WEBVTT - Ghost Guns & 23andMe Genetic Data Risk 0:00:02.759 --> 0:00:07.000 This is Bloomberg Law with June grosseol from Bloomberg Radio. 0:00:08.640 --> 0:00:11.760 In a seven to two decision, the Supreme Court today 0:00:12.039 --> 0:00:16.240 upheld the federal regulation of build at home ghost gun kits. 0:00:16.600 --> 0:00:19.840 The decision keeps in force a twenty twenty two rule 0:00:19.960 --> 0:00:24.200 put in place during the Biden administration that subjects commercially 0:00:24.280 --> 0:00:29.280 sold gunkits to the same requirements as fully assembled firearms, 0:00:29.720 --> 0:00:33.720 requiring serial numbers and background checks. Joining me is Bloomberg 0:00:33.760 --> 0:00:38.120 Supreme Court reporter Greg Store Greg This wasn't a Second 0:00:38.159 --> 0:00:40.240 Amendment case. What was the issue here? 0:00:40.640 --> 0:00:43.640 The issue is whether federal regulators, in particular the Bureau 0:00:43.640 --> 0:00:47.440 of Alcohol, Tobacco, Firearms and Explosives, had the authority to 0:00:47.760 --> 0:00:51.400 regulate these so called ghost gun kits under the existing 0:00:51.440 --> 0:00:54.360 gun laws. So, the existing gun laws give the government 0:00:54.440 --> 0:00:58.600 power to put regulations like background checks, things like that 0:00:59.080 --> 0:01:02.120 on fully bold firearms. And the question is, well, what 0:01:02.160 --> 0:01:03.440 if they're not fully assembled? 0:01:03.960 --> 0:01:07.640 And Justice Neil Gorsich wrote for the majority, the seven 0:01:07.920 --> 0:01:10.959 justices in the majority, what was the basis of his opinion? 0:01:11.319 --> 0:01:13.640 Yeah, so it was a pretty technical opinion. And looking 0:01:13.640 --> 0:01:16.080 he's very much a textualis likes to look at the 0:01:16.120 --> 0:01:18.280 text of the law, and so he looked at the 0:01:18.280 --> 0:01:21.120 text of the nineteen sixty eight Gun Control Act, and 0:01:21.240 --> 0:01:24.400 he said that the regulation that ATF had put in 0:01:24.440 --> 0:01:28.160 place to regulate these kids met within the definition of 0:01:28.560 --> 0:01:31.199 a firearm in that nineteen sixty eight law. 0:01:31.640 --> 0:01:36.280 Not surprising there were descents from Clarence Thomas and Samuel Alito. 0:01:36.760 --> 0:01:39.440 Yeah, so, at least on the surface, they were mostly 0:01:39.480 --> 0:01:43.960 focused on the language, and Justice Thomas disagreed with Justice 0:01:44.000 --> 0:01:48.559 Gorsich on what that nineteen sixty eight law allows. Justice 0:01:48.600 --> 0:01:51.240 thomas Is dissent was twenty six pages, so it too 0:01:51.400 --> 0:01:55.200 was very very technical. Justice Alito added his own descent 0:01:55.400 --> 0:01:58.360 that was a bit shorter and sort of focused on 0:01:58.400 --> 0:02:01.760 some of the procedural aspects of the case, including criticism 0:02:01.800 --> 0:02:04.840 that the way the Court decided the case as a 0:02:04.920 --> 0:02:08.560 so called facial challenge to this regulation wasn't exactly the 0:02:08.600 --> 0:02:09.440 way it was argued. 0:02:10.080 --> 0:02:13.720 So is a ruling in favor of gun regulations from 0:02:13.760 --> 0:02:17.240 this court a surprise to any extent. 0:02:17.639 --> 0:02:21.280 And it is perhaps a mild surprise, the argument suggested 0:02:21.320 --> 0:02:23.639 this might be the outcome. But if you go back 0:02:23.800 --> 0:02:27.359 just a term ago, a similar kind of argument, again 0:02:27.760 --> 0:02:30.560 having to do a statute or interpretation, not the Second Amendment. 0:02:30.680 --> 0:02:34.320 The court struck down the Trump administration's ban on so 0:02:34.440 --> 0:02:37.960 called bump stocks, those devices that convert a semi automatic 0:02:38.000 --> 0:02:41.520 weapon into something akin to a machine gun, so that 0:02:41.800 --> 0:02:45.440 decision perhaps voted poorly for this to the extent, both 0:02:45.440 --> 0:02:49.600 were actually focused on the extent of the federal government's 0:02:49.639 --> 0:02:53.120 authority over to regulate guns. But there are different statutes 0:02:53.200 --> 0:02:56.080 and different provisions, and so the cases came out differently. 0:02:56.600 --> 0:02:59.680 It was also a bit surprising considering that the Court 0:02:59.760 --> 0:03:02.560 has been so skeptical in the last couple of years 0:03:02.720 --> 0:03:08.200 of administrative agency powers, and I would say, particularly Justice. 0:03:07.960 --> 0:03:12.320 Gorsag, yes, he has been. And certainly if you look 0:03:12.360 --> 0:03:15.000 at that big decision from last term where the Court 0:03:15.080 --> 0:03:18.080 said we're no longer going to defer to agencies on 0:03:18.200 --> 0:03:20.960 the meaning of ambiguous statutes, that sort of thing does 0:03:21.000 --> 0:03:23.200 suggest that, you know, the Court isn't going to let 0:03:23.240 --> 0:03:26.120 agencies have their way in cases like this. But again, 0:03:26.480 --> 0:03:30.080 this is about this particular statute, and looking at the 0:03:30.120 --> 0:03:33.520 words of the statue, a majority of the Court said that, 0:03:33.760 --> 0:03:37.720 you know, just because a kit isn't fully assembled, if 0:03:37.720 --> 0:03:40.400 it still has the components of an ir arm, that's 0:03:40.600 --> 0:03:41.160 that's enough. 0:03:41.320 --> 0:03:43.920 Do we know how the Trump administration is going to 0:03:43.920 --> 0:03:46.840 handle this, because this is a rule from the Biden 0:03:46.880 --> 0:03:50.160 administration and he signed in order requiring the AG to 0:03:50.280 --> 0:03:52.960 review gun regulations. So is it sort of up in 0:03:53.000 --> 0:03:53.360 the air. 0:03:53.960 --> 0:03:57.160 Yeah, that's a really good point, and we don't know. Yes, indeed, 0:03:57.200 --> 0:03:59.800 it is up in the air. The Trump administration didn't 0:03:59.800 --> 0:04:03.800 take a position on this. The challengers to this regulation 0:04:04.400 --> 0:04:08.480 have called on the Attorney General, Pam Bondy, to take 0:04:08.480 --> 0:04:10.880 another look at this issue and toss out the regulation, 0:04:11.640 --> 0:04:14.000 and the Justice Department, when I asked them for comment, 0:04:14.560 --> 0:04:17.640 just said we support people's Second Amendment rights, which of 0:04:17.640 --> 0:04:20.120 course isn't what this case is about. So we really 0:04:20.120 --> 0:04:21.080 don't know what they're. 0:04:20.880 --> 0:04:21.320 Going to do. 0:04:21.880 --> 0:04:24.920 This was a reversal of the Fifth Circuit, the most 0:04:24.920 --> 0:04:28.799 conservative circuit in the country, and the oral arguments today 0:04:28.920 --> 0:04:33.960 regarding the FCC may also result in an overturning of 0:04:34.000 --> 0:04:34.799 the Fifth Circuit. 0:04:35.200 --> 0:04:38.200 It might well. The arguments to today are about this 0:04:38.279 --> 0:04:41.200 program known as the Universal Service Fund, which is a 0:04:41.240 --> 0:04:44.400 program eight billion dollar program run by the SEC that 0:04:44.480 --> 0:04:48.720 imposes a charge on your phone bill and uses that 0:04:48.839 --> 0:04:53.719 money to cover to subsidize phone and internet service for 0:04:54.000 --> 0:04:57.760 poor people, folks who live in rural areas, schools, libraries, 0:04:57.800 --> 0:05:01.480 rural hospitals, things like that, And it was a constitutional 0:05:01.560 --> 0:05:04.520 challenge saying that essentially the core of it was that 0:05:04.680 --> 0:05:08.400 Congress had delegated too much of its authority, too much 0:05:08.400 --> 0:05:11.840 of its taxing authority to the FCC to determine how 0:05:11.839 --> 0:05:15.120 big this fee is on your phone bill. And based 0:05:15.160 --> 0:05:18.119 on the argument today, it sounds like the Supreme Court 0:05:18.279 --> 0:05:22.600 isn't buying that that they are going to uphold this program. 0:05:23.080 --> 0:05:25.560 That would be another win for a federal agency in 0:05:25.600 --> 0:05:29.240 this term. I'm keeping track. I'm also trying to keep 0:05:29.279 --> 0:05:33.960 track of the Justice Department fast tracking cases over Trump's 0:05:34.000 --> 0:05:38.799 efforts to push the boundaries of executive power. Because today 0:05:38.800 --> 0:05:41.400 they asked for the Supreme Court to intervene in a case. 0:05:41.760 --> 0:05:44.600 They had already asked for the Supreme Court to intervene 0:05:44.640 --> 0:05:47.800 in another case on Monday. These are all being done 0:05:48.080 --> 0:05:51.200 on an emergency basis. Are they up to about six 0:05:51.240 --> 0:05:55.320 emergency requests in a little over two months. 0:05:55.160 --> 0:05:59.040 By my countage five times what they're asking for this week. Well, 0:05:59.080 --> 0:06:02.560 the most recent case has to do with teacher training programs. 0:06:02.800 --> 0:06:05.599 So the Trump administration is asking the Supreme Court to 0:06:05.680 --> 0:06:08.800 lift a lower court order, a district disorder that temporarily 0:06:08.880 --> 0:06:13.119 requires the government, the Education Department, to keep funding teacher 0:06:13.160 --> 0:06:16.960 training projects in eight states. The Education Department had said 0:06:16.960 --> 0:06:19.279 that it's canceling one hundred and four out of one 0:06:19.360 --> 0:06:24.240 hundred and nine grands. A US district judge said that 0:06:24.760 --> 0:06:28.080 the challengers to that are likely to succeed, that the 0:06:28.120 --> 0:06:32.480 cancelations are arbitrary and capricious, and so that judge issued 0:06:32.480 --> 0:06:36.080 a temporary restraining order saying you got got to keep 0:06:36.080 --> 0:06:39.720 paying those for now, and the Trump administration is now 0:06:39.760 --> 0:06:43.320 here asking the Supreme Court to lift that order so 0:06:43.400 --> 0:06:47.039 they can freeze those payments. The one earlier in the 0:06:47.080 --> 0:06:51.599 week on Monday had to do with efforts to fire 0:06:51.960 --> 0:06:58.160 a number of people in six different federal agencies, and 0:06:59.040 --> 0:07:02.279 the Justice Apartment is asking the Supreme Court to let 0:07:02.279 --> 0:07:06.279 it go ahead and fire those people, or at least 0:07:06.640 --> 0:07:09.840 not actually bring them back to the workplace, at least 0:07:09.840 --> 0:07:14.040 to just put them on administratively. This is a case 0:07:14.200 --> 0:07:17.800 out of California that is similar to another one in Maryland. 0:07:18.560 --> 0:07:23.600 The Supreme Court so far has not done anything with 0:07:23.720 --> 0:07:26.280 that one. And I say that they haven't even asked 0:07:26.280 --> 0:07:31.760 for a response from the nonprofit groups that are challenging this. 0:07:32.520 --> 0:07:35.880 And it maybe that the Supreme Court in that case 0:07:36.280 --> 0:07:40.280 wants to hold its fire because there's actually something still 0:07:40.360 --> 0:07:43.440 pending before the Ninth Circuit in that case. So a 0:07:43.440 --> 0:07:44.760 lot of stuff going on here. 0:07:45.360 --> 0:07:49.360 Are the justices perhaps getting numb to these emergency requests? 0:07:49.520 --> 0:07:53.600 You say five in a little over two months. I mean, 0:07:53.920 --> 0:07:58.320 has any other administration made so many emergency requests to 0:07:58.400 --> 0:08:01.120 the court in such a short period of time, and 0:08:01.160 --> 0:08:05.480 they're calling issues like birthright citizenship and emergency. 0:08:05.880 --> 0:08:09.040 Certainly, we've never seen anything like this, and of course 0:08:09.040 --> 0:08:12.520 we've never seen anything like the flurry of Trump executive 0:08:12.600 --> 0:08:15.720 orders that sparked an awful lot of this. The one 0:08:15.760 --> 0:08:17.880 thing I would say about the Supreme Court so far 0:08:18.080 --> 0:08:20.640 is it's pretty clear they are in no rest to 0:08:20.680 --> 0:08:25.040 get involved. The way they have handled cases up until 0:08:25.120 --> 0:08:29.240 now has been to sort of kick the can down 0:08:29.280 --> 0:08:32.040 the road, and I think we see that with you 0:08:32.120 --> 0:08:37.240 mentioned birthright citizenship. That's the case where the administration came 0:08:37.320 --> 0:08:40.000 here and said, hey, we need an emergency order at 0:08:40.120 --> 0:08:42.679 least limiting these lower court injunctions so that we can 0:08:42.840 --> 0:08:46.440 impose our new birthright citizenship restrictions in much of the country. 