23andMe Requiring Potential Bidders To Affirm They Will Uphold Data Privacy 30
The sale of bankrupt DNA data bank 23andMe is delayed as the company struggles to secure a lead bidder who can meet regulatory and privacy requirements, pushing the initial auction deadline from Friday to Monday. Seeking Alpha reports: 23andMe Holdings (OTC:MEHCQ), currently in Chapter 11 bankruptcy proceedings, is requiring that any potential bidders for the company's assets "guaranty that they will comply with the Company's privacy policies and applicable law." The genetics company said this is necessary to protect customers' data.
In addition, bidders will need to submit documentation of their intended use of any data, describe the privacy programs and security controls they have in place or would implement, and say whether they would ask for current privacy policies to be amended. 23andMe has also filed a motion asking for the appointment of an independent customer Data representative to review whether a proposed deal is in alignment with the company's privacy policies and data privacy laws.
In addition, bidders will need to submit documentation of their intended use of any data, describe the privacy programs and security controls they have in place or would implement, and say whether they would ask for current privacy policies to be amended. 23andMe has also filed a motion asking for the appointment of an independent customer Data representative to review whether a proposed deal is in alignment with the company's privacy policies and data privacy laws.
Re: (Score:2)
I imagine there are things the terms of service do allow them to do that are of commercial value. Deleting it will reduce the valued of the company even if the buyer intend to keep their promise.
However, I can't imagine any buyer, even one who intends to keep their promise, actually doing so in the long run. Not doing the things they'd be prohibited from doing is why the company is bankrupt in the first place.
Re:Why not just purge the data (Score:4, Insightful)
Before handing over the remainder of the assets?
Because the data is their assets.
"Guarantee" ? (Score:3)
Really. Wow. "Guarantee" that they will comply with 23-and-me's policies. Sure, yup. Will do that, I promise. Pinky promise.
Who's going to enforce the promise once I've completed the purchase?
Re: (Score:2)
Re: (Score:2)
Who's going to enforce the promise once I've completed the purchase?
Presumably the bankruptcy court. But that's an awfully big presumption.
Re: (Score:2)
Re: (Score:2)
Really. Wow. "Guarantee" that they will comply with 23-and-me's policies. Sure, yup. Will do that, I promise. Pinky promise.
Who's going to enforce the promise once I've completed the purchase?
But ... the honor system was good enough to send them your sample in the first place?
I didn't use their service or any other like it, because there are no privacy protections in this country. It's not like nobody, especially here on /. was warning you. And I don't know who the hell that company is or who's running it, it sounds like a startup??
It's like complaining that Facebook knows too much about your life, wrong place to complain about that. It's a calculated risk you took, none of my business, but comp
I "requested" data deletion (Score:2)
Re: (Score:2)
"Request completed. Your access to your DNA data has been deleted"
Meaningless (Score:5, Insightful)
Nothing prevents these companies from agreeing upfront and then changing their tune the second they own the company. This is just to protect the current ownership so they can say, "Well we made them promise not to do that."
Let's be real. That data is the only thing of value they have to offer. That's the only thing a buyer would be interested in acquiring.
Re: (Score:2)
Selling data is a bad move even if you're really invasive into people's privacy. Look at Google. They don't give out any of your personal data - it's too valuable. Instead, they sell the use of that data via their own advertising network.
Re: (Score:2)
They could always sell the database to law enforcement for their DNA profiling database - you know law enforcement agencies aren't going to sell that data but instead keep it for themselves. Or maybe they'll sell access for matching unknown DNA samples.
Re: (Score:2)
If they really have a contract that forbids it, it prevents them. But this would require a buyer who accepts a contract for indefinite time preventing him from certain ways to make revenue.
Glad I didn’t get swabbed. (Score:2)
Re: (Score:2)
You'll still be traceable. When the DNA results come back to "child of mother", the suspect list is pretty small.
That's how DNA databases solve cold-cases. Usually by matching a family member in the database.
Simple solution: (Score:2)
If they actually wanted to ensure the data remained confidential then they would be placing these requirements in the sale contract. Anything short of this is worth as much as any other "promise", "pledge", or whatever you want to call the blatant lies that for-profit companies tell you.
Re: (Score:2)
Re: (Score:2)
You could include the US federal government as a party to the contract thereby allowing them to sue to enforce it. However, contracts are so insanely flexible that there are many things that could be done. Hell, you could make sure that the executives and board members themselves become personally liable and have them all sign the contract.
Just because it seems outlandish doesn't mean it shouldn't be done.
Delete the data (Score:2)
The best solution is to delete the data before. You can have users opt-out of deletion if they are sure they want to take the risk.
They gonna get sued by creditors (Score:2)
They're gonna get sued by their creditors for not acting as a proper fiduciary.
pssst, buddy.... (Score:2)
Oh sure (Score:2)
Sure, they'll agree or swear to anything, but what about the next company that gets the data, or the one after that? Or the 350 companies after that?
Will (all) the new buyers also guarantee that they'll never allow a data breach so the data doesn't get 'lost' or 'stolen'?
Let's face it- if the data isn't already out there, it will be soon. And it's probably already out there.
It's just lipservice (Score:2)
The company's existing privacy policy states they may change it at any time, without prior notice.
Re: (Score:2)
The actual text:
Changes to this Privacy Statement
We may make changes to this Privacy Statement from time to time. We’ll let you know about those changes here or by reaching out to you via email or some other contact method, such as through in-app notification, or on another website page or feature.
They can change the terms when ever they want, how ever they want, without directly telling you, as long as it's on some website, somewhere. They don't need to tell you which website.
Sundar Pichai will buy it. (Score:1)
Crossed fingers? (Score:1)