This post contains a video, which you can also view here. To support more videos like this, head to patreon.com/rebecca!
Transcript:
Waaaaay back in 2013, I went to a conference where I got a free 23andMe kit. I thought it was pretty cool that there was a tool that could tell me about my genes, giving me an idea of whether or not I have an increased risk of problems like breast cancer or Alzheimer’s, so I spit in the little tube and mailed it off. I participated despite the fact that I was also a little concerned about handing my genetic code to a corporation. At the time, I came up with a few potential problems: for a start, learning that I had an increased risk of certain disorders might increase my own anxiety, but that was offset by an ability to try to change my habits to mitigate that risk. And that happened: my code suggested I might have an increased risk of macular degeneration, so I informed my optometrist and I now get regular exams to make sure everything’s cool with my eyeballs.
Another concern was privacy-based. The company was brand new, so there wasn’t a lot of information on the potential risks but the big, obvious problem I could think of was based on US insurance companies getting their hands on my genetic data and using it to decline to pay for care based on a “pre-existing condition” that I was literally born with. Because we live in a dystopia. But 23andMe promised to never sell or share my data without my explicit consent, and also honestly, at the time I was a bit of a doomer on that issue and figured that an insurance company would end up bankrupting me eventually anyway so I went for it in the interest of science.
And honestly, I am glad I did it. I learned more about genetics in general, it encouraged me to continue to pay attention to breaking genetics research, and I did learn stuff about my own genes.
In the decade since I first spit in that tube, a few other issues have popped up. As I discussed in a video in 2019, for instance, researchers discovered that telling people that they were genetically predisposed to be easily winded during exercise made those people more easily winded while running on a treadmill compared to people who were told they were genetically predisposed to be able to run longer, regardless of whether or not they actually did have those genes (which do exist). Also, telling people their genes made them more likely to feel satiated led to those people eating less. So even though genes aren’t destiny, learning about our genes make us more likely to act as though they are. That’s a pretty powerful effect, especially considering how little we really know about how certain genes actually affect our lives.
And of course, as my fellow true crime fans know, around that same time the world learned about forensic genealogy with the arrest of the infamous Golden State Killer. He was caught by investigators comparing crime scene DNA to commercial online DNA databases and finding his relatives. They built family trees and narrowed down suspects until they finally landed on Joseph James DeAngelo, only catching him thanks to people using these services who happened to have the same great-great-great-grandparents as him.
As a true crime fan, a puzzle fan, and a science fan, I found this case absolutely fascinating. As a critic of the American justice system and a privacy advocate, I found it troubling. How would I feel if my DNA led police to arrest someone for rape or murder? Well, if they actually did it I guess I’d be fine with it. If they didn’t, well. I don’t know, it’s complicated!
Another issue that came to light in the past few years is how can a for-profit corporation remain solvent when they make all their money on a product that, by definition, a customer can only buy once? And that’s why today, the biggest problem everyone has is that 23andMe has, in fact, declared bankruptcy. And that means that if you’re one of their customers, your genetic data might end up in the hands of someone you don’t trust.
23andMe has stated that they’ll be protecting that data throughout the bankruptcy proceedings, but people are understandably skeptical of that considering that they already gave hackers access to the data for 7 million users a few years ago, giving up user passwords and allowing the hackers to see users’ family trees.
That’s why California Attorney General Rob Bonta issued a consumer alert reminding people that the Genetic Information Privacy Act and the California Consumer Privacy Act give customers the right to demand that23andMe delete all their data and even destroy any samples they might still have on file. Obviously that’s for Californians, but it’s part of the reason why customers anywhere can in fact log in and do that, and Bonta gives step by step instructions for anyone who wants to. I’m not going to read it all out but feel free to pause here if you’d like:
To Delete Genetic Data from 23andMe:
Consumers can delete their account and personal information by taking the following steps:
Log into your 23andMe account on their website.
Go to the “Settings” section of your profile.
Scroll to a section labeled “23andMe Data” at the bottom of the page.
Click “View” next to “23andMe Data”
Download your data: If you want a copy of your genetic data for personal storage, choose the option to download it to your device before proceeding.