0:08:46.679 --> 0:08:49.240 The administrations that we need an emergency order, and then 0:08:49.280 --> 0:08:54.200 the Supreme Court gave an unusually long time for the 0:08:54.200 --> 0:08:56.360 folks on the other side to file a response, gave 0:08:56.400 --> 0:08:58.800 them three weeks. And that comes on top of some 0:08:58.840 --> 0:09:02.760 other some earlier stuff that really indicated the Court did 0:09:02.760 --> 0:09:06.640 not want to dive into these very contentious issues until 0:09:06.920 --> 0:09:08.120 it absolutely has to. 0:09:08.960 --> 0:09:11.440 One thing is certain, Greg, you are going to be 0:09:11.679 --> 0:09:15.960 very very busy over the next few years. Thanks so 0:09:16.040 --> 0:09:19.200 much for joining me tonight. That's Bloomberg Supreme Court reporter 0:09:19.320 --> 0:09:21.600 Greg store Well. 0:09:21.600 --> 0:09:25.240 Our journeys in life are all slightly different. My DNA 0:09:25.360 --> 0:09:28.920 journey started here with twenty three and meters, and it 0:09:29.000 --> 0:09:30.160 was all so simple. 0:09:30.960 --> 0:09:34.319 It may have been simple then, but it's getting complicated 0:09:34.440 --> 0:09:38.720 now as twenty three and meter file for bankruptcy, raising 0:09:38.800 --> 0:09:41.880 concerns about the future use of the genetic data it's 0:09:41.920 --> 0:09:46.120 collected from more than fifteen million customers. The laws provide 0:09:46.240 --> 0:09:50.160 very little protection for customers, and any future buyer of 0:09:50.200 --> 0:09:53.640 the trove of genetic data will likely have the last 0:09:53.720 --> 0:09:57.079 say on how they use it. My guest is Colin Walkee, 0:09:57.440 --> 0:10:00.160 a partner at hall Estel and leader of the firm 0:10:00.200 --> 0:10:04.880 cybersecurity and data privacy practice. Before we even get to 0:10:04.960 --> 0:10:09.360 what's happening now. In September, the company agreed to pay 0:10:09.440 --> 0:10:13.160 thirty million dollars to settle a class action lawsuit for 0:10:13.240 --> 0:10:16.120 a data breach that affected six point nine million of 0:10:16.120 --> 0:10:20.240 its users. Has a lot of their information already been compromised? 0:10:20.840 --> 0:10:24.559 Yes, And so here's the concerning part about the statistic 0:10:24.600 --> 0:10:27.560 you just gave about the data breach. That data breach 0:10:27.720 --> 0:10:31.280 affected roughly six million individuals. However, the vast majority of 0:10:31.280 --> 0:10:36.040 those individuals were of Osconazi Jewish descent or Chinese descent, 0:10:36.400 --> 0:10:39.400 meaning that it appears to have been a targeted attack 0:10:39.520 --> 0:10:43.720 in order to identify who is of Oscanazi heritage or 0:10:43.760 --> 0:10:48.040 who is of Chinese heritage. And so, yes, those six 0:10:48.040 --> 0:10:51.559 million individuals information is certainly out there somewhere. The remaining 0:10:51.679 --> 0:10:52.520 people who. 0:10:52.400 --> 0:10:56.080 Know twenty three and me's in bankruptcy. So is all 0:10:56.200 --> 0:11:00.000 the information it has, All the personal and genetic information 0:11:00.080 --> 0:11:03.560 nation going to be sold with the company. 0:11:04.120 --> 0:11:06.800 Well, that's the plan as of right now, is that 0:11:06.840 --> 0:11:09.679 they are looking for a buyer of that. And here's 0:11:09.720 --> 0:11:14.079 the reality is that our data is an asset, and 0:11:14.400 --> 0:11:18.640 that's why bought and sold with data brokers, and you know, 0:11:18.760 --> 0:11:23.440 openly traded. And so the consequence is those assets have value, 0:11:23.559 --> 0:11:28.439 Our data has values. And so yes, the plan is 0:11:28.440 --> 0:11:31.679 that in the bankruptcy proceeding, either twenty three and meters 0:11:31.720 --> 0:11:35.840 gets bought out as a whole entity, or perhaps the 0:11:35.880 --> 0:11:41.040 assets themselves get purchased, and then only the assets survive bankruptcy, 0:11:41.200 --> 0:11:42.400 not the entity itself. 