CONSUMER GENETIC DATA RESALE PROHIBITION: LEGAL FRAMEWORK AND CASE LAWS

1. INTRODUCTION

Consumer Genetic Data Resale Prohibition concerns legal restrictions on the sale, licensing, disclosure, or commercial transfer of genetic information collected by direct-to-consumer DNA testing companies, biotechnology businesses, ancestry platforms, laboratories, and healthcare providers. Such information may include DNA sequences, ancestry profiles, inherited disease risks, biological samples, and genetic health predictions.

The principal objective is to prevent organisations from exploiting genetic information for undisclosed commercial purposes without meaningful consumer consent. Unauthorised resale may expose individuals and their biological relatives to discrimination, privacy violations, identity-related risks, and unwanted disclosure of family relationships.

There is no single universal statute prohibiting every resale of consumer genetic data. The applicable rules depend on the jurisdiction, the nature of the information, the original consent, the proposed recipient, and the purpose of transfer. India primarily relies on constitutional privacy principles and general data-protection legislation, whereas certain United States jurisdictions provide more specific protections for consumer genetic information.

2. LEGAL FRAMEWORK

A. INDIAN CONSTITUTIONAL PRIVACY PROTECTION

Article 21 of the Constitution of India protects life and personal liberty, including the fundamental right to privacy recognised in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017). Genetic data resale may raise constitutional concerns involving informational privacy, autonomy, dignity, and the unauthorised exploitation of intimate personal information.

However, Article 21 does not automatically create a standalone statutory prohibition on every private company's resale of genetic data. Its direct application and available remedies depend on the circumstances and the relevant legal framework.

B. DIGITAL PERSONAL DATA PROTECTION ACT, 2023

The DPDP Act regulates digital personal data relating to identifiable individuals, subject to its scope, exemptions, and applicable commencement provisions. A genetic profile associated with an identifiable consumer can qualify as personal data.

Relevant requirements include lawful processing, consent where required, specified-purpose limitations, security safeguards, and compliance with applicable obligations concerning data breaches and individual rights. Consent for DNA testing should not be assumed to authorise every subsequent commercial use or disclosure.

The Act does not establish a blanket ban on all commercial transfers of genetic data. The legality of a particular transaction must be assessed against the operative statutory provisions, applicable rules, consent terms, and any additional restrictions.

C. UNITED STATES GENETIC PRIVACY LAWS

Some American jurisdictions impose more specific obligations on direct-to-consumer genetic testing businesses. California's Genetic Information Privacy Act establishes requirements concerning disclosures, consent, and consumer control over genetic information. Minnesota Statutes section 325F.995 similarly addresses express consent, privacy notices, secondary uses, and service-provider restrictions.

The federal Genetic Information Nondiscrimination Act of 2008 (GINA) addresses genetic discrimination in employment and health insurance, but it is not a comprehensive prohibition on genetic-data resale. HIPAA applies to covered entities and business associates within its statutory scope; independent consumer DNA testing companies are not automatically covered.

3. KEY LEGAL REQUIREMENTS

A. INFORMED AND SPECIFIC CONSENT

Companies should clearly distinguish consent to perform a genetic test from consent to research participation, pharmaceutical development, advertising, third-party disclosure, and commercial licensing. Where legislation requires express or separate consent, general acceptance of lengthy terms may not satisfy the requirement.

B. TRANSPARENCY AND PURPOSE LIMITATION

Privacy notices should explain what data is collected, why it is processed, who may receive it, whether it may be commercialised, and how long it will be retained. Material changes in ownership or purpose require careful legal assessment.

C. THIRD-PARTY AND CORPORATE TRANSFERS

Transfers to pharmaceutical companies, data brokers, insurers, advertisers, or new corporate owners should be assessed against applicable consent and disclosure requirements. A corporate acquisition does not automatically eliminate privacy obligations.

D. SECURITY AND ACCOUNTABILITY

Organisations should apply encryption, access controls, retention limits, incident-response procedures, and contractual restrictions on onward disclosure. Pseudonymised or supposedly de-identified genetic data may remain re-identifiable and should not automatically be treated as risk-free.

E. CONSUMER REMEDIES

Depending on the applicable law, consumers may seek regulatory intervention, statutory remedies, contractual relief, or judicial protection. Remedies depend on jurisdiction, proof of the violation, standing, and the relevant statutory requirements.4. RELEVANT CASE LAWS

A. JUSTICE K.S. PUTTASWAMY (RETD.) v. UNION OF INDIA (2017)

Authority: Direct constitutional authority on privacy; analogous to commercial genetic-data resale. The Supreme Court of India recognised privacy as a fundamental right under Article 21 and other constitutional guarantees. The judgment provides a constitutional foundation for challenging unjustified intrusions into informational privacy. Although it did not decide a consumer DNA resale dispute, its principles are relevant when genetic information is exploited without an adequate legal basis.

B. S. AND MARPER v. UNITED KINGDOM (2008), EUROPEAN COURT OF HUMAN RIGHTS

Authority: Strong analogous authority concerning genetic information. The Court held that the indefinite retention of DNA samples and profiles belonging to individuals who had not been convicted of offences violated Article 8 of the European Convention on Human Rights. It emphasised the sensitivity of genetic information and the importance of proportionate retention. The judgment supports safeguards against excessive retention and uncontrolled use, although it concerned state-held data rather than commercial resale.

C. GOOGLE SPAIN SL v. AGENCIA ESPAÑOLA DE PROTECCIÓN DE DATOS (2014), COURT OF JUSTICE OF THE EUROPEAN UNION

Authority: Analogous international data-protection precedent. The Court examined the responsibilities of a search engine processing personal information and recognised that data-protection rights may require restrictions on continued accessibility. Its reasoning is relevant to the broader balance between commercial exploitation of information and individual privacy, but it did not directly prohibit genetic-data resale.

D. DIGITAL RIGHTS IRELAND LTD v. MINISTER FOR COMMUNICATIONS (2014), COURT OF JUSTICE OF THE EUROPEAN UNION

Authority: Analogous precedent on excessive data retention. The Court invalidated the EU Data Retention Directive because it imposed disproportionate interference with fundamental rights. The decision supports scrutiny of indiscriminate collection and retention, including policies that retain consumer genetic information beyond legitimate purposes.

E. IN RE 23ANDME HOLDING CO. (2025), UNITED STATES BANKRUPTCY COURT, EASTERN DISTRICT OF MISSOURI

Authority: Directly relevant judicial proceeding concerning the commercial transfer of consumer genetic data. In its decision of 27 June 2025, the Bankruptcy Court approved a proposed transaction involving the company's assets, including genetic and other personally identifiable information, over objections raised by several states. The proceedings exposed a fundamental tension between bankruptcy asset sales and genetic privacy protections.

The decision should not be understood as a universal authorisation to resell DNA data without consent. Its reasoning concerned the particular transaction structure and applicable law. California subsequently pursued an appeal, and the dispute illustrates why contractual privacy promises, statutory transfer restrictions, and corporate ownership changes must be examined separately.

F. GAUGHRAN v. UNITED KINGDOM (2020), EUROPEAN COURT OF HUMAN RIGHTS

Authority: Analogous precedent on biometric-data retention. The Court found an Article 8 violation arising from the retention of biometric information without adequate safeguards. Its proportionality analysis is relevant to the development of retention and deletion policies for genetic databases, but it was not a consumer-data resale case.

5. PRACTICAL COMPLIANCE AND ENFORCEMENT

Companies should adopt a written genetic-data commercialisation policy covering:

Separate consent for optional research, third-party disclosures, and commercial uses wherever required.

Clear disclosure of prospective recipients and the purposes for which genetic information may be used.

Contractual restrictions preventing service providers from independently selling or exploiting customer data.

Data-retention schedules, secure deletion procedures, and accessible consumer withdrawal mechanisms.

Legal review of mergers, insolvency proceedings, acquisitions, and transfers to pharmaceutical or insurance businesses.

Documented security assessments, breach-response procedures, and compliance audits.

Consumers should examine privacy policies before submitting biological samples and determine whether the company permits research reuse, third-party licensing, or transfers following a change of ownership.

6. CONCLUSION

Consumer genetic data resale prohibition is an emerging area of privacy law rather than a universally established, absolute ban. Indian constitutional jurisprudence supports the protection of informational privacy, while international cases establish important principles concerning genetic confidentiality, proportionality, and retention. Specific legislation in certain jurisdictions provides more direct restrictions on genetic-data disclosure and commercial transfer. Effective protection requires clear consent rules, transparent commercial practices, enforceable security obligations, and careful scrutiny of transactions involving sensitive genetic databases.