WEBVTT - TANGOTI: Are genetic testing services protecting our data? 0:00:03.279 --> 0:00:06.560 Have you ever thought about how incredibly complex I spit is. 0:00:07.240 --> 0:00:11.280 It may only be water, but just aliva isn't simple. 0:00:11.800 --> 0:00:16.400 That remaining one percent holds incredibly meaningful information that could 0:00:16.480 --> 0:00:19.400 change everything. And I'm not just talking about your family 0:00:19.440 --> 0:00:23.640 treat Hi. I'm Barrett to Day Thurston. And on this 0:00:23.680 --> 0:00:26.320 season of Spit and I Heart Radio podcast with twenty 0:00:26.320 --> 0:00:30.480 three and Me, we explore how DNA isn't just about ancestry, 0:00:30.800 --> 0:00:37.040 it can also be key to understanding your health. Hello, 0:00:37.360 --> 0:00:41.040 and welcome back. On today's show, we have Bridget Todd, 0:00:41.360 --> 0:00:44.720 host of the podcast There Are No Girls on the Internet. 0:00:45.320 --> 0:00:50.120 Each week, Bridget chronicles marginalized voices in technology, the voices 0:00:50.200 --> 0:00:52.839 that have always been at the forefront of tech, but 0:00:52.960 --> 0:00:57.760 far too often go overlooked. Bridget has investigated how marginalized 0:00:57.760 --> 0:01:01.280 communities are more likely to be impact by technology and 0:01:01.360 --> 0:01:05.000 historically have been skeptical of data collection and privacy. So 0:01:05.040 --> 0:01:07.479 when Bridget decided to take a twenty three and Me test, 0:01:08.000 --> 0:01:11.360 she saw an opportunity to not only gain insightful information 0:01:11.400 --> 0:01:14.800 on our ancestry and health, but also to alleviate concerns. 0:01:14.880 --> 0:01:17.520 And she had light on exactly how twenty three and 0:01:17.600 --> 0:01:22.960 me protects your information. In today's episode, Bridget unpacks her 0:01:23.000 --> 0:01:26.120 own hesitancy about taking the twenty three and ME test. 0:01:26.720 --> 0:01:29.160 As a critic of tech, she's examined the ways that 0:01:29.200 --> 0:01:34.000 privacy policies can, but sometimes don't, protect the intimate details 0:01:34.040 --> 0:01:37.160 of our lives. But when she reviewed twenty three and 0:01:37.240 --> 0:01:40.520 These privacy policy, Bridget was very happy to see a 0:01:40.520 --> 0:01:44.240 clear set of guidelines in plain English to help better 0:01:44.319 --> 0:01:47.560 understand all the ins and outs. Bridget sits down with 0:01:47.680 --> 0:01:50.800 Zarena Kovac from twenty three of These Data and Privacy 0:01:50.840 --> 0:01:54.520 Team to learn more. But that's not all. Bridget also 0:01:54.560 --> 0:01:57.480 shares some of what she learned from her reports, including 0:01:57.520 --> 0:02:00.320 the discovery of a whole bunch of cousins she didn't 0:02:00.360 --> 0:02:03.040 know she had. I know the feeling, Bridget, I know 0:02:03.320 --> 0:02:06.560 the feeling. It's a very important episode that you don't 0:02:06.560 --> 0:02:16.240 want to miss. Let's listen is There Are No Girls 0:02:16.240 --> 0:02:18.200 on the Internet. As a production of I Heart Radio 0:02:18.320 --> 0:02:25.200 and Unbossed Creative. I'm Bridget Todd, and this is There 0:02:25.200 --> 0:02:29.840 Are No Girls on the Internet. So it's probably no 0:02:29.960 --> 0:02:32.480 secret to anyone listening that I consider myself to be 0:02:32.520 --> 0:02:34.960 a bit of a tech critic. I just think it's 0:02:35.000 --> 0:02:38.160 important to interrogate who has the power and technology and 0:02:38.160 --> 0:02:40.639 how that power is being used. And this has been 0:02:40.680 --> 0:02:43.760 particularly important to me as somebody who is traditionally marginalized. 