0:11:43.240 --> 0:11:46.920 So the board chair issued a statement saying that twenty 0:11:46.920 --> 0:11:50.319 three in me is committed to continuing to safeguard customer 0:11:50.440 --> 0:11:54.320 data and being transparent about the management of user data 0:11:54.360 --> 0:11:57.319 going forward. Quote, any buyer of twenty three and meter 0:11:57.360 --> 0:12:00.520 will be required to comply with applicable law with respect 0:12:00.600 --> 0:12:03.920 to the treatment of customer data. What does that really mean? 0:12:05.200 --> 0:12:09.400 Not a lot in today's world. And the reason is is, 0:12:09.440 --> 0:12:13.040 as everyone's been discussing, there really isn't a federal law 0:12:13.559 --> 0:12:16.680 that governs this sort of circumstance. Even though we're talking 0:12:16.720 --> 0:12:21.120 about health information. HIPPA is not applicable because. 0:12:21.040 --> 0:12:23.800 Twenty three and me is not what's called a covered entity. 0:12:24.000 --> 0:12:26.679 Twenty three and meters is not required to abide by 0:12:27.160 --> 0:12:31.360 HIPPO rules. And regulations, then you have to ask yourself, Okay, well, 0:12:31.360 --> 0:12:34.199 what are the state requirements? And as a state requirements 0:12:34.240 --> 0:12:36.680 first and foremost, not every single state has a data 0:12:36.679 --> 0:12:39.800 privacy law. So, for example, in Oklahoma, I literally have 0:12:39.960 --> 0:12:42.520 no right to my data that may be housed within 0:12:42.600 --> 0:12:45.520 twenty three and me. There is no law that compels 0:12:45.559 --> 0:12:47.840 them to do anything that I asked them to do. 0:12:48.040 --> 0:12:51.000 And if I lived in a state, for example, like California, 0:12:51.480 --> 0:12:54.439 I don't necessarily have to give my consent in advance 0:12:54.520 --> 0:12:57.600 to the collection of my sensitive information. Versus a state 0:12:57.679 --> 0:13:01.160 like Colorado, I do have to give my affirmative consent 0:13:01.240 --> 0:13:04.400 for the collection of my sensitive data. But it then 0:13:04.440 --> 0:13:07.400 begs the question, if twenty three and me is purchased, 0:13:07.440 --> 0:13:09.960 do I have to give my consent again? And here's 0:13:10.000 --> 0:13:13.439 the other really truly concerning part about twenty three and 0:13:13.520 --> 0:13:16.840 meters statements. The biggest concern has to do with, for example, 0:13:16.880 --> 0:13:19.880 their terms of service, which they state can be changed 0:13:20.000 --> 0:13:22.480 at any time. And the same thing applies to their 0:13:22.480 --> 0:13:25.640 medical record privacy node, which they say may change from 0:13:25.679 --> 0:13:28.760 time to time. And so for an individual to come 0:13:28.800 --> 0:13:30.520 out and say that twenty three and meters is still 0:13:30.559 --> 0:13:33.160 going to continue to comply with the law. It begs 0:13:33.200 --> 0:13:37.240 the question with the law because in certain circumstances there 0:13:37.280 --> 0:13:40.280 aren't any laws that govern how they can use our data. 0:13:40.800 --> 0:13:44.920 Tell us a few ways in which this data could 0:13:44.960 --> 0:13:47.520 be used against customers in the future. 0:13:47.920 --> 0:13:51.800 So the biggest concern right now has to do with 0:13:52.200 --> 0:13:54.800 deep sakes, and we all know about AI technology and 0:13:54.800 --> 0:13:57.680 those sorts of things. And if an individual is able 0:13:57.720 --> 0:14:01.560 to identify someone's family tree through the genetic information that's 0:14:01.600 --> 0:14:04.920 been held by twenty three and meters, then that individual 0:14:05.080 --> 0:14:07.760 has a better ability to do a deep fake. Not 0:14:07.800 --> 0:14:09.559 only do I know your name, your address is so 0:14:09.720 --> 0:14:13.199 security number, but I now know your entire family tree. 0:14:13.640 --> 0:14:16.360 And so this type of information can be used for 0:14:16.400 --> 0:14:19.480 what we call synthetic fraud, where there's a real human 0:14:19.520 --> 0:14:22.960 being but is utilizing fake information. That's one of the 0:14:23.000 --> 0:14:26.880 major concerns. Another major concern again going back to targeted, 0:14:26.920 --> 0:14:29.800 hacked and AI. If you think back to the hacking 0:14:29.800 --> 0:14:31.960 of twenty three and meters in which the six million 0:14:32.080 --> 0:14:37.320 records were lost, they are identifying individuals with particular racial traits. 