CROSS-BORDER TRANSMISSION OF DNA DATA FILES: LEGAL AND REGULATORY FRAMEWORK

1. INTRODUCTION

Cross-border transmission of DNA data files refers to the electronic transfer of genetic information, including DNA sequences, genomic profiles, genetic test results, and whole-genome sequencing files, from one country to another. Such transfers commonly occur between hospitals, biotechnology companies, research institutions, forensic laboratories, pharmaceutical companies, and international genomic databases.

DNA data is particularly sensitive because it may reveal information about an individual's ancestry, inherited medical conditions, biological relationships, and potential health risks. It may also reveal information about biological relatives who have not independently consented to the transfer. Consequently, international transmission raises questions concerning privacy, informed consent, data sovereignty, cybersecurity, research ethics, and governmental access.

2. LEGAL FRAMEWORK GOVERNING INTERNATIONAL DNA DATA TRANSFERS

A. GENERAL DATA PROTECTION REGULATION (GDPR)

The European Union's General Data Protection Regulation (GDPR) classifies genetic data as a special category of personal data under Article 9. Processing generally requires an applicable legal basis under Article 6 and a separate condition under Article 9.

Articles 44–49 regulate international transfers of personal data. Transfers may rely on:

Adequacy decisions under Article 45.

Appropriate safeguards, including standard contractual clauses, under Article 46.

Binding corporate rules for qualifying intra-group transfers.

Limited derogations under Article 49, where applicable.

B. INDIAN DATA PROTECTION FRAMEWORK

India's Digital Personal Data Protection Act, 2023 establishes obligations concerning lawful processing, consent, security safeguards, and cross-border transfers. Section 16 empowers the Central Government to restrict transfers of personal data to notified countries or territories. Genetic information capable of identifying an individual may fall within the Act's scope.

Other relevant laws include the Information Technology Act, 2000, applicable cybersecurity requirements, medical confidentiality obligations, and research ethics regulations.

C. INTERNATIONAL RESEARCH AND BIOETHICS PRINCIPLES

The UNESCO Universal Declaration on the Human Genome and Human Rights, 1997, and the International Declaration on Human Genetic Data, 2003, provide important ethical principles concerning confidentiality, informed consent, genetic-data protection, and responsible international scientific cooperation.

3. PRINCIPAL LEGAL REQUIREMENTS

A. INFORMED CONSENT

Institutions should explain the purpose of international transmission, recipient identity, destination country, intended research, retention period, possible commercial use, and potential onward transfers. Consent must not be treated as unlimited permission for unrelated future uses.

B. DATA MINIMISATION

Only information necessary for the approved purpose should be transferred. Pseudonymisation and encryption should be considered before transmission. Removing names alone does not necessarily anonymise genomic information because DNA sequences can sometimes be linked to identifiable individuals.

C. INTERNATIONAL TRANSFER SAFEGUARDS

Organisations must assess the destination country's privacy protections, government-access powers, enforcement mechanisms, and available remedies. Contractual safeguards should specify permitted purposes, security standards, breach notification, deletion obligations, and restrictions on onward disclosure.

D. CYBERSECURITY AND ACCOUNTABILITY

Encryption, access controls, authentication, audit logs, secure transmission channels, and documented retention policies are important safeguards. Organisations should also establish procedures for responding to unauthorised access, accidental disclosure, and cross-border security incidents.

4. IMPORTANT JUDICIAL DECISIONS

1. Justice K.S. Puttaswamy v. Union of India (2017) — Direct constitutional authority.

The Supreme Court of India recognised privacy as a fundamental right under Article 21 and other constitutional freedoms. The judgment provides the constitutional foundation for protecting sensitive personal information, including identifiable genetic information.

2. District Registrar and Collector v. Canara Bank (2005) — Analogous authority.

The Supreme Court recognised the importance of privacy and protection against unjustified access to private records. Its principles are relevant to unauthorised access to confidential genetic databases.

3. Selvi v. State of Karnataka (2010) — Direct analogous authority.

The Supreme Court addressed involuntary narcoanalysis, polygraph examinations, and brain electrical activation profiling. It emphasised individual autonomy and constitutional protections against compelled testimonial evidence. Its reasoning is relevant to compulsory genetic-data collection and use.

4. Schrems v. Data Protection Commissioner (2015), C-362/14 — Direct international transfer authority.

The Court of Justice of the European Union invalidated the EU–US Safe Harbour arrangement because it did not provide adequate protection against certain forms of governmental access to personal data.

5. Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (2020), C-311/18 — Direct international transfer authority.

Known as Schrems II, the judgment invalidated the EU–US Privacy Shield and required exporters and importers using standard contractual clauses to assess whether protection is effective in the destination country. This is highly relevant to international genomic-data transfers.

6. Breyer v. Germany (2016), C-582/14 — Analogous authority.

The CJEU considered when dynamic IP addresses constitute personal data. The decision is relevant to the identifiability of genetic datasets when additional information can reasonably be used to identify individuals.

5. LIABILITY AND REGULATORY CONSEQUENCES

Unlawful international transmission may result in regulatory investigations, financial penalties, compensation claims, contractual liability, research suspension, and reputational damage. Liability may arise where an organisation transfers DNA files without a valid legal basis, ignores applicable transfer restrictions, fails to implement adequate security measures, or permits unauthorised secondary use.

Research institutions and biotechnology companies should maintain transfer registers, data-processing agreements, ethics approvals, documented consent, and incident-response procedures.

6. PRACTICAL COMPLIANCE REQUIREMENTS

Identify whether the DNA files contain identifiable or pseudonymised personal data.

Establish a lawful basis for collection, processing, and international transmission.

Obtain appropriate consent or identify another legally valid basis.

Conduct a privacy and transfer-risk assessment.

Execute appropriate international data-transfer agreements.

Apply encryption, access restrictions, and audit mechanisms.

Restrict onward transfers and unauthorised commercial exploitation.

Establish retention, deletion, and breach-response procedures.

7. CONCLUSION

Cross-border transmission of DNA data files requires a balance between international scientific cooperation and the protection of genetic privacy. GDPR transfer provisions, India's data protection framework, constitutional privacy principles, and international bioethics standards collectively establish important safeguards. The Schrems decisions demonstrate that contractual permission alone cannot guarantee lawful international transmission. Institutions must therefore ensure lawful processing, meaningful consent, appropriate transfer safeguards, cybersecurity, and accountability throughout the genetic-data lifecycle. Effective compliance protects individuals while allowing responsible international genomic research and biotechnology development.