Data breaches involving genetic information

Introduction

Data breaches involving genetic information refer to incidents in which confidential DNA sequences, genetic test results, biological samples, genomic research records or inherited health information are accessed, disclosed, altered or stolen without proper authorisation.

Genetic information is particularly sensitive because it may reveal an individual's inherited characteristics, disease susceptibility, biological relationships and certain aspects of family history. Unlike passwords or identification numbers, genetic information cannot simply be replaced after a security breach.

Such breaches may affect patients, research participants, biotechnology companies, pharmaceutical organisations, hospitals and genetic testing laboratories. Therefore, protecting genetic information is essential for privacy, medical confidentiality, scientific research and responsible biotechnology governance.

Legal framework governing genetic information breaches

1. Digital Personal Data Protection Act, 2023

The DPDP Act is relevant when genetic information constitutes digital personal data relating to identifiable individuals.

Section 8 establishes important responsibilities for Data Fiduciaries, including reasonable security safeguards to prevent personal data breaches and notification of breaches to the Data Protection Board of India and affected individuals in the prescribed manner.

These obligations apply subject to the relevant commencement provisions and applicable rules.

2. Information Technology Act, 2000

The Information Technology Act, 2000 provides legal protection against unauthorised access, disclosure and misuse of electronic information.

Important provisions include:

Section 43: Provides compensation for unauthorised access, copying, downloading or damaging computer systems and data.

Section 66: Addresses computer-related acts committed dishonestly or fraudulently.

Section 72: Addresses breach of confidentiality and privacy in specified circumstances.

Section 72A: Provides punishment for disclosure of information in breach of a lawful contract, where statutory requirements are satisfied.

Section 70B: Establishes CERT-In and its cybersecurity incident-response responsibilities.

3. CERT-In directions, 2022

The CERT-In directions dated 28 April 2022 require covered organisations to report specified cybersecurity incidents within six hours of noticing them or being informed about them.

They also prescribe requirements for maintaining certain ICT logs for a rolling 180-day period within Indian jurisdiction.

Genetic testing laboratories and biotechnology companies should maintain appropriate procedures to identify and report applicable cybersecurity incidents.

4. European Union General Data Protection Regulation (GDPR)

The GDPR provides additional protection for genetic information.

Article 4: Defines personal data and genetic data.

Article 9: Treats genetic data as a special category of personal data and restricts its processing unless an applicable legal condition is satisfied.

Article 32: Requires appropriate technical and organisational security measures.

Article 33: Establishes personal data breach notification requirements, generally within 72 hours of becoming aware of a reportable breach.

Article 34: Requires communication to affected individuals when a breach is likely to result in a high risk to their rights and freedoms.

Major causes of genetic information breaches

1. Cyberattacks on genomic databases

Genetic testing laboratories and research institutions store large volumes of DNA sequences and patient information. Cybercriminals may target these databases to obtain confidential biological information.

2. Unauthorised employee access

Employees or research personnel may access genetic records beyond their authorised responsibilities. Improper sharing or misuse may violate confidentiality and data protection obligations.

3. Third-party service provider failures

Biotechnology organisations frequently use external cloud storage providers, genetic testing platforms and research contractors. Security weaknesses in these services may expose genetic information.

4. Inadequate anonymisation

Removing names from genetic datasets does not necessarily guarantee anonymity. Genetic information may be linked with relatives' records or other publicly available information to identify individuals.

5. Improper research data sharing

Genetic information may be transferred between universities, hospitals, pharmaceutical companies and international research institutions. Unclear consent arrangements and inadequate contractual safeguards may create legal risks.

Legal consequences of genetic information breaches

Genetic information breaches may create several legal consequences.

1. Privacy violations: Unauthorised disclosure may violate constitutional privacy protections and applicable data protection requirements.

2. Compensation claims: Affected individuals may seek remedies where the applicable legislation establishes a right to compensation.