0:14:37.400 --> 0:14:39.960 So we have to be concerned not just about bad 0:14:40.040 --> 0:14:43.720 actors who have this information, but even quote unquote good 0:14:43.760 --> 0:14:47.760 actors like insurance companies, healthcare providers, school, any type of 0:14:47.800 --> 0:14:52.880 governmental agency or private agency. If they're wanting to evaluate 0:14:53.040 --> 0:14:56.080 you as a human being for credit worthiness, to get 0:14:56.120 --> 0:14:58.600 a house, to get a loan, one of the things 0:14:58.640 --> 0:15:01.840 they may look to is your information here genetic data. 0:15:01.880 --> 0:15:05.120 Do you have, for example, genes that might lead you 0:15:05.160 --> 0:15:07.760 to get ald time, Do you have genes that will 0:15:07.840 --> 0:15:10.000 lead to some sort of disease that in the future 0:15:10.080 --> 0:15:12.600 is going to cost an insurance company a ton of 0:15:12.640 --> 0:15:17.480 money and therefore they decline to ensure you base solely 0:15:17.520 --> 0:15:19.920 off of this genetic information. So there's a lot of 0:15:19.960 --> 0:15:24.240 discriminatory aspects to this, as well as targeted fishing attacks 0:15:24.240 --> 0:15:27.320 that can result from someone acquiring this data and information. 0:15:27.640 --> 0:15:32.760 So attorneys general in California, New York, Georgia, North Carolina, Virginia, 0:15:32.800 --> 0:15:36.720 and Florida to have sent out alerts warning that customers 0:15:36.840 --> 0:15:40.720 data could be sold in the proceedings and advising customers 0:15:40.760 --> 0:15:45.680 to delete their accounts and ask for their genetic samples back. 0:15:46.200 --> 0:15:49.480 So doing that with that you or the problem that 0:15:49.600 --> 0:15:52.880 customers may face when the information is sold. 0:15:53.280 --> 0:15:55.760 I would say that it certainly goes a very long way, 0:15:55.840 --> 0:15:58.160 because if you have asked them to delete their data, 0:15:58.200 --> 0:16:01.640 and again they're obligated either through their own contractual obligations 0:16:01.720 --> 0:16:04.720 or a state law to delete that data. That certainly 0:16:04.720 --> 0:16:07.360 goes a long way. One of the questions, though, that 0:16:07.480 --> 0:16:10.680 is bagged, is how they actually store that data and 0:16:10.720 --> 0:16:14.240 that information. So, for example, they may get Colin Walkee's 0:16:14.240 --> 0:16:17.800 genetic information because I voluntarily supplied it, and then they 0:16:17.920 --> 0:16:21.080 stored it in what we call an anonymized or to 0:16:21.160 --> 0:16:25.720 be more accurate, pseudonymized fashion, And what that means is 0:16:25.720 --> 0:16:28.600 is they block out all of Colin's phi, you know, 0:16:28.720 --> 0:16:31.640 identifiers to link back to Colin Walkie directly, and then 0:16:31.680 --> 0:16:34.360 you just have a data set sitting there. The question 0:16:34.480 --> 0:16:38.000 then is if I have another data set that doesn't 0:16:38.000 --> 0:16:40.280 have genetic information, right, but if I have a zip 0:16:40.320 --> 0:16:42.520 code or an address or something along those lines, can 0:16:42.560 --> 0:16:46.520 I re link that data back to Calin walking specifically, 0:16:46.840 --> 0:16:48.960 And that's something we don't know. So you may have 0:16:49.120 --> 0:16:52.360 your information deleted, but on their servers, they still retain 0:16:52.400 --> 0:16:55.720 a copy that is, for all intents and purposes anonymized. 0:16:55.960 --> 0:16:58.600 You look at it, you can't see anything. But if 0:16:58.600 --> 0:17:00.920 you link it to another data set, that might have 0:17:01.040 --> 0:17:05.480 some additional information, you could potentially reidentify individuals. So it 0:17:05.600 --> 0:17:07.760 certainly goes a long way. It may not cure the 0:17:07.920 --> 0:17:10.680 entire problem, but it's certainly the first and best steps 0:17:10.720 --> 0:17:11.080 to pay. 0:17:11.359 --> 0:17:15.840 Most states have health information exchanges. Do people have to 0:17:15.880 --> 0:17:17.119 worry about that as well? 0:17:17.720 --> 0:17:20.160 That's a very interesting question. I'm glad you brought that up, 0:17:20.240 --> 0:17:25.680 because health information exchanges are governed by HIPPA. The problem, however, 0:17:26.000 --> 0:17:29.400 is that many, if not most, if not all, are 0:17:29.440 --> 0:17:32.720 actually owned by third party right and so for example, 0:17:32.840 --> 0:17:37.200 idahos HIE a few years ago declared Chapter eleven bankruptcy 0:17:37.240 --> 0:17:39.520 and they fortunately worked out a plan, but they were 0:17:39.560 --> 0:17:41.800 kind of in twenty three and me's situation. And for 0:17:41.880 --> 0:17:45.119 individuals who don't know what an HIE is, it is 0:17:45.320 --> 0:17:48.160 a database where every time you go to see your doctor, 0:17:48.560 --> 0:17:52.879 your healthcare information is uploaded into this HIE. And in 0:17:53.000 --> 0:17:55.679 theory this is good because in theory that means that 0:17:55.720 --> 0:17:57.520 if you're in one part of the state where your 0:17:57.520 --> 0:18:01.320 primary care provider is not and you into an accident, well, 0:18:01.359 --> 0:18:03.679 whoever's taking care of you just logs into the HIE 0:18:03.840 --> 0:18:05.399 and is able to determine whether or not you have 0:18:05.440 --> 0:18:09.040 any sort of medical conditions or reactions or something like that, 0:18:09.119 --> 0:18:12.000 even though they've never treated you. The problem, however, is 0:18:12.280 --> 0:18:17.000 it increases the threat service for individuals to do cyber attacks. 0:18:17.040 --> 0:18:20.520 And if you have all four million Oklahomas information sitting 0:18:20.520 --> 0:18:23.520 in an HIE database, that's a very valuable database to 0:18:23.560 --> 0:18:26.200 get a hold up. And so hiees have a little 0:18:26.240 --> 0:18:29.760 bit more protection for consumers because of the Hippo compliance requirement, 0:18:30.040 --> 0:18:32.400 but they're just as dangerous because they're being held by 0:18:32.480 --> 0:18:36.080 third parties that are susceptible to hacks just like everybody else. 0:18:36.400 --> 0:18:39.560 So twenty three and meters has proposed a May fourteenth 0:18:39.640 --> 0:18:43.439 auction to sell its assets. Will the bankruptcy court be 0:18:43.640 --> 0:18:47.960 monitoring any aspects of the sale of the genetic. 0:18:47.560 --> 0:18:51.480 Data that depends. I could certainly see the situation in which, 0:18:51.520 --> 0:18:54.720 as part of the deal, an agreement is reached to 0:18:54.800 --> 0:18:57.520 comply with some sort of privacy law, whether that be 0:18:57.600 --> 0:19:01.840 Hippo or otherwise, and that the court signs off on. However, 0:19:02.400 --> 0:19:05.439 I don't know that a court can unilaterally make that 0:19:05.520 --> 0:19:09.399 decision and say you're going to treat the data this way. However, 0:19:09.440 --> 0:19:12.280 of twenty three and meters is serious about them abiding 0:19:12.280 --> 0:19:14.040 by the law and that they're going to do everything 0:19:14.040 --> 0:19:16.800 about board. Then there ought to be an agreement enter 0:19:16.880 --> 0:19:19.880 into a judicial order as to how these assets are 0:19:19.920 --> 0:19:22.280 going to be transferred and dealt with in the future. 0:19:22.560 --> 0:19:24.679 But absence in an agreement, I don't know that the 0:19:24.720 --> 0:19:27.359 court has the authority to then order them to do 0:19:27.400 --> 0:19:29.760 certain things with that healthcare data other than comply with 0:19:29.800 --> 0:19:30.399 state laws. 0:19:30.520 --> 0:19:33.360 After the assets are sold to a different company. Could 0:19:33.400 --> 0:19:38.160 the FTC step in or state attorneys general to monitor 0:19:38.200 --> 0:19:39.320 what's happening. 0:19:39.359 --> 0:19:42.280 Yes, I absolutely think so. Part of the problem with 0:19:42.440 --> 0:19:45.960 the state attorney general approach is just funding, right, I mean, 0:19:46.000 --> 0:19:48.880 if you think about how many tech companies are out 0:19:48.920 --> 0:19:52.760 there and trying to make sure they're complying with privacy regulations, well, 0:19:52.800 --> 0:19:55.280 I mean, good luck, right, I mean, we understand that's 0:19:55.320 --> 0:19:57.480 going to be a huge heavy load. But the flip 0:19:57.520 --> 0:20:00.480 side of that point is is that they still have 0:20:00.520 --> 0:20:04.240 to comply with the laws. The question, though, is how so, 0:20:04.320 --> 0:20:06.960 for example, in Colorado, that you have to get consent 0:20:07.160 --> 0:20:12.120 in order to process sensitive data such as your genetic information. Okay, 0:20:12.359 --> 0:20:14.920 twenty three and me got that consent, and now I 0:20:15.040 --> 0:20:17.160 purchased twenty three and me, do I have to get 0:20:17.200 --> 0:20:20.480 that consent. Again, it's still the same incity. Probably not 0:20:20.880 --> 0:20:25.159 if I just buy the asset, just buy the genetic information, well, 0:20:25.440 --> 0:20:28.480 maybe then I do have to get consent to utilize 0:20:28.480 --> 0:20:31.760 and further process that data. That's kind of an unknown 0:20:31.800 --> 0:20:34.400 at this day, but I certainly think that the AGS 0:20:34.480 --> 0:20:39.000 will have scrutiny, especially over anyone who purchases this. But again, 0:20:39.280 --> 0:20:42.480 out of the twenty six million people's information that's in 0:20:42.520 --> 0:20:45.040 that data set, do tell me how many of them 0:20:45.080 --> 0:20:48.200 live in state or countries with data privacy laws. 0:20:48.440 --> 0:20:52.480 So let's say someone is still interested in genetic testing, 0:20:52.960 --> 0:20:55.720 is there anything that they can do if they decide 0:20:55.760 --> 0:20:58.159 to sign up with one of these companies? Is there 0:20:58.160 --> 0:21:00.240 anything they can do to protect their data? 0:21:00.359 --> 0:21:03.320 No, because once you transfer your data into the hands 0:21:03.320 --> 0:21:06.840 of the third party, absent regulation, they're free to do 0:21:06.920 --> 0:21:09.760 whatever the heck do they want to with that data. 0:21:09.880 --> 0:21:13.480 It is truly the wild West, which is why Congress 0:21:13.520 --> 0:21:16.520 and the states need to get serious about enforcement, because 0:21:16.560 --> 0:21:19.600 the reality is even the laws on the books are 0:21:19.640 --> 0:21:23.240 not very strong laws. Every single law on the books 0:21:23.320 --> 0:21:26.280 is what's called opt out, which means that unless you 0:21:26.359 --> 0:21:29.159 tell them, don't collect and sell my information. That's what 0:21:29.240 --> 0:21:33.560 they're doing. And so here, yes, we're dealing with sensitive information. 0:21:33.640 --> 0:21:36.240 But aside from Colorado and a few other handfuls of tape, 0:21:36.880 --> 0:21:39.840 there's no rules on what individuals have to do. Just 0:21:39.880 --> 0:21:43.200 like Fitbit. How many people wear fitbit and are sharing 0:21:43.240 --> 0:21:47.280 their you know, sensitive biomedical information with fitbit. Millions of 0:21:47.320 --> 0:21:49.600 people are doing this on a daily basis, and I 0:21:49.640 --> 0:21:52.560 don't think that people appreciate the harm and the exposures 0:21:52.560 --> 0:21:56.879 that come from that type of to be frank, cavalier behavior. 0:21:57.320 --> 0:21:59.840 I appreciate that we all have, you know, an interest 0:21:59.880 --> 0:22:02.120 in our history and our camelin trees and those sorts 0:22:02.160 --> 0:22:05.640 of things, but I strongly encourage individuals to be careful 0:22:05.680 --> 0:22:08.120 with that type of data, to be frank with any 0:22:08.200 --> 0:22:10.639 of their data. But since we're talking twenty three and me, 0:22:10.880 --> 0:22:14.480 especially the genetic data, because unlike your social security numbers, 0:22:14.720 --> 0:22:18.120 unlike your name, unlike pretty much everything else about you, 0:22:18.119 --> 0:22:20.960 you cannot change your genetics. And if somebody gets a 0:22:21.000 --> 0:22:23.879 hold of that information, that is something that is immutable 0:22:23.960 --> 0:22:25.240 and cannot be changed. 0:22:25.600 --> 0:22:27.760 So this may end up being a sort of wake 0:22:27.840 --> 0:22:29.000 up call for people. 0:22:29.640 --> 0:22:32.239 I'm afraid that we've gotten to the point in our 0:22:32.320 --> 0:22:36.600