0:02:44.240 --> 0:02:47.080 So last Thanksgiving and my cousin was telling her family 0:02:47.400 --> 0:02:50.000 all about how he used the ancestry and DNA kit 0:02:51.000 --> 0:02:53.400 and me to find out more about our family legacy 0:02:53.400 --> 0:02:57.240 and history. The entire family was listening to him, completely 0:02:57.280 --> 0:03:00.160 captivated while he talked about what he had found, and 0:03:00.280 --> 0:03:02.840 I could already feel all their eyes on me, like 0:03:02.840 --> 0:03:04.440 they were all just waiting for me to reign on 0:03:04.480 --> 0:03:07.400 the parade. But it actually sounded like he had found 0:03:07.400 --> 0:03:10.040 out some pretty compelling information that made us all feel 0:03:10.120 --> 0:03:13.000 more deeply connected to our family story, which frankly had 0:03:13.000 --> 0:03:16.079 always been a little bit murky, so kind of out 0:03:16.080 --> 0:03:18.520 of character for me. I actually started to get pretty 0:03:18.560 --> 0:03:21.480 interested in DNA and ancestry kits like twenty three and me. 0:03:22.200 --> 0:03:24.800 But as interested as I was, I was also really 0:03:24.880 --> 0:03:27.280 really hesitant. You know, I knew it could be used 0:03:27.320 --> 0:03:29.960 to learn more about my family, my background, and to 0:03:30.040 --> 0:03:31.840 learn more about my health so I can make more 0:03:31.880 --> 0:03:36.880 informed choices, But I also know this whole fraught history 0:03:36.880 --> 0:03:40.320 of people, particularly our people when it comes to things 0:03:40.320 --> 0:03:44.280 like DNA being misused or worse, used against us. So 0:03:44.320 --> 0:03:46.880 I checked out twenty three's website and was surprised to 0:03:46.920 --> 0:03:50.120 find a privacy policy written more or less in plain 0:03:50.160 --> 0:03:53.280 English that I felt like I could actually kind of understand, 0:03:53.800 --> 0:03:56.920 you know. I read a ton of tech privacy policies 0:03:56.960 --> 0:03:58.880 for there are no girls on the Internet, and I 0:03:58.920 --> 0:04:01.280 feel like I have a pretty could handle on them. 0:04:01.320 --> 0:04:04.280 But I am no lawyer or data privacy expert, so 0:04:04.360 --> 0:04:07.160 I still had a lot of questions. So I turned 0:04:07.160 --> 0:04:17.280 to an actual expert. Hi, I'm Serena kervac Um at 0:04:17.320 --> 0:04:21.600 twenty three and me and my title is UM Director 0:04:21.680 --> 0:04:25.080 Senior Privacy Council. So there, Bena. I know that you've 0:04:25.160 --> 0:04:27.800 kind of been in this privacy space for a while. 0:04:28.200 --> 0:04:29.839 How did you get into this work? How did this 0:04:29.880 --> 0:04:31.400 come to be something that you do for a living? 0:04:32.440 --> 0:04:35.640 You know, it was so random. One day I learned 0:04:35.680 --> 0:04:39.120 about the e f F, the Electronic Frontier Foundation, and 0:04:39.160 --> 0:04:42.920 I was like, this sounds so interesting. You're thinking about 0:04:43.080 --> 0:04:46.719 digital identities and flipprints that people leave on the Internet, 0:04:46.800 --> 0:04:48.799 and um, I was in the midst of law school 0:04:48.800 --> 0:04:51.760 and I was like, uh, you know, I thought I 0:04:51.800 --> 0:04:54.760 was going to do intellectual property and I was not 0:04:54.880 --> 0:04:57.400 liking it, and un while I like, World of Privacy 0:04:57.480 --> 0:05:00.080 just seemed so fascinating, so um, I put all my 0:05:00.080 --> 0:05:03.600 eggs in one basket and just went for it. Yeah. 0:05:03.640 --> 0:05:05.960 E f F was one of my first for ways 0:05:06.040 --> 0:05:10.400 into thinking seriously about technology and sort of the implications 0:05:10.440 --> 0:05:12.880 of the trails that we leave online. And I had 0:05:12.920 --> 0:05:15.159 never really thought about it before, even as somebody who 0:05:15.200 --> 0:05:17.039 was like a super user of the Internet, until I 0:05:17.120 --> 0:05:20.680 really encountered their work. Yeah, and it's really good stuff. 0:05:20.680 --> 0:05:22.400 I think that they do a good job of making 0:05:22.440 --> 0:05:25.440 it very accessible and easy to understand and meeting people 0:05:25.560 --> 0:05:29.680 like who are regular consumers um and understanding like privacy 0:05:29.960 --> 0:05:32.440 and like what the Internet is like and what your 0:05:32.520 --> 0:05:35.680 data is. Okay, I'm so glad I'm talking to you 0:05:35.680 --> 0:05:38.240 about this because you're the expert. And when I went 0:05:38.279 --> 0:05:40.000 to do my twenty three and me, I of course 0:05:40.080 --> 0:05:42.640 had questions, and one of the things I appreciated was 0:05:42.680 --> 0:05:46.000 that the questions, like the answers about privacy on the 0:05:46.000 --> 0:05:49.200 twenty three and the side are actually like pretty plain English. 0:05:49.240 --> 0:05:51.400 I read a lot of privacy policies and I'm like, 0:05:51.440 --> 0:05:53.880 I'm no lawyer, I do not understand this. So I 0:05:53.920 --> 0:05:57.920 really appreciated that they're pretty straightforward and like I felt 0:05:57.960 --> 0:05:59.680 like I could have a handle on them. But I'm 0:05:59.680 --> 0:06:02.120 really that I'm talking to you because you're the expert. 0:06:02.160 --> 0:06:04.159 And so, you know, as we know, we're in this 0:06:04.240 --> 0:06:08.120 climate where folks, particularly people who are marginalized, are understandably 0:06:08.279 --> 0:06:10.880 pretty concerned about privacy when it comes to their data. 0:06:11.240 --> 0:06:15.400 Is that something that twenty three and Me takes really seriously. Yeah. Absolutely, 0:06:15.600 --> 0:06:17.160 you know, I think some of the things that you'll 0:06:17.160 --> 0:06:19.440 see all over our website is you know, choice and 0:06:19.440 --> 0:06:24.400 transparency being our key values in our privacy approach our customers. 0:06:24.440 --> 0:06:26.360 It's really important to us that our customers are in 0:06:26.480 --> 0:06:28.840 control of their data and we don't make any assumptions 0:06:28.839 --> 0:06:31.080 about the way that they want to share their information 0:06:31.520 --> 0:06:35.120 when we build out our features. UM customers make choices 0:06:35.200 --> 0:06:38.040 about whether they want to view certain sensitive health information 0:06:38.520 --> 0:06:40.880 or you know, with whom they want to share their information, 0:06:40.960 --> 0:06:43.599 whether they want to participate in certain features or programs 0:06:43.600 --> 0:06:46.719 such as DNA Relatives or twenty three and me research. 0:06:47.360 --> 0:06:51.400 UM and Customer choice also means allowing individuals to change 0:06:51.400 --> 0:06:53.440 their mind at any time. UM. You know, if you 0:06:53.480 --> 0:06:56.120 want to revoke your consent to participate in research or 0:06:56.680 --> 0:06:59.479 um DNA relatives, it's easy to do that at any time, 0:07:00.080 --> 0:07:04.040 Just go to your account settings and boop, you're out. UM. 0:07:04.120 --> 0:07:08.120 And these meaningful choices are also like they require transparency, 0:07:08.320 --> 0:07:11.320 and we work hard to make that information accessible, including 0:07:11.400 --> 0:07:14.000 presenting that information in a way that's easy to understand. 0:07:14.000 --> 0:07:16.480 And sometimes that can be hard, and it's an iterative approach, 0:07:17.240 --> 0:07:20.560 especially as you're dealing with like not only like the Internet, 0:07:20.600 --> 0:07:23.680 but genetic information and like there's a lot of you know, 0:07:24.640 --> 0:07:27.440 fun interesting things that can come out of that UM. 0:07:27.480 --> 0:07:30.240 And recently we've updated our privacy statement to add like 0:07:30.320 --> 0:07:34.600 more graphics and visuals to improve readability. UM. And we 0:07:34.600 --> 0:07:37.080 were very closely with our customer care team because they're 0:07:37.080 --> 0:07:39.160 the ones who really like talk to our customers, have 0:07:39.240 --> 0:07:41.920 that first touch to be able to address those privacy 0:07:41.960 --> 0:07:46.440 topics and concerns UM that are important to people. Yeah, 0:07:46.480 --> 0:07:49.040 that's really helpful. I know there are so many reasons 0:07:49.080 --> 0:07:51.400 that a person might decide to undergo the kind of 0:07:51.400 --> 0:07:54.080 genetic testing that twenty three and MEDAS and you being 0:07:54.080 --> 0:07:56.480 part of the privacy part, you being part of the 0:07:56.480 --> 0:07:58.360 privacy team, I know that part of your job is 0:07:58.400 --> 0:08:00.600 to think about the risks involved than that, what do 0:08:00.640 --> 0:08:01.960 I have that right? Is that a big part of 0:08:01.960 --> 0:08:04.800 your job? Oh? Yeah, for sure. So at twenty three 0:08:04.800 --> 0:08:06.760 and me, I'm you know, there's me, and there's a 0:08:06.760 --> 0:08:10.320 whole privacy team that works cross functionally with like nearly 0:08:10.400 --> 0:08:13.840 every team in the company to think through