3. Regulatory action: Organisations may face investigations, directions or penalties under applicable data protection and cybersecurity laws.

4. Contractual liability: Breaches of confidentiality agreements and research contracts may create civil liability.

5. Intellectual property disputes: Unauthorised disclosure of proprietary genetic research may affect patent rights and confidential commercial information.

6. Ethical consequences: Genetic information may reveal details about biological relatives who have not directly participated in the research.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court of India recognised privacy as a fundamental right under Article 21 of the Constitution. The judgment established that informational privacy is an essential part of individual liberty. It is particularly relevant to genetic information because DNA records may reveal highly personal health and hereditary details.

2. S. and Marper v. United Kingdom (2008)

The European Court of Human Rights examined the indefinite retention of DNA samples and fingerprints of individuals who had not been convicted. It held that blanket and indefinite retention violated Article 8 of the European Convention on Human Rights. The decision is important for genetic privacy because it recognises the sensitive nature of biological information and the need for appropriate retention limits.

3. Association for Molecular Pathology v. Myriad Genetics, Inc. (2013)

The United States Supreme Court examined the patentability of naturally occurring human DNA and synthetically created cDNA. It held that naturally occurring DNA is not patentable merely because it has been isolated, while cDNA may be patentable in the circumstances considered. Although the case did not concern a data breach, it demonstrates the commercial and legal importance of genetic information.

4. Moore v. Regents of the University of California (1990)

The Supreme Court of California considered the commercial use of a patient's biological materials without adequate disclosure. It rejected the patient's conversion claim over the excised cells but recognised potential liability for failure to obtain informed consent. The judgment is relevant to the legal and ethical responsibilities of institutions handling biological materials and associated research information.

5. Greenberg v. Miami Children's Hospital Research Institute (2003)

The United States Court of Appeals for the Eleventh Circuit considered disputes involving genetic research contributions, informed consent and the commercialisation of genetic discoveries. The court addressed claims concerning the use of research contributions and associated genetic information. The decision is relevant to the ethical management of genetic databases and the responsibilities of research institutions.

These cases do not directly establish a comprehensive legal regime for genetic data breach notification. They provide important analogous principles concerning genetic privacy, informed consent, biological materials and research responsibilities.

Compliance obligations and preventive measures

Organisations handling genetic information should establish a comprehensive data protection and cybersecurity programme.

Encryption: Protect genetic information during storage and transmission.

Access control: Restrict access to authorised researchers and healthcare professionals.

Data minimisation: Collect only genetic information necessary for the stated purpose.

Consent management: Clearly explain research purposes, data sharing and permitted secondary uses.

Anonymisation: Apply appropriate anonymisation techniques and assess re-identification risks.

Security audits: Conduct regular vulnerability assessments and independent reviews.

Vendor agreements: Include confidentiality, cybersecurity and breach notification obligations in contracts.

Incident response: Maintain procedures for investigating, reporting and managing genetic data breaches.

Retention controls: Establish appropriate retention and deletion policies.

International regulatory challenges

Genetic research frequently involves international collaboration. A genetic database maintained in one country may be accessed by researchers, pharmaceutical companies or laboratories in several other jurisdictions.

This creates challenges concerning cross-border data transfers, different consent requirements, regulatory reporting deadlines and international privacy standards.

Organisations must identify the laws applicable to each processing activity and establish clear agreements governing data access, research purposes, confidentiality and security responsibilities.

Conclusion

Data breaches involving genetic information represent a serious challenge for biotechnology, healthcare and genomic research institutions. India's DPDP Act, 2023, Information Technology Act, 2000 and CERT-In directions provide important legal foundations, while the GDPR establishes additional protection for genetic information in applicable circumstances. Judicial decisions such as Puttaswamy, S. and Marper and Greenberg demonstrate the importance of genetic privacy, informed consent and responsible research governance. Strong encryption, restricted access, transparent consent procedures and timely breach notification are essential for protecting genetic information and maintaining public trust in biotechnology research.