There's a pretty significant difference between "when you use their service you can opt-in to have your data added to the dataset" and "buried in the EULA is a clause saying they own your genes."
It appears some people in this thread use a rather creative version of "opt in" [1]. There is nothing "opt" about what has been described here, nor about Microsoft telemetry (it was opt-out last time I checked).
6. Do I have any alternatives? Can I withdraw from this study?
Your alternative is not to participate in the 23andMe Research study. If you choose not to give consent for 23andMe Research, your Genetic & Self-Reported Information may still be used for other purposes, as described in our Privacy Statement. If you do give consent to participate in this study, you may choose not to take 23andMe Research surveys or use other 23andMe Research features.
At any time, you may choose to change your consent status to either take part in 23andMe Research or to withdraw all or some of your Genetic & Self-Reported Information from 23andMe Research. Your consent status is located in the 23andMe "Settings" page (if you experience problems changing your consent status, write to the Human Protections Administrator at hpa@23andme.com). If you withdraw all or some of your Genetic & Self-Reported Information, 23andMe will prevent that information from being used in new 23andMe Research initiated after 30 days from receipt of your request (it may take up to 30 days to withdraw your information after you withdraw your consent). Any research on your data that has been performed or published prior to this date will not be reversed, undone, or withdrawn.
Choosing not to give consent or withdrawing from 23andMe Research will not affect your access to your Genetic Information or to the Personal Genome Service.
You may also discontinue participation by closing your Personal Genome Service account, as described in the Terms of Service. Requests for account closure can be made directly within your Account Settings.
> Your alternative is not to participate in the 23andMe Research study. If you choose not to give consent for 23andMe Research, your Genetic & Self-Reported Information may still be used for other purposes, as described in our Privacy Statement
Seems to imply that if you do not give your consent for whatever "23andMe Research" is, then they will still use the data for other purposes. So in other words if you do not opt in they will still use they data. That's not a normal definition of "opt in".
However, I don't know what is in the privacy statement. What are they able to do with the data if you don't opt-in?
I don't use Windows 10, but I from what I understand Microsoft had to make it GDPR compliant. I'm not sure they succeeded entirely with that (last time I checked, the German government did not find it GDPR compliant. Regardless, at the very least it was an improvement [which isn't an excuse]).
Not really. It's more like they have an army of lawyers paid so they can claim GDPR compliance, and delay/suppress or negotiate deals for years (if not decades) anything that comes up to say their not.
That being said, apparently there are already ongoing legal cases around GDPR complaints for MS. No idea how those will end up.
I think a clearer phrasing of that is "Consent is not freely given unless it's explicit". I'm fine with giving consent as long as I'm clear on what that is. General consent for using a service, to me, doesn't include using my data and/or information outside of what's needed to provide that service.
In this case it totally is. Your free to not use 23andMe if you don't consent. I do think, however, it shouldn't be buried in the EULA but communicated clearly.
> Your free to not use 23andMe if you don't consent
That is not how consent works.
If I am selling you an apple, but thereby you give me consent to use its genetics for research, and without that we do not do business, then there is nothing optional about it; no opt-in, no opt-out.
Opt-in is when the flag is disabled by default, and you can enable it if you want to, and use the product regardless of your choice.
Opt-out is when the flag is enabled by default, and you can disable it if you want to, and use the product regardless of your choice.
You're not buying apples, though. You're buying "apples+X". That's a different from "apples". If your seller is upfront about that then I and people who want just an apple can go somewhere else for fruit. Most, though, aren't upfront about it.
That is up to our governments to decide if such is allowed or not. For example, it isn't allowed to sell a gun or drugs with an apple (at least not here in The Netherlands, YMMV).
That you can decide to not go for the entire package is not what we disagree on (apart from above, I suppose).
What we were discussing is that the consent is optional; it is not in any of these examples. It is part of the package deal; then you don't call it opt-in or opt-out, as that allows you to opt-in or opt-out of something which is otherwise not in your direct advantage, but is in the other party's advantage.
Let's say there are two people who are supposed to get a punishment. One is found guilty by a fair trial, the other one is not found guilty by a fair trial.
For some superficial rule, I may only punish the person who has been found guilty by also punishing the person who has not been found guilty.
Can you explain to me how this is fair?
Here is where you and I differ. You find it OK when a party (e.g. business) uses your private data to sell or otherwise use for their benefit. I believe such personal data is ultimately my say. And I believe only informed opt-in (optional, not part of a package deal ie. how GDPR works) is a fair way to deal with such situation.