how we 0:08:13.960 --> 0:08:16.800 use data and the risks involved so that we maintain 0:08:16.840 --> 0:08:20.520 not only our strict privacy commitments to our customers, but 0:08:20.680 --> 0:08:22.840 to also provide them with a secure and private place 0:08:22.880 --> 0:08:25.040 to learn about themselves and make sure we comply with 0:08:25.200 --> 0:08:29.000 a tapestry of evolving privacy laws. Um and we work 0:08:29.040 --> 0:08:34.200 a little closely with teams like product engineering, security, marketing, HR, 0:08:34.320 --> 0:08:37.600 coustomer care research and everyone in between to do that. 0:08:38.240 --> 0:08:41.040 Um and. So, when you think about it, privacy not 0:08:41.080 --> 0:08:43.520 only should be at the heart of every single cup organization, 0:08:43.559 --> 0:08:46.600 but especially a place like twenty three and me where 0:08:46.600 --> 0:08:50.000 we are dealing with such sensitive data. You know, whenever 0:08:50.120 --> 0:08:52.400 a new product or idea comes up, we work with 0:08:52.400 --> 0:08:55.240 our product and engineering teams very closely at the early 0:08:55.320 --> 0:08:59.320 stages to address those privacy risks early on. Rather than later, 0:08:59.480 --> 0:09:02.360 so it's not like an ad hoc solution at the end. 0:09:03.040 --> 0:09:05.080 UM and we also continue to work with you know, 0:09:05.200 --> 0:09:09.080 other UM stakeholders outside of our company, like the Future 0:09:09.120 --> 0:09:11.800 of Privacy Forum the FPF UM. It's a think tank 0:09:11.840 --> 0:09:15.640 and advocy advocacy group that's focused on data privacy. We've 0:09:15.679 --> 0:09:19.480 collaborated with them and other genetic testing companies to develop 0:09:19.880 --> 0:09:24.600 consumer genetic testing industry best practices. UM and twenty three 0:09:24.600 --> 0:09:28.160 and is also part of a Coalition for Genetic Data 0:09:28.160 --> 0:09:31.520 Protection UH, the c GDP UM and we work to 0:09:31.559 --> 0:09:36.200 advance legislation and policies that support privacy and security for 0:09:36.800 --> 0:09:39.880 UM genetic data, so all genetic testing companies will be 0:09:40.160 --> 0:09:42.880 held to that same high standard that we have. And 0:09:42.920 --> 0:09:45.280 so those are all of the great things that we 0:09:45.320 --> 0:09:48.000 get to work on as the privacy team. Can you 0:09:48.040 --> 0:09:50.120 tell me, like, walk me through some of the steps 0:09:50.160 --> 0:09:52.360 that twenty three and ME does take to keep people's 0:09:52.720 --> 0:09:55.440 data secure. Yeah, there's a lot that goes into that. 0:09:55.600 --> 0:10:00.319 So UM twenty three and ME is ISO sort of fide. 0:10:00.360 --> 0:10:03.520 We also hold other certifications to confirm our commitment to 0:10:03.840 --> 0:10:09.240 customer security and privacy. Um ISO certifications are awarded after 0:10:09.400 --> 0:10:12.719 extensive audits by an independent third party, so not within 0:10:12.800 --> 0:10:15.920 twenty three and me UM, and we've been identified, we've 0:10:15.920 --> 0:10:21.520 been certified under IS one seven oh one and twenty 0:10:21.559 --> 0:10:24.920 seven eighteen UM and we're the first directed consumer genetic 0:10:24.920 --> 0:10:28.360 testing company to be assessed against all those three standards. 0:10:28.920 --> 0:10:30.800 So that's what we do on like the security front, 0:10:30.880 --> 0:10:32.760 and there's a lot more. You know, we encrypted our 0:10:32.800 --> 0:10:36.320 customer data so that like it's obviously more secure, so 0:10:36.440 --> 0:10:40.000 INCRUP customer data. We limit access to customer data internally, 0:10:40.400 --> 0:10:44.240 and we store data like in segregated databases, so it's 0:10:44.280 --> 0:10:47.680 not like we just lump everything together UM. For example, 0:10:47.720 --> 0:10:51.920 of customers, registration information like their name an email is 0:10:51.960 --> 0:10:55.760 separately stored from their genetic information UM, and so this 0:10:55.800 --> 0:11:00.400 reduces the risk of and incentive to commit a breach UM. 0:11:00.440 --> 0:11:04.760 And we also empower customers to take UM take their 0:11:04.880 --> 0:11:07.640 like security in their own hands, and we give them 0:11:07.679 --> 0:11:12.320 tools like to step verification UM and other other like 0:11:12.600 --> 0:11:15.040 guidance materials and things like that to keep themselves safe 0:11:15.080 --> 0:11:18.520 and play that important role in maintaining their account security. 0:11:20.120 --> 0:11:22.920 What about for folks who might be genetically rare, who 0:11:23.000 --> 0:11:26.280 might be thinking like I have something particular about my 0:11:26.320 --> 0:11:29.280 genetics that I feel might identify me or there's particular 0:11:29.400 --> 0:11:34.120 ways that you all, UM could approach that kind of privacy. Yeah, 0:11:34.240 --> 0:11:38.480 definitely UM For twenty three and me customers, as I mentioned, 0:11:38.480 --> 0:11:41.640 like controls really important UM and how they how someone 0:11:41.679 --> 0:11:44.679 wants to use their data or share it, they get 0:11:44.720 --> 0:11:47.600 to make that choice. In addition to like the privacy 0:11:47.640 --> 0:11:51.120 and security protections that we've talked about, UM, we have 0:11:51.280 --> 0:11:54.520 the identification that we employ, so you know, removing that 0:11:54.679 --> 0:11:59.040 registration information from genetic information and so on. That's a 0:11:59.080 --> 0:12:01.720 measure of protection. We you know, store things in separate 0:12:01.720 --> 0:12:05.400 places so that things aren't on together. UM. Customers who 0:12:05.440 --> 0:12:08.280 want to participate in things like research, UM, they can 0:12:08.320 --> 0:12:10.160 rest as shirt that we do take many measures to 0:12:10.200 --> 0:12:15.679 protect their research participants and minimize associated with that participation. UM. 0:12:15.800 --> 0:12:20.559 Not only are there access controls for customer information UM, 0:12:20.640 --> 0:12:22.320 there are people you know, like we go buy role 0:12:22.320 --> 0:12:25.360 based functions, so like not you know, one person doesn't 0:12:25.360 --> 0:12:27.520 have access to every single customer at twenty three and ME. 0:12:27.880 --> 0:12:30.000 It really depends on what their role is and what 0:12:30.120 --> 0:12:33.560 makes sense for them to have access to UM and 0:12:33.920 --> 0:12:37.160 under our main research consent UM when we share research 0:12:37.200 --> 0:12:40.120 results outside of twenty three and ME, whether that's like 0:12:40.160 --> 0:12:43.360 in a publication or with a third party collaborator, we 0:12:43.400 --> 0:12:47.960 only share like the summary advocate information UM, and those 0:12:48.000 --> 0:12:52.320 summer results in twenty three and publications are like statistics 0:12:52.440 --> 0:12:56.800 or calculations UM that describe like the research findings UM 0:12:56.840 --> 0:13:00.520 about some genetic associations that were discovered. UM. So for 0:13:00.559 --> 0:13:03.080 an example, it's like, you know, in our study, variant 0:13:03.679 --> 0:13:06.760 X was present in five percent of participants and was 0:13:06.800 --> 0:13:11.920 associated with a higher risk of this disease. UM. And 0:13:11.960 --> 0:13:16.160 so if a customer chooses to UM not often to 0:13:16.200 --> 0:13:18.760 participate in research, or they were in research and then 0:13:18.760 --> 0:13:22.000 they change their mind, UM, they're still able to access 0:13:22.040 --> 0:13:24.200 all of the same reports and product features as a 0:13:24.200 --> 0:13:28.240 customer who is participating in the research program. So UM, 0:13:28.280 --> 0:13:30.000 you know, not only are there all these like different 0:13:30.280 --> 0:13:34.440 privacy and security safeguards UM that customers can take themselves, 0:13:34.440 --> 0:13:36.679 but we also make sure that we're really like keeping 0:13:36.760 --> 0:13:40.920 data segregated, keeping access really locked down limited. But we're 0:13:40.960 --> 0:13:43.360 also you know, in those instances like research where there 0:13:43.400 --> 0:13:47.120 is that collaboration with outside collaborators, you know, making sure 0:13:47.160 --> 0:13:50.959 that like that data is the identified, aggregated and really 0:13:51.000 --> 0:13:57.600 minimized UM really really minimize at risk to our participants. Yeah, 