Data protection for lifetime genetic records

Introduction

Genetic records contain information about an individual's inherited characteristics, biological relationships, health risks, and susceptibility to certain diseases. Unlike ordinary personal information, genetic data remains relevant throughout a person's lifetime because an individual's DNA generally remains substantially unchanged. It may also reveal information about biological relatives and future generations.

Lifetime genetic records may be generated through medical diagnosis, genetic screening, reproductive technologies, clinical trials, ancestry testing, and genomic research. Their long-term storage creates important legal and ethical concerns relating to privacy, informed consent, confidentiality, data security, discrimination, and unauthorized commercial use.

Therefore, data protection for lifetime genetic records requires strong safeguards throughout the entire data lifecycle, from collection and storage to sharing, retention, and eventual deletion.

Meaning and importance of lifetime genetic record protection

Lifetime genetic record protection refers to legal, technical, and institutional measures designed to safeguard genetic information throughout its existence. It recognizes that genetic data may remain sensitive even after the original medical or research purpose has ended.

The protection of such records is important for several reasons:

Permanent sensitivity: Genetic information cannot ordinarily be changed like a password if it is exposed.

Family privacy: Genetic records may reveal hereditary conditions and biological relationships involving relatives.

Medical confidentiality: Unauthorized disclosure may expose individuals to stigma or discrimination.

Research protection: Genetic datasets must be protected against misuse by researchers, laboratories, and commercial organizations.

Intergenerational concerns: Information obtained from one individual may have implications for future generations.

Legal framework in India

The Digital Personal Data Protection Act, 2023 provides a general framework for protecting digital personal data. Genetic information that identifies an individual or can be linked to that individual falls within its scope. The Act establishes obligations relating to lawful processing, consent, security safeguards, and erasure, subject to applicable legal requirements and exemptions.

However, the Act does not create a separate statutory category for genetic information or establish a special lifetime retention regime for genetic records. Organizations must therefore develop appropriate safeguards according to the sensitivity and purpose of the information.

The Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, have also addressed the protection of sensitive information, including medical records and biometric information. Their continuing applicability must be assessed alongside the newer data protection framework.

The Assisted Reproductive Technology (Regulation) Act, 2021 and the Surrogacy (Regulation) Act, 2021 establish regulatory requirements for assisted reproductive services, including confidentiality and record management. These laws are relevant where genetic information is generated through reproductive treatment and related procedures.

The Constitution of India, particularly Article 21, provides protection through the fundamental right to privacy.

International legal framework

The General Data Protection Regulation (GDPR) classifies genetic data as a special category of personal data under Article 9. Processing is generally prohibited unless an applicable legal condition permits it, such as explicit consent or certain healthcare and research grounds.

Article 5 establishes principles of purpose limitation, data minimization, storage limitation, and integrity and confidentiality. These principles are especially important when genetic records are retained for extended periods.

The UNESCO International Declaration on Human Genetic Data, 2003 specifically addresses the collection, processing, storage, and use of human genetic data. It emphasizes informed consent, confidentiality, privacy, and respect for human dignity.

The UNESCO Universal Declaration on Bioethics and Human Rights, 2005 also recognizes privacy and confidentiality as essential principles in biomedical research.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognized privacy as a fundamental right under Article 21. The judgment emphasized informational privacy and individual autonomy. Its principles provide a constitutional foundation for protecting lifetime genetic records from unnecessary collection, unauthorized disclosure, and disproportionate use.

2. K.S. Puttaswamy v. Union of India (Aadhaar case, 2018)

The Supreme Court examined the constitutional limits of collecting and using personal information through the Aadhaar system. It emphasