are giving far more away with DNA information; it's not remotely the same.

The point is, at the very least it's a grey area, so to dismiss the counter points so airily as you have done on such a serious subject indicates - at best - a lack of reflection and respect for the rights of others.

No, but for having the results stored at some company.

Reply on news.ycombinator.com