Table of Contents
Your Data For Sale – $300 Million or Best Offer
We’re following the 23andMe bankruptcy debacle over here. The TLDR is that the question of whether 23andMe can sell their customers’ data (i.e., their DNA data) is a real point of contention right now. Relevant issues here include whether this violates 23andMe’s privacy policy and whether users need to provide informed consent, akin to when an individual needs to provide informed consent for the release of medical information. The murky waters resulting from this novel intersection between technological advances and protection of sensitive personal information only seem to get murkier. I mean, how much more “personal and confidential” can you get other than the data that is quite literally the blueprint for your entire existence? All of this got us thinking, of course. When was the last time you revisited your privacy policy? If it’s been a while, or you just don’t have one, get to it! But before you do, maybe go ahead and download your 23andMe data first.
Privacy Still Matters – Even if ChatGPT is Your New Therapist
A privacy policy is exactly what it sounds like. It’s a written policy that lays out what data you collect, how and why you would collect it, what you do with that data, limits of third-party access to that data, how it’s stored, and user-specific rights, including any deletion rights. It’s that “fine print” we all loathe and quickly click out of. ARGH! TOO MANY WORDS! We like reading them. We like writing them too. Can feel your judgy eyes from here.
The point of a privacy policy is to ensure that the user understands how their data is collected and used, and to memorialize certain protections required by law. Several states have harsher privacy laws and impose significant penalties for data breaches – sorry, California, you just can’t win with us. So, a privacy policy isn’t just tiny letters at the bottom of a website, it’s a legal requirement. With real legal implications.
While we’ve evolved beyond shrink-wrap contracts (talk about archaic), it’s still common practice to assume that by using an app, a website, or a program, you accept the terms and conditions/privacy policy. So, what happens when you spit in a tube and send off your entire genetic blueprint? Well, at some point along the way, you agreed to some sort of privacy policy. What that does for you now is, well, up for debate.
Mo’ Data Mo’ Problems
The long and short of it here is that if you collect personal information and data – you need a privacy policy. Have a website? That means you collect data! Much like any agreement we discuss on this blog, the point of a privacy policy is to provide transparency and limit liability. A robust privacy policy is clear, without being so lengthy and detailed that it’s virtually impossible for the user to actually understand what it says (or being so short that it is virtually useless). The more data you collect, the more detailed you’ll need to be about how each category of data is collected, maintained, protected, and, if applicable, shared with any third parties. Additionally, the more exposure you have to various users, the more protections you’ll need. For example, if there’s a risk that a child can use your website or app, you’ll need language about that, as children are of course subject to greater protections. The key here is to be proactive.
In this technological age we’re in, data is everywhere and in everything we do, and data collection is inevitable, even if you aren’t actively mining data and selling it off to the highest bidder. Otherwise, “big data” wouldn’t exist! (Sorry to break it to you, but someone somewhere is analyzing why you bought that jumbo size KitKat bar last week). And speaking of dessert: cookies, third-party software, and automatic collection tools are all things that should be considered and addressed when crafting your privacy policy disclosures. Like we said – if you have a website, you collect data!
The internet changed everything, including how we collect data, but that doesn’t mean you have to be in the dark about it. Why? Because as always, if you’ve got questions, you know we’ve got answers!
~ The W + K Team
ABOUT WEINSTEIN + KLEIN P.C.
Established in 2019, Weinstein + Klein is a boutique law firm focused on labor and employment law, business matters, and litigation. W + K works with businesses, individuals, and entrepreneurs to protect their legal interests. In addition to advising clients on employment matters and working with businesses to minimize their risk of litigation, we advise small businesses and start-ups on various business law matters.