0:13:57.640 --> 0:13:59.360 I mean that's that's good to hear, and you kind 0:13:59.360 --> 0:14:02.400 of touched on it it, you know, especially given the 0:14:02.480 --> 0:14:04.400 kind of climate that we're in. I know, the big 0:14:04.480 --> 0:14:07.560 question everybody has every time I give any kind of 0:14:07.640 --> 0:14:10.480 information about myself to anyone anywhere, The big question is 0:14:10.480 --> 0:14:13.080 always like what third parties are they? Are they giving 0:14:13.120 --> 0:14:15.840 this information to write? Like I might consent to my 0:14:15.880 --> 0:14:18.120 information being shared with twenties three and me, but are 0:14:18.120 --> 0:14:20.040 they selling my data? Are they? Are they going to 0:14:20.120 --> 0:14:22.240 give it to police? Like? How are they working with 0:14:22.680 --> 0:14:24.960 organizations and institutions that are not twenty three and me? 0:14:25.080 --> 0:14:28.080 So can you tell me a bit about how twenty 0:14:28.120 --> 0:14:31.080 three and me handles data when it comes to third parties? Yeah, yeah, 0:14:31.120 --> 0:14:33.520 of course, I think. You know, like, just like every company, 0:14:33.560 --> 0:14:36.160 we have service providers who help us do the things 0:14:36.160 --> 0:14:38.760 that we do, from like operating the business to improving 0:14:38.800 --> 0:14:42.400 it UM And there's also you know, choices that a 0:14:42.440 --> 0:14:46.240 customer can make about how their data is being handled 0:14:46.240 --> 0:14:48.840 throughout the platform, like whether they want to participate in 0:14:48.920 --> 0:14:52.120 research UM and so in that case, if someone does 0:14:52.120 --> 0:14:55.800 participate in research, we only share their data based on 0:14:55.840 --> 0:14:59.320 their explicit consent, and you know again that whole participation 0:14:59.400 --> 0:15:04.000 is often entirely voluntary. So it's really about making sure 0:15:04.040 --> 0:15:07.280 that the customer is pretty aware of who they're sharing 0:15:07.560 --> 0:15:11.080 who their information will be shared with. Absolutely, Yes, that 0:15:11.120 --> 0:15:13.880 makes a lot of sense. And but there's so many 0:15:14.000 --> 0:15:18.320 other like genetic testing. You know, kids out there UM 0:15:18.360 --> 0:15:22.040 are there just sort of like talking to usually put 0:15:22.080 --> 0:15:24.840 me at ease in terms of like the privacy risks. 0:15:24.840 --> 0:15:28.440 But I wonder, like are their privacy risks associated with 0:15:28.440 --> 0:15:30.880 with genetic testing in general that folks should just be 0:15:30.920 --> 0:15:32.800 aware of if this is something they're going to decide 0:15:32.840 --> 0:15:35.360 to do for themselves. Yeah, you know, I think some 0:15:35.440 --> 0:15:38.800 of the main privacy risks consumer may have. Consumers may 0:15:38.840 --> 0:15:43.960 have UM concerned things like finding out stuff about themselves 0:15:44.520 --> 0:15:46.600 or their family that they may not be prepared to 0:15:46.680 --> 0:15:50.560 learn about UM and also law enforcement access into genetic 0:15:50.600 --> 0:15:54.160 data UM so at twenty three and me. UM customers 0:15:54.160 --> 0:15:57.240 are not automatically visible to others in the platform. You know, 0:15:57.320 --> 0:16:01.040 they have to UM opted to in a relatives and 0:16:01.080 --> 0:16:03.520 if they do, then they become visible to others and 0:16:03.600 --> 0:16:07.240 they can also see who their genetic relatives are and 0:16:07.280 --> 0:16:11.280 see those results. UM. Additionally, customers can also choose on 0:16:11.320 --> 0:16:14.520 an often basis whether they want to see health reports, 0:16:14.600 --> 0:16:18.880 particularly any sensitive health reports like our BRACA reports for 0:16:18.920 --> 0:16:22.680 breast cancer risks and UM. We have educational materials and 0:16:22.720 --> 0:16:25.080 training modules and things like that to also support and 0:16:25.120 --> 0:16:28.840 prepare customers for that kind of information that they might receive. 