Hacker News Reader

Comment by ydnaclementine | Hacker News Reader

Can anyone comment on privacy for this company? I know that's an issue around 23&me

I believe in the future it will be basically free to sequence the genome from a strand of hair. Given that, is it reasonable to try protecting your genome data?

Imo yes; the ability to match dna to individuals without their consent should belong to law enforcement only. I am holding out hope for legislation that makes this work.

The ability to match dna to individuals is sadly pretty easy and even the idea that you can "de-identify" dna is the elephant in the room for things like HIPPA since dna is the most identifiable thing a person has.

Looking at things like this - https://phys.org/news/2013-03-easy-identity-cell.html

https://33bits.wordpress.com/about/

etc

Having DNA and just looking at the traits that person has will reduce the population down to a pretty manageable number. Any other bits - location, gender, etc will be enough to make an educated guess to an almost certain one. This will not become more difficult to do in the future.

I wouldn't be surprised if we trained ML models to map DNA to adult faces. It doesn't seem out of the realm of possibility.

there is a thing called developmental noise, thats the outcome of phenotype after post expressional events further modify the expression products [proteins, RNA, MeDNA etc.] the face you interpolate from genetic sequence will be an approximation.

A company founded by Craig Venter and Peter Diamandis (Human Longevity Inc) has been working on this and published a paper about it last year in PNAS [1], but it attracted some scepticism from other researchers in the field (the paper was rejected for publication by Science) [2].

[1] http://www.pnas.org/content/early/2017/08/29/1711125114

[2] https://www.technologyreview.com/s/608813/does-your-genome-p...

The biggest issue is relatives. All you need is one person relatively closely related to you to openly post their DNA on a genealogy site and someone searching only has a handful of people to narrow down from.[0]

I used 23andme years ago, using a fake name on the website and a kit ordered by someone else (a friend ordered kits). I should see if I can use their GDPR process to purge it before any relatives give it a shot and start a scandal about the presence of John Doe in the family tree.

[0] https://globalnews.ca/news/4171752/golden-state-killer-dna-g...

Yes, because in the future there will be laws addressing issues surrounding DNA data.

Right now, it's the wild west.

Just because sensitive information can be compromised doesn't mean that it should be offered freely. Yes, someone can target you and collect a DNA sample, but does that mean you shouldn't care how securely your genetic data is used and stored?

Link to privacy policy: https://us.dantelabs.com/pages/privacy-policy

> I know [privacy is] an issue around 23&me

In what regard? I’ve not heard of any privacy related issue with 23andme, and I follow the field quite closely (professional interest). On the contrary, 23andme has been known to uphold customer privacy in the face of government requests [1]. The FTC is investigating 23andme and other companies (which is a good thing), but there is no indication that they’ve found any violation.

[1] https://www.23andme.com/transparency-report/

I believe you can opt out of them storing your data once you retrieve it.

Which is useless unless we can get someone on the inside to vouch for the fact that it's actually not stored

Most companies at least track frequencies. We used to think that deidentified was enough, but apparently it’s not that hard to figure out who a person is if you know that much about them. (Especially if you have relatives.)

There’s been a lot of work with homeomorphic encryption, but I think that the new avenue of research using sketches to provide a sense of anonymity while preserving comparability.

The storage of the data is a not inconsequential portion of the total cost. A lot of work is done to cut costs on genomic data storage. No better way than not storing it in the first place

They explicitly state they're GDPR compliant, so at the very least if they keep customer data after saying they've deleted it and are discovered they would probably be looking at huge fines. Doesn't make much sense from a business perspective, especially given that most customers probably won't bother to have their data deleted.

It's a serious issue for any service that offers to sequence any/all of your genome. AFAIK, none of them get it right. I hope to be corrected here, but I doubt it.

Reply on news.ycombinator.com