Hacker News Reader

Comment by Tuna-Fish | Hacker News Reader

If they file for bankruptcy, they cannot legally destroy the data. The data is a salable asset, the law requires them to preserve it so that it can be sold and the money returned to creditors. And many of the promises they have given about it's use can and will be broken by the trustees dissolving the company.

The thing you need to consider when you give data to a company is not "will these people misuse this", but "once these guys go bankrupt and sell the data to the highest bidder, can it be misused?". See, for example, how if your company holds a large mailing list, it will typically be sold to a spam operation for a few bucks.

The minimum standard for giving serious personal information, like your DNA, to a company needs to be that the company receives a limited-time license to handle the data for the purposes they need to provide the service, and absolutely nothing more.

View on HN

My mom, dad and sister have all done 23andMe, so it doesn't matter if I have or not. They have an entirely complete genome for me.

I agree with your limited license idea. It's just not ok that something like that can be dischargeable in bankruptcy. We don't have the ability to refuse consent in the first place, if our family provide it.

How can they link your family's DNA to you if they don't have a profile or account for you? How do they know you exist? And if they know you exist, how do they know you are related to that particular family without some DNA information about you to link to them?

OSInt will happily fill in the rest. Even if you don’t have a social media footprint, your family does and they shoved their contact list, with you in it, to Facebook 10 years ago.

That's a lot of information, but it is in no sense a complete genome. It does mean that someone who had that information could prove that your DNA belonged to a child of your mom and dad with high accuracy, or that you were a sibling of your sister. It also reveals that you don't have certain mutations, or that you do have a few.

But where your parents have different SNPs, there's no way to derive which of them you inherited. What you said is a bit like saying that, because you know all of the cards in a deck of playing cards, you know what hand someone is holding, except in a counterfactual world where there are 10,000 possible cards and you know that a deck only has 52 of them.

When people describe DNA as PII, I don't think they imagine being involuntarily cloned (yet..), I think they're imagining heritable conditions becoming public information through data leaks.

People have a right to privacy from imprecise yet correct information about themselves. Someone wouldn't want to explain an abusive parent to a prospective employer, but they could see a strong tendency to, schizophrenia, with DNA data leaks.

Be that as it may, you said they have an entirely complete genome for you, which they do not.

> The data is a salable asset, the law requires them to preserve it so that it can be sold and the money returned to creditors.

This would depend on the terms you agreed to at the time you signed the account and submitted your data. I'm aware a lot of companies like to bury marketing disclosures under a busload of T&Cs. But if you didn't agree having your marketable data allowed to be sold the sale the to creditors can't backdoor it in. They can only reach out to you to opt into new terms, which you should refuse.

This makes me wonder if there could be strong enough laws around protecting genetic info (for example penalties that pierce the corporate veil) that those with fiduciary responsibility to the company could argue that destroying the data is really in the shareholders' best interest.

I'm completely uninformed in this area. Is there precedent for anything like this in the modern day?

Upgrade this to any medically adjacent data. ALL of the DNA data should be covered under HIPPA or something similar.

Genetic information is PHI and is already covered under HIPAA. The problem is that, like most companies, 23andMe isn't a HIPAA covered entity. Because they're not a healthcare provider or health insurer, it doesn't apply to them.

Genetic information is also controlled by other laws such as GINA. So it is already some of the most controlled health data there is. But that's not a very high bar in the US.

It'd be fun to watch what would happen if data shared with services giving health advice fell under HIPAA.

It's not even really that unreasonable, if they want to advertise that they can provide health information, they don't get to pretend that they don't.

Reply on news.ycombinator.com