No federal privacy law? After the 23andMe hack, it's time to take action

>every medical-field-related service is going to have some private info necessarily (for example), as long as they don’t exploit it that seems fine.

HIPAA is rather stringent, but we don't have anything like that for most other domains where a company might legitimately need confidential information. Instead we have the third party doctrine.

The good/unique passwords stuff is crazy. Almost all of these happen because of a system backdoor or spoofing an admin. I can’t recall any big breaks we’re adding more $! To a password would have changed the outcome.

I hope I can sign up for 'clone monitoring'

CRISPR!

In the same way you change your mother's maiden name in case of breaches I assume

You can take personal accountability for driving collective change, which is what is required here. 23andMe's business practices should not be legal, they are recklessly endangering the lives of people who have never used their service or agreed to their terms, and the only thing I can see that can stop them is legislation.

The article clearly calls for legislative action, which isn't personal.

I never used 23 and me but I did use Lemonaid Health a few times several years ago and found out that apparently I too was affected by this hack in the form of an email telling me to reset my password - with no other information.

Apparently 23 and Me bought Lemonaid at some point. And I only ever used Lemonaid to get prescriptions for medications that really shouldn't even need prescriptions but the United States healthcare system is insane.

It's just a comedy of late stage capitalism. And isn't the one privacy law the US does have HIPAA? So shouldn't this run afoul of that somehow?

The problem is when "just don't give personal information" is taken out of your control.

For example, I have largely cut Facebook and Google out of my life (Facebook lingers for keeping up with a few people but its access is severely limited).

However that does nothing to stop my data that may happen to be on my friends phones (like my cell phone or chats for example) from being gobbled up by both of these companies if they allow it.

There is basically no way for me to stop Google from buying my credit card information. Just saying use a different card really isn't a realistic option.

These laws are necessary because there are many instances of a complete lack of consent on my part for these companies getting my data.

I would love this, but unfortunately if you want to travel nowadays you need to give up biometrics to board a flight

Technically that means not participating in genetic research studies. At least there's the GINA law.

Great idea - I'm going to take personal action to stop my data from getting into the hands of corporations. Now all I need to do is...

- Stop using credit cards and taking loans, or go through every payment processor's arcane process to stop them from sharing my transaction data with advertisers

- Learn what a "tracking pixel" and "device fingerprinting" is and install browsers/extensions to block these technologies, breaking several websites in the process

- Stop receiving images in my emails

- Decompile and screen all my mobile apps to make sure they don't use something like Foursquare's Movement SDK, which allows app developers to create location-aware apps at the cost of sending their users' location data to Foursquare, who then sells it. Foursquare is just one of a half-dozen companies who do this and probably the most transparent, so I've got my work cut out for me.

- Gather a list of all major customer segment providers (companies like Neustar and Claritas) and figure out where and how they get their individual-level data (this is often a fiercely guarded trade secret) so that I can avoid making it into their data collection funnels.

- Find a mobile carrier who won't sell my cell phone data.

- Find a pharmacy who won't sell my aggregated prescription data to IQVia or one of its competitors

- Stop voting (voter rolls are often public or buyable and include your address)

- Never donate directly to a political campaign

- Only buy a house via an LLC with a registered agent

- Only deal with merchants who won't sell my transaction history

Yeah, this seems easier and more tenable than privacy legislation. Definitely.

I’ve never understood the specific privacy concern I should have about my genetic code. The things I consider private in my life never surface in my biology, they surface in my behaviors, experiences, thoughts, associations, and other aspects of my lived life. While I don’t want insurance company to adjudicate coverage and claims from it, I don’t know what hackers or customers of illegally obtained health ordnance dna data are reasonably going to do with it that impacts me in the least. I’d love to be convinced otherwise, but at some level I almost am at the level of anonymized genetic codes should be generally available with health histories for researchers and not locked away behind privacy screens more rigorous than everything I actually wish could be kept private.

The ability of relatives, friends, and acquaintances to completely invalidate my own actions is the entire reason this advice falls flat. Unless the advice is to simply never interact with those people to the point of my friends and family not even having my phone number. Personal action is nonviable when the entire rest of the system is built is sidestep it.

> You can't control what your relatives do, unfortunately.

That’s exactly what laws are for. Making “best practices” enforceable. Imagine if not killing people was just considered a “best practice” rather than something you would face severe consequences for.

In this case the best practices need to be enforced against 23andme and their ilk.

User data should be treated like uranium, not like oil. Both are valuable, but you don't want to just accumulate and store uranium. You want only as much as you absolutely positively need, hold it securely, and then to get rid of it as soon as you don't need it anymore.

The United States can’t even carry out basic governmental functions. The House of Representatives is without a speaker going on a month now, and each election cycle is degrading to the point that it may stop functioning properly.

We are unfortunately well beyond the point of expecting the legislature to legislate, let alone pass robust beneficial laws.

No, even in Europe they don't care, it's just for pr and the image.

Is that why the EU is trying to break my encryption, scan my devices for CSAM, and grab all its visitors' biometric data? To "protect my privacy"?

This narrative needs to end. The EU does not care about privacy. They care about making headlines about sticking it to foreign companies.

What's missing is a catastrophic privacy event. People have been yelling from rooftops about how terrible losing your privacy could be, but the horror stories aren't coming true. There aren't any wide-scale or pervasive negative consequences of a loss of privacy, and there are a lot of immediate positives.

An insurer needs to start disqualifying anyone who, I dunno, is shown in Google Maps to be out at bars past 11 PM or something like that. Until you can show the practical problems associated with a lack of privacy, people won't care, and I would even argue that those people aren't entirely unjustified in that belief.

I heard one of the users was wearing a very revealing skirt and browsing through a bad neighborhood.

Some of the users were logging into 23andMe after midnight unaccompanied!

To be fair, 23andme wasn't hacked, at least not with the traditional definition. Their users who were reusing passwords got hacked.

That said… Should they have required 2FA? Yes. Should they have taken proactive action on behalf of their users when they appeared in "Have I Been Pwned"? Yes.