0:16:29.520 --> 0:16:32.360 And on the law enforcement access front, we are the 0:16:32.520 --> 0:16:35.480 first direct to consumer genetic custing company to publish a 0:16:35.640 --> 0:16:39.880 transparency report UM and that happened back in two thousands fifteen. UM. 0:16:39.920 --> 0:16:43.480 It details you know, the types of law enforcement requests 0:16:43.480 --> 0:16:46.600 that we've received and how we've responded UM. And this 0:16:46.680 --> 0:16:49.520 is updated on a quarterly basis, and so far, we 0:16:49.560 --> 0:16:52.920 haven't released any individual user data UM to any law 0:16:53.000 --> 0:16:57.320 enforcement UM. And you know, something to be aware of 0:16:57.480 --> 0:17:00.000 is also like that not all genetic custing companies share 0:17:00.040 --> 0:17:02.760 these same values UM that we might have a twenty 0:17:02.800 --> 0:17:05.000 three and so it's really important that customers who are 0:17:05.000 --> 0:17:09.199 concerned with things like law enforcement request or how are 0:17:09.240 --> 0:17:12.959 they going to become visible to other potential genetic relatives 0:17:13.080 --> 0:17:14.840 or you know, the health reports that they're about to 0:17:14.840 --> 0:17:17.399 get UM, those are things that are really important to 0:17:17.440 --> 0:17:25.920 look into, um before choosing a genetic testament provider. More 0:17:25.960 --> 0:17:40.000 after a quick break, let's get right back into it. Yeah, 0:17:40.119 --> 0:17:41.920 just ask someone, I mean, like, while I've got you here, 0:17:42.000 --> 0:17:44.800 as someone who knows a lot about privacy, what do 0:17:44.840 --> 0:17:47.879 you see as the biggest privacy risk today that folks 0:17:47.880 --> 0:17:50.639 should be aware of and have on their radar. Well, 0:17:50.680 --> 0:17:56.240 I don't mean for this to sound like a uh, 0:17:56.240 --> 0:17:57.960 I don't mean for this has done like a general 0:17:58.200 --> 0:18:00.480 sort of like response here, but I do think that 0:18:00.520 --> 0:18:05.080 one of the biggest privacy risks across industries, not just 0:18:05.080 --> 0:18:09.000 genetic genetic testing, is that technology is rapidly changing and 0:18:09.040 --> 0:18:12.920 evolving the way that we collect, interpret, use, share data, 0:18:13.280 --> 0:18:15.760 and the laws are not necessarily keeping up with that. Um. 0:18:15.800 --> 0:18:18.080 There are a lot of positives that come from technology 0:18:18.160 --> 0:18:21.680 changing so quickly, Like you know, you have more data, 0:18:21.840 --> 0:18:25.640 better insights, and there's more potential impact to your personal 0:18:25.640 --> 0:18:29.119 health and wellness. Um. However, like the privacy risks that 0:18:29.200 --> 0:18:30.959 come with that can be hard to predict. So it's 0:18:31.000 --> 0:18:35.080 important that customers and like companies especially embrace privacy by 0:18:35.119 --> 0:18:38.880 design values and get ahead of those risks. Um. Um, Yeah, 0:18:38.960 --> 0:18:41.840 get ahead of those risks. Yeah, are there are there 0:18:41.840 --> 0:18:44.320 any tips or ways that you would give folks to 0:18:44.400 --> 0:18:47.240 like try to stay ahead of that. Like I am 0:18:47.320 --> 0:18:49.560 someone who is I make a tech podcast. I try 0:18:49.560 --> 0:18:51.919 to stay plugged in, but even things change and I 0:18:51.920 --> 0:18:53.720 don't realize that, Like, are there are there ways that 0:18:53.760 --> 0:18:56.720 folks can kind of get ahead of that. That's a 0:18:56.720 --> 0:19:00.840 good question, I think, Um, you know, it's just really 0:19:00.920 --> 0:19:03.359 it's kind of hard. There's so much going on at 0:19:03.400 --> 0:19:06.920 any given time. UM. And you have certain industries that 0:19:06.960 --> 0:19:09.440 are like going to change the way that we see 0:19:09.440 --> 0:19:11.600 the world in ten years, like you know, machine learning 0:19:11.600 --> 0:19:14.800 and AI and so on. UM. But I think, like, 0:19:14.840 --> 0:19:17.320 you know, as a consumer, it's just really important to 0:19:17.480 --> 0:19:19.760 understand how your data is being used and whether like 0:19:19.960 --> 0:19:22.760 the values of a company are aligned with what you 0:19:22.800 --> 0:19:27.080 care the most about, you know, any given sort of interaction. UM. 0:19:27.119 --> 0:19:29.119 You know, as I mentioned for like