Hacker News Reader

Comment by progbits | Hacker News Reader

If they go bankrupt they should destroy all the data but of course they will rather sell it to recover at least a bit of money.

View on HN

Remember that it's good opsec to rotate your genome every six months.

Also you have to have a genome with at least one uppercase, one lowercase, one number and one special character that isn’t \/‘` or ”

That's hilarious. I'm imagining CRISPR as a tool to scramble your DNA every so often.

That sounds like a terrifying cyberpunk novel that I would definitely read. Although I hope the future is not that bleak.

Reminder of the film Gattaca which explored some of the risks of leaking your DNA in a future dystopia.

Excellent movie. Did not see it when it was released orignally, but discovered it by chance going through the tv channels. A real gem.

Such a good movie. (If a bit slow paced.)

Someone should do a genome manager startup

If they file for bankruptcy, they cannot legally destroy the data. The data is a salable asset, the law requires them to preserve it so that it can be sold and the money returned to creditors. And many of the promises they have given about it's use can and will be broken by the trustees dissolving the company.

The thing you need to consider when you give data to a company is not "will these people misuse this", but "once these guys go bankrupt and sell the data to the highest bidder, can it be misused?". See, for example, how if your company holds a large mailing list, it will typically be sold to a spam operation for a few bucks.

The minimum standard for giving serious personal information, like your DNA, to a company needs to be that the company receives a limited-time license to handle the data for the purposes they need to provide the service, and absolutely nothing more.

My mom, dad and sister have all done 23andMe, so it doesn't matter if I have or not. They have an entirely complete genome for me.

I agree with your limited license idea. It's just not ok that something like that can be dischargeable in bankruptcy. We don't have the ability to refuse consent in the first place, if our family provide it.

That's a lot of information, but it is in no sense a complete genome. It does mean that someone who had that information could prove that your DNA belonged to a child of your mom and dad with high accuracy, or that you were a sibling of your sister. It also reveals that you don't have certain mutations, or that you do have a few.

But where your parents have different SNPs, there's no way to derive which of them you inherited. What you said is a bit like saying that, because you know all of the cards in a deck of playing cards, you know what hand someone is holding, except in a counterfactual world where there are 10,000 possible cards and you know that a deck only has 52 of them.

When people describe DNA as PII, I don't think they imagine being involuntarily cloned (yet..), I think they're imagining heritable conditions becoming public information through data leaks.

People have a right to privacy from imprecise yet correct information about themselves. Someone wouldn't want to explain an abusive parent to a prospective employer, but they could see a strong tendency to, schizophrenia, with DNA data leaks.

Be that as it may, you said they have an entirely complete genome for you, which they do not.

How can they link your family's DNA to you if they don't have a profile or account for you? How do they know you exist? And if they know you exist, how do they know you are related to that particular family without some DNA information about you to link to them?

OSInt will happily fill in the rest. Even if you don’t have a social media footprint, your family does and they shoved their contact list, with you in it, to Facebook 10 years ago.

> The data is a salable asset, the law requires them to preserve it so that it can be sold and the money returned to creditors.

This would depend on the terms you agreed to at the time you signed the account and submitted your data. I'm aware a lot of companies like to bury marketing disclosures under a busload of T&Cs. But if you didn't agree having your marketable data allowed to be sold the sale the to creditors can't backdoor it in. They can only reach out to you to opt into new terms, which you should refuse.

This makes me wonder if there could be strong enough laws around protecting genetic info (for example penalties that pierce the corporate veil) that those with fiduciary responsibility to the company could argue that destroying the data is really in the shareholders' best interest.

I'm completely uninformed in this area. Is there precedent for anything like this in the modern day?

Upgrade this to any medically adjacent data. ALL of the DNA data should be covered under HIPPA or something similar.

Genetic information is PHI and is already covered under HIPAA. The problem is that, like most companies, 23andMe isn't a HIPAA covered entity. Because they're not a healthcare provider or health insurer, it doesn't apply to them.

Genetic information is also controlled by other laws such as GINA. So it is already some of the most controlled health data there is. But that's not a very high bar in the US.

It'd be fun to watch what would happen if data shared with services giving health advice fell under HIPAA.

It's not even really that unreasonable, if they want to advertise that they can provide health information, they don't get to pretend that they don't.

I would expect that you have a right to get your data deleted.

Reply on news.ycombinator.com