00:00:00
Dan Loney: Well, the bankruptcy case of
genetic testing site 23andMe is
00:00:04
bringing forward an interesting
case around personal data to
00:00:08
dive deeper into. What should
people do who have provided
00:00:12
personal data to one company but
see it gets sold to another?
00:00:16
Gideon Nave is Associate
Professor of Marketing here at
00:00:18
the Wharton School, and he joins
us right now. Gideon, great to
00:00:21
talk to you again. How are you,
sir?
00:00:23
Gideon Nave: I'm well. Always great to talk
to you too. - I would guess
00:00:26
that when you have instances
like this, that for the most
00:00:30
part, people don't necessarily
even think about the data. It's
00:00:34
just kind of part of doing
business here.
00:00:37
- Yeah, I mean, we do know that
our data is everywhere and
00:00:41
moving around between entities,
sometimes without very clear
00:00:46
understanding of us and
transparency of this process.
00:00:50
But I think genetic data is
something a bit more special
00:00:54
than just what we buy and what
we like on Facebook.
00:00:59
- What makes this so important in
your mind?
00:01:03
- There are several layers here,
but I'd say the number one layer
00:01:06
is that our genetic data is
something that we cannot change
00:01:09
about ourselves. We are born
with it. You can measure it for
00:01:12
us even before we are born,
and it continues to follow us
00:01:18
throughout our lives. So you
know, I may be able to change my
00:01:21
behavior, but I will not be able
to change my genetics. And my
00:01:25
genetics includes information
for many other things that,
00:01:28
because they are determined by
genetics. Even to some degree, I
00:01:32
mean, many things are just
partly determined by genetics,
00:01:35
like personality and so on. But
even these things, the genetic
00:01:40
component of it, I will not be
able to change about myself, and
00:01:44
this data includes information
about it. Not to mention that
00:01:48
lots of these things are things
that I even don't know about
00:01:51
myself, that maybe are in the
data and I'm not aware of it.
00:01:55
Maybe I will even choose to not
know deliberately. I will not
00:01:58
want to know about it. That's
just the first layer. I mean, I
00:02:01
can continue with many other
layers.
00:02:03
- So the concern would probably
be, if a company were to acquire
00:02:08
the data that maybe is not
necessarily in that field, but
00:02:12
is looking to maximize potential
profitability
00:02:16
of that data. - Yeah, I mean,
let's say it this way. You
00:02:20
know, they say it in the Silicon
Valley, that if you're not paying
00:02:23
for the product, you are the
product. We kind of agreed to
00:02:26
the fact that we are customers.
And as a result of being
00:02:31
customers, we are providing
something, which is our data, to
00:02:35
the companies, which makes them
live and survive. But again,
00:02:39
this is a bit different for the
case of genetic data. We
00:02:42
actually paid companies like
23andMe to give us a service, to
00:02:48
genotype us. And the sad thing
about this company is that, once
00:02:53
they gave us the service, we
don't have a strong reason to
00:02:57
continue being a customer,
right? So it's not like their
00:03:01
genetic data now keeps giving us
a lot of value once we got the
00:03:06
genetic report. Again, unless
there are some progresses in
00:03:09
genetic research, and then they
can give us some additional
00:03:12
insight, which they did and
actually didn't work so well.
00:03:17
Part of the reason that it
doesn't work well is that
00:03:19
genetics, you know, in most
cases, it's informative of
00:03:22
things, but it's not
deterministic. It gives you some
00:03:25
probabilistic knowledge that,
with the current level of
00:03:28
genetic data, is relatively
small. We actually never gave
00:03:34
23andMe our data. Just, "Hey, go
do research with our data, or go
00:03:39
advertise with our data." But
they have this data and they can
00:03:43
use it. The question is whether
we are now in a kind of a
00:03:47
unilateral situation where we
don't get benefit from our data
00:03:51
given to them, and they can
still benefit from our data. And
00:03:56
this is a bit, I guess, an issue
related to autonomy and to
00:04:01
informed consent of like, you
know, do I want this to be
00:04:05
done? If the answer is yes,
then, you know, many people did
00:04:09
give informed consent to 23andMe
to use the data for research,
00:04:12
and I think that this is great.
If you're not okay with this,
00:04:17
then you can ask 23andMe to
delete your data. You're
00:04:21
legally allowed to do this.