genetic testing, what 0:19:29.240 --> 0:19:31.240 a lot of consumers tend to be concerned about is 0:19:31.320 --> 0:19:34.200 you know, law enforcement access or you know, what they're 0:19:34.240 --> 0:19:38.400 gonna learn and how they're gonna be coached through that experience. UM. 0:19:38.600 --> 0:19:40.280 And so you want to make sure if those are 0:19:40.280 --> 0:19:41.919 things that are important to you, that you will like 0:19:42.040 --> 0:19:45.520 find the right provider for that um so, short of 0:19:45.560 --> 0:19:49.560 telling you read the privacy statements and like I know, 0:19:49.880 --> 0:19:54.359 I know, sure, you know you like just being smart 0:19:54.480 --> 0:19:57.480 about like how you're engaging with companies and the data 0:19:57.520 --> 0:19:59.800 that you provide uh to them, I think is key. 0:20:00.400 --> 0:20:05.359 And you know, also understanding that these companies are like 0:20:06.200 --> 0:20:08.000 wanting to make sure that you're picking companies that are 0:20:08.040 --> 0:20:12.119 thinking about privacy by design UM where it's not like 0:20:12.280 --> 0:20:15.640 something that you wire on or you put into the 0:20:15.640 --> 0:20:18.119 back end and like or at the end of the project, 0:20:18.560 --> 0:20:20.359 and rather you think about it from the beginning. Like 0:20:20.400 --> 0:20:23.000 the way that we thought about segregating our databases to 0:20:23.080 --> 0:20:26.640 make sure that there isn't like one pool of data. Uh. 0:20:26.880 --> 0:20:29.840 That was something that was thought about the first days 0:20:29.920 --> 0:20:33.720 that three and Me was created um SO, and for 0:20:34.000 --> 0:20:36.240 you know, the time that that was the two thousands, 0:20:36.280 --> 0:20:38.600 that was pretty innovative compared to like some of the 0:20:38.600 --> 0:20:42.280 other companies out there, UM and so, I think like 0:20:42.440 --> 0:20:45.600 it's really about picking companies that think about privacy at 0:20:45.600 --> 0:20:49.119 the ideation stages and implementing those privacy by design values 0:20:49.160 --> 0:20:52.680 and thinking into their business processes UM that are going 0:20:52.760 --> 0:20:57.160 to be the clear winners for consumers who care about privacy. UM. 0:20:57.280 --> 0:20:59.199 The other piece of it, too is I think, you know, 0:21:00.200 --> 0:21:03.280 legislation is starting to catch up on these privacy issues. UM. 0:21:03.320 --> 0:21:05.840 And we've welcomed, you know, that's want to commit. We've 0:21:05.880 --> 0:21:09.160 welcomed a lot of legislation on the genetic privacy front. 0:21:09.280 --> 0:21:14.360 There's half a dozen date states such as California, Arizona, Utah, 0:21:14.880 --> 0:21:19.920 UM and more and that have legislated on genetic privacy specifically. UM. 0:21:20.000 --> 0:21:22.200 And we hope to see federal legislation on this front 0:21:22.200 --> 0:21:26.040 as well. UM that goes beyond Gina, the Genetic Information 0:21:26.119 --> 0:21:32.199 Nondiscrimination Act. UM. Yeah, awesome, that's really helpful. I have 0:21:32.240 --> 0:21:35.000 one last rapid fire question for you. What is it 0:21:35.040 --> 0:21:37.159 like to be in what I can only assume is 0:21:37.200 --> 0:21:42.160 a super male dominated space, you know, privacy law. If 0:21:42.400 --> 0:21:43.920 I don't know for sure, I don't have the data 0:21:43.960 --> 0:21:46.120 in front of me, but I feel like it's probably 0:21:46.240 --> 0:21:49.560 very male dominated. Is that is that accurate to say? 0:21:49.720 --> 0:21:52.280 Actually kind of surprising. One thing that drew me into 0:21:52.320 --> 0:21:54.840 privacy was that there was a lot of there is 0:21:55.000 --> 0:21:59.280 still a lot of women in privacy. UM. And you know, 0:21:59.359 --> 0:22:02.679 I think what the draw is is that it is 0:22:02.840 --> 0:22:09.040 very like it's very privacy is not something that like you, 0:22:09.800 --> 0:22:13.560 it's very um contextual, like there, you know, it takes 0:22:13.640 --> 0:22:19.879 a lot of understanding different cultures and um, understanding different perspectives, 0:22:20.400 --> 0:22:22.480 and so I do think it actually has a lot 0:22:22.560 --> 0:22:25.200