Scroll to the “Delete Data” section.
Click “Permanently Delete Data.”
Confirm your request: You’ll receive an email from 23andMe; follow the link in the email to confirm your deletion request.
To Destroy Your 23andMe Test Sample:
If you previously opted to have your saliva sample and DNA stored by 23andMe, but want to change that preference, you can do so from your account settings page, under “Preferences.”
To Revoke Permission for Your Genetic Data to be Used for Research:
If you previously consented to 23andMe and third-party researchers to use your genetic data and sample for research, you may withdraw consent from the account settings page, under “Research and Product Consents.”
So, is this a big deal? Should you delete your data? The Washington Post urges you to absolutely go do that right the fuck now. Meanwhile, my good friend, who used to work at 23andMe, points out that he is not worried and will not be deleting his data, pointing to this piece in Reason to describe why.
I trust my friend’s judgement when it comes to genetics stuff, so even though I was leaning towards deleting my own data I clicked through to see the other side. And I have to say, I found the arguments presented by Ronald Bailey, Reason’s science correspondent, pretty weak, but for the sake of presenting both sides I’ll try to sum them up fairly.
He starts by stating that the privacy implications “aren’t that dire” because there are other ways that our privacy is compromised, like the government having some people’s fingerprint data and facial recognition software existing. In my opinion, the existence of other privacy concerns doesn’t mean we should ignore this one.
Next he says that we shouldn’t be worried about our data being used for forensic genealogy because unlike other companies, 23andMe requires a warrant before giving away user data. That’s great until you realize that 23andMe has declared bankruptcy and could sell your data to another company that might choose to not require a warrant.
He next says we shouldn’t worry about hackers getting our data because hackers frequently steal sensitive medical data from hospitals and healthcare companies. I will refer you back to my first point: one privacy violation doesn’t mean we should ignore another.
Worried about someone using your data to blackmail you? Bailey thinks that’s only a problem if you’ve committed an unsolved murder or rape, ignoring things that are way, way more likely to be fodder for blackmail, like having a secret child out of wedlock. Hackers aren’t out there solving crimes and using that to extort money but it would be pretty easy to look at someone’s family tree and come to some conclusions.
Worried about your name, address, and birth date being used by a hacker to impersonate you? Bailey says that information is not unique to 23andMe. Do I need to tap the sign again? Your data being accessed elsewhere does not mean you should ignore your data being accessed here.
Are you worried about your genetic data being used by insurers to deny you coverage? Bailey counters that with an example of how an insurer used a blood test to double their cost. I had to reread this section several times because it so thoroughly counters his own thesis that I was baffled as to why he included it, but when I sat down to make this video I realized that he’s probably making the same pointless argument again: it’s already happening in other ways, so why worry about it happening with your genetic data?
His final point is the only actual argument in the entire piece, and I suspect it’s the reason why my science-loving friend isn’t deleting his data:
“I invite my fellow 23andMe customers to consider why nearly 80 percent of you agreed to participate in 23andMe research efforts. Besides hoping to gain some insights about yourself, you also want to help advance medical science. The company may or may not survive, but its stored genetic data remains a scientifically and medically valuable resource that some other research firm or institution may use to help develop new treatments and cures. Keep that in mind and resist being panicked into deleting your data for some speculative gain in privacy.”
I do think that’s a good point. I am one of those customers who opted into the research program, though I spent some time going back and forth over that. On the one hand, yes, I do want my genetic data to be used to develop new treatments and cures. On the other hand, I understand that large, private corporations use public data to develop those treatments only to sell them back to the public at an inflated price, and so the same genetic data that leads to a new treatment can also be used by an insurer to withhold that treatment from the person who needs it. It’s a shitty situation, and so at the end of the day I, personally, am deleting my data for an actual gain in privacy. It’s not “speculative,” it’s real: if a corporation does not have my data, I have more privacy than if a corporation does have my data.
Only you can decide whether or not you want to delete your data, but that’s my view of it all. My only worry now is this: what if Darwin’s Ark goes bankrupt next, and I need to do this same analysis on whether or not to delete Indy’s data?? I don’t need hackers threatening to tell the world that he’s part cocker spaniel.
