• doublejay1999@lemmy.world
    link
    fedilink
    English
    arrow-up
    66
    arrow-down
    12
    ·
    11 months ago

    Poor reporting, as ever. As people have pointed out, you cannot disclaim away the Law. No one can.

    If you did a bungee jump, and you sign any kind of waiver, it might protect the company if your glasses fall off and smash. It will not protect them if the rope snaps and break your head.

    • lhx@lemmy.world
      link
      fedilink
      English
      arrow-up
      38
      ·
      11 months ago

      Lawyer here: this isn’t necessarily correct and in America it’s state dependent. There are absolutely parts of the law you can waive, including negligence of a party which is likely your bungee jumping scenario with the rope snapping.

    • Wogi@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      11 months ago

      That’s what the helmet is for.

      Silly lemmer, you can’t protect your head with paper. You gotta use a helmet. Psh

    • LOLjoeWTF@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      11 months ago

      My understanding is that when signing a liability waiver, first the acknowledgement of risk happens, and then the release of liability. State by state it can be a little bit different for releasing liability, depending on the interpretation. I looked up where I live, and that liability waiver isn’t upheld if one can prove damages (possibly death, in which case someone has to sue upon my lifeless corpse) caused by intentional recklessness, not simply neglect.

      • doublejay1999@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        3
        ·
        11 months ago

        It would be interesting to look into some cases. My statement was based on not being able to disclaim negligence at all.

  • hi_its_me@lemmy.world
    link
    fedilink
    English
    arrow-up
    46
    ·
    11 months ago

    PSA: you can request deletion of your 23andMe account. It won’t do anything for this past hack, but it’ll at least prevent your data from being included in future hacks (assuming they actually completely delete your data like they’re supposed to).

    • lemmesay@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      26
      arrow-down
      1
      ·
      11 months ago

      it’s almost always a soft delete, that is, change active field in database to false, coupled with their terms of service that state vaguely how they start the deletion process which could take months and how they may still keep certain data for legitimate purposes.

      • HeyJoe@lemmy.world
        link
        fedilink
        English
        arrow-up
        22
        ·
        11 months ago

        And this is why I wish we adopted GDPR more… if they are compliant, then they have to remove all data held when requested. Too bad the US will never care that much to respect individuals’ data like that.

        • hi_its_me@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          11 months ago

          Exactly. I made a GDPR request for deletion. They can get in big trouble if they are soft deleting.

          • Rodeo@lemmy.ca
            link
            fedilink
            English
            arrow-up
            1
            ·
            11 months ago

            Have they ever been audited?

            How does the legal authority work with GDPR if the company’s physical and financial operations are entirely within the US? Would the GDPR even be allowed to audit them without their consent?

            • hi_its_me@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              11 months ago

              No idea if they’ve been audited. GDPR doesn’t require it. My understanding is that American companies doing any business or having any users in the EU need to be GDPR compliant for those users. I don’t think that’s been challenged in any courts yet.

    • douglasg14b@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      4
      ·
      edit-2
      11 months ago

      Why would you this wasn’t even a hack for my understanding?

      It was a password stuffing attack. Meaning that a bunch of users with reused crappy passwords had their accounts accessed with their legitimate passwords by attackers.

      I’m not sure why this reflects horribly on the company in a way that would encourage one to delete their account?

      This would be like leaving the key to your apartment in a public place and then complaining about your landlords terrible security when someone accesses your house when you’re not there.

      • Rentlar@lemmy.ca
        link
        fedilink
        English
        arrow-up
        9
        ·
        edit-2
        11 months ago

        They stuffed passwords to get them access to information not just on the compromised accounts’ profiles but to detailed data on a large group of other people whose accounts weren’t compromised through a function within 23andMe’s database browser.

  • Kecessa@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    35
    ·
    11 months ago

    I feel like ToS changes should require the user to accept before being enforceable with no right to suspend the user’s account if they don’t and when it comes to data it should only apply to data the user shared after the changes…