might GEDmatch/Verogen in future give access to our data to their new partner without giving us the chance to delete it first?

[J. P. Gilliver (John)]

I've just had an email from GEDmatch, drawing my attention to new terms
and conditions.

Within those, in a section headed "Future", they've explained that in
the event of any future merger (or transfer of rights) of Verogen
with/to any other entity, that entity will be given access to any of our
DNA data they hold.

This seems perfectly reasonable, and indeed happened when they were
taken over by Verogen. However, when that happened, they gave sufficient
notice to users, for users to demand deletion of their data if they
didn't want (in that case) Verogen to have or control access to their
data.

I am HOPING that the lack of mention of this is just an oversight, and
not deliberate. However, _as they stand_, my reading (and IANAL) of the
new terms is that such transfer of access rights COULD occur without our
having the chance to forbid it.

Yes, I am probably being paranoid. However, here's the text of an email
I'm sending them; anyone else equally paranoid, feel free to copy any of
it (to ***@verogen.com or anywhere else). [You'd probably want to
snip the first point.]

--

Following your recent email, I have examined the new Ts & Cs at
https://www.gedmatch.com/Documents/tos_20210111.html; I must say I am
disappointed at the confrontational tone throughout. I would like
clarification on two points:

1. Payment information.
I currently use none of the paid services; I have my data with
GEDmatch/Verogen in a spirit of co-operation with others (though I am
aware that its being there, along with that of other similar users,
makes Verogen more attractive to paying customers). I do not believe you
have any payment information for me; however, I would like your
assurance that under no circumstance will I become liable for charges
unless I take some specific action which at the time makes it clear to
me that I am committing myself to payment liability. This is not IMO
clear from the new Ts & Cs.

2. "Future".
I appreciate you cannot predict the future for DNA or genealogy
research, or for GEDmatch, including possible future mergers or
transfers. However, I assume that, should such mergers or transfers
occur, I and other users will be given sufficient notice that we can
require deletion of our DNA data before such merger or transfer occur -
as was indeed the case with the transfer to Verogen. THIS IS NOT CLEAR
FROM THE "Future" SECTION OF THE NEW Ts & Cs; IN FACT IN THEIR PRESENT
FORM, THEY IMPLY THAT TRANSFER OF ACCESS TO DATA WILL OCCUR WITH NO
NOTICE. Unless you can assure me that such adequate notice will be
given, PLEASE DELETE MY DATA. Note: I would prefer NOT to do this, and
hope that this particular paragraph of the new Ts and Cs has been
written in this form unintentionally.

Last time (the Verogen takeover), you required explicit consent from
users, and in fact did not allow access - for new users or those who
_had_ consented - to the matching services etc. using the data from
those who had _not_ consented, until they did explicitly consent. This
worked well.

[Ian Goddard]

Post by J. P. Gilliver (John)
I am HOPING that the lack of mention of this is just an oversight, and
not deliberate.

When reading a contract, T&Cs, etc. never assume something that isn't
there is just an oversight and would be regarded as being there if push
came to shove.

If they don't say they won't do something then they're free to do it.

If they don't say you're free to do something then you're not free to do it.

The closest you come to being able to overturn that, and it would
probably need to go to court to achieve it, would be if the terms
override your legal rights under consumer law or GDPR. Even then you
have to take into account what law prevails to determine your rights
under consumer law. Post-Brexit there is still a DPA which largely
reflects GDPR for data subjects in the UK.

I'm amused to see them relying on Standard Contractual Clauses as these
have, I understand, been struck down by the ECJ.

On the whole it reminds me why I don't provide data for any of these
services, especially those within reach of US legislation.

[J. P. Gilliver (John)]

On Thu, 7 Jan 2021 at 15:16:52, "J. P. Gilliver (John)"

Post by J. P. Gilliver (John)
I've just had an email from GEDmatch, drawing my attention to new terms
and conditions.

[]

Post by J. P. Gilliver (John)
Yes, I am probably being paranoid. However, here's the text of an email
I'm sending them; anyone else equally paranoid, feel free to copy any
to snip the first point.]

[]
I have received a mostly-reassuring reply. Here it is (with my
responses):

--

Post by J. P. Gilliver (John)
Hello,
Regarding your questions on the issues you had with the Terms of
1.GEDmatch remains a free site. The details of payment structures
only apply to those who choose to purchase the optional Tier 1
Service. If you do not actively sign up for the service, you will
not be responsible for any charges. 

Thank you. I thought that was probably the case, but the phrasing of the
new Ts and Cs made this rather hard to determine.

Post by J. P. Gilliver (John)
2.We would provide a notification should such a transfer occur. 
Please let us know if you have any additional questions. 

Provided such notice would be sufficiently in advance of any such
merger/transfer that users would have adequate time to instigate
deletion of their data before the merger/transfer happens, I have no
further question.