Maybe we want to thank the
00:04:23
European Union for giving us
this right to be forgotten. And
00:04:29
you can ask every company,
whether it's Facebook or 23andMe,
00:04:33
to forget about you. And if
you're not fine with it, go do
00:04:38
it. - But how do we avoid
00:04:41
the misuse of this personal
data, this genetic data? And
00:04:45
I guess, from a regulatory
landscape, you mentioned about
00:04:48
what Europe has done around this
topic. Obviously, we don't have
00:04:53
the same kind of structure here
in the United States, but it
00:04:56
becomes a more important topic
as we move forward since our
00:05:00
lives are so much more digital
than they were a couple of
00:05:03
decades ago.
- It's
00:05:04
an extremely important topic,
and it goes beyond genetics. But
00:05:08
I think genetics has several
components that make it
00:05:11
especially alarming, like
genetic data is considered very
00:05:13
sensitive also within medicine.
How do we deal with it? Well,
00:05:17
you know, I think first of all,
many of the GDPR regulations are
00:05:22
very much adopted by American
companies because they also
00:05:26
serve European customers. I
think that one potential
00:05:31
limitation of the regulations is
the thing that, you know, with
00:05:37
consent, you're allowed -- the
companies can do everything they
00:05:40
want. And we are consenting to
numerous things every day. Like,
00:05:44
every time we are going to a new
website, we are consenting to
00:05:48
stuff. We have become so
automatically consenting to
00:05:51
everything that it's very clear
that nothing is going to stop us
00:05:56
probably from consenting to many
other things we don't want. And
00:06:00
then, you know, we have to go
back, and there is a lot of
00:06:02
effort of thinking of, what did
I consent to, and where will I --
00:06:07
it's an issue. It's a problem. I
mean, there may be a business
00:06:10
opportunity here for companies
that will kind of try to look at
00:06:14
what did you consent to, and try
to figure out where your data
00:06:17
is.
00:06:19
- One of the things that I saw
noted in looking at what we
00:06:23
might see play out with the 23andMe
bankruptcy process is also,
00:06:27
whoever that company is who
comes in and maybe acquires it,
00:06:30
is having a level of
transparency so that the
00:06:33
customers of 23andMe truly
understand where this data is
00:06:37
going to be potentially living
and going down the
00:06:40
road. - Absolutely. And I think
that as a society, we have a
00:06:44
very strong interest that this
data will be collected.
00:06:47
23andMe is a company
that is very important for the
00:06:52
future of medicine. It's a
company that collected data, that
00:06:56
facilitated breakthrough
discoveries of research. Even,
00:07:01
you know, you can say
genetics maybe has not delivered
00:07:06
as much as we hoped for
when the Human Genome Project
00:07:12
concluded, and we thought that
we were going to solve all of our
00:07:14
problems. But we do gain a lot,
and it's actually crucial that
00:07:18
we have very large samples when
it comes to genetic data. So we
00:07:22
actually all, as a society, are
kind of in a place where
00:07:26
it's good for us that everyone
give their genetic data, but you
00:07:31
know, we do have to pay a price
for it. We do know also that
00:07:34
there are data breaches. There
are a lot of potential downsides
00:07:38
here, and this is like a
classical place where you need
00:07:41
regulation. I think that in
a place like this, where the
00:07:45
benefit is of society, but the
data is so, so, so sensitive, I
00:07:52
think regulation must take
place. And at the moment, we
00:07:55
don't have much of it. We have
regulation about using genetic
00:07:57
data for insurance, for
job applications, and so on. We
00:08:04
don't have it for many other
things. And so once this is the
00:08:09
case, it's a bit of a broken
area where we have to depend on
00:08:12
maybe the GDPR, which
is related to many types of data.
00:08:16
We rely on the consent,
we rely on the companies not
00:08:20
actually just unilaterally
modifying the agreements that
00:08:24
they have with us and doing
stuff with the data. Yeah, there
00:08:27
is a lot of -- there are a lot of
problems here. I personally can
00:08:32
tell you that I did -- I was a customer of 23andMe
00:08:35
and I told them that, "I
want my data. I will have my
00:08:38
data. But I don't want them to
keep my data, because at the
00:08:42
moment, I don't feel like I have
control of where it's going to
00:08:44
go." And it's a bit sad, because
I'm using data of many, many
00:08:47
people in my own research where
we are -- where I'm using it
00:08:51
to identify genetic variations
that are related to all sorts of
00:08:57
human conditions, which I find
very important. - Gideon, great to
00:09:02
talk to you again. Thanks very
much for your time today. - Thank
00:09:05
you. - Thank you. Gideon Nave,
Associate Professor of Marketing
00:09:08
here at the Wharton School.
