Comment by dotBen | Hacker News Reader

Comment by dotBen | Hacker News Reader

My advice to anyone thinking of doing genetic testing (be it 23andMe or another route) is to consider seriously doing it at as a "John Doe" (ie not using your real name and details).

Knowing you have a high susceptibility to a significant disease could have all sorts of implications for insurance - medical, life and even car.

In general insurance companies require you to disclose any and all information that you have that would be pertinent to them assessing risk. Clearly for medical and life insurance you knowing there is a high chance you will get Parkinsons (for example) is information your insurer would like to know - and presumably will have a negative impact on your coverage costs/availability.

Here in the US there are currently laws - such as Genetic Information Nondiscrimination Act (GINA) - to prevent insurance companies demanding this information.

However laws can be repealed. The insurance industry is the 'leader' in government lobbying. 23andMe is still subject to US federal subpoenas laws. 23andMe could be aquired by an insurance firm.

Also consider laws differ in other countries, where insurance companies might be able to legally demand results. In Canada insurance companies can not only request it, they can demand you get this kind of testing before you can obtain coverage.

Consider further that databases can be hacked/stolen (it seems to be happening to every email marketing company right now).

Think carefully whether you want your personal legal name and contact details all over the results of a test like this.

If 23andMe is acquired by any company (insurance or otherwise) that wants to change the Terms Of Service and / or Privacy Policy, they will have to notify customers, and those customers who don't agree with the changes would have the right (under the current policy) to download their raw data and delete their 23andMe accounts.

Also, the chances of 23andMe getting hacked are much lower than the chances of your friendly neighborhood email marketing company. I know since I built the site.

Is that your aspiration or something you know for a fact?

I couldn't see anything that indicates this in their Privacy Policy. In fact https://www.23andme.com/about/privacy/#Full says:

Account Closure and Correction of Personal Information

As stated in the applicable Consent Document, however, Genetic Information and/or Self-Reported Information that you have previously provided and for which you have given consent to use in 23andWe Research will not be removed from ongoing or completed studies that use the information. Our contracted genotyping laboratory may also retain your Genetic Information as required by local law and we may retain backup copies for a limited period of time pursuant to our data protection policies. In addition, we retain limited Registration Information related to your order history (e.g., name, contact, and transaction data) for accounting and compliance purposes.

Doesn't look like they're interested in totally zero'ing you out of all of their records even if you explicitly request it (acquisition or not).

From the page you cited (https://www.23andme.com/about/privacy/#Full):

Business Transitions

In the event that 23andMe goes through a business transition such as a merger, acquisition by another company, or sale of all or a portion of its assets, your Personal Information will likely be among the assets transferred. In such a case, your information would remain subject to the promises made in any pre-existing Privacy Statement.

From their current privacy policy (https://www.23andme.com/about/privacy/?version=1.1):

Business Transitions

In the event that 23andMe goes through a business transition such as a merger, acquisition by another company, or sale of all or a portion of its assets, your personal information and non-personal information will likely be among the assets transferred. You will be notified in advance via email and prominent notice on our website of any such change in ownership or control of your personal information. We will require an acquiring company or merger agreement to uphold the material terms of this privacy statement, including honoring requests for account deletion.

I think khomenko is correct, with the exception you pointed out (ongoing studies).

It is something I know for a fact since I worked at 23andMe for 4+ years. Looks like the first responder already found the relevant section and posted it. It's not an ironclad assurance, and there are a few caveats, but these provisions, together with any scrutiny an attempted acquisition would bring (the database is big and well-known enough where it's virtually guaranteed), can provide peace of mind for some. There are certainly risks and I don't advocate that everyone gets tested without considering them, but "insurance company buys 23andMe, gets all the data, and starts discriminating based on it", is a very low-probability event based on what I know.

It says that I would have to pay 9 dollars a month. Do you know if I can tell them to charge the whole subscription once instead of 9 dollars every month?

You can "buy it as a gift" and pre-pay the 1-year subscription.

Damn, I already paid, is there any way I could do it now or it's too late?

Contact help@23andme.com

if you expect to be truly anonymous with 23andme, you're going to need to anonymize the address the kit is sent to, the payment information, and the connections to other people you have as well.

related: http://www.quora.com/Is-it-possible-to-use-23andme-anonymous...

"To date, there is no way to order the service completely anonymously. That said, if you have a trusted friend or relative who would be willing to order a kit for you, his or her address and credit card would be tied to the account, rather than your own, and there would be no way to connect it to you."

even if you've ordered under your own name, doesn't this suggest you could just maintain plausible deniability? surely a DNA test can connect it to you- but that would nullify the "john doe" tactic as well, no?

23andMe make clear that they do not assume that the genetic material belongs to you just because you are the account holder -- you can submit several samples under different names for family members, for instance.

It seems the simplest step to prevent 23AndMe being forced to give up your genetic data at some future dystopic point has already been taken: they already have no way of knowing if it's actually your data. You can take anyone's DNA and call it yours, or give anyone else's name to your own DNA.

The following is my boiler plate for anything that requires anonymous subscription - 23andme, domain registration, hosting, etc:

1) Mailbox in SF's China Town (a number don't ask for ID even though they're supposed to legally request it). Many also don't speak much English so if anyone comes to investigate good luck to them.

2) Visa/Amex gift card purchased at Walgreens/Safeway in cash - ideally in a different city you happen to be visiting with no connection in. Las Vegas and New York are great choices.

3) Email address created and accessed via TOR within the incognito mode of the browser. Buy the 23andMe subscription/domain/hosting in the same way but making sure you are using a different TOR session.

While I approve of you guarding your privacy, you may want to be careful about doing this with domain names - many registrars require that the WHOIS information is up to date, and can theoretically take them back if it isn't. I'd imagine the same holds for domainsbyproxy and the like.

So what? All you need is the initial email to work, nobody is going to notice fake whois that quickly. No person is going to show up at the address you list to verify that it's actually your address.

I've used fake whois records for a while and have never had any problems. I did make my main domain "real" a few years ago to avoid any problems, however.

On the other hand, it presents an opportunity in countries with a moratorium on using genetic testing information for insurance purposes; it creates an information asymmetry in your favour. For example, until 2017 in the UK you can take out as much life insurance as you please with no test-result penalty (with the sole exception of Huntington’s Disease results). http://www.abi.org.uk/Media/Releases/2011/04/Insurance_Genet... Perhaps the insurance companies figure that knowing the results might improve the actual outcome in many cases, because the individual alters their behaviour to mitigate them. That, and the predictive power of most tests is fairly weak at present.

I bought my entire family the $99 special on last year's 23andme. The kits are pretty darn anonymous - and they all signed up under initials. Unless you give them your legal name, their is no way to identify who the test was for - address doesn't tell you that.

if the issue is knowing whether you knew about a disease, i don't think there's any way to anonymize oneself.

the insurance company could simply acquire a dna sample from you and check whether there is a match in the database?

In theory it could have been someone else who sent in your sample.

https://github.com/msporny/dna

a hackernews reader: https://github.com/orta/dna

Let's say someone wanted to buy as a John Doe. How would they pay without the risk of revealing their identity?

see http://news.ycombinator.com/item?id=2431482

What's the chance of this kind of thing occurring and simultaneously NOT requiring a new test anyway?

Reply on news.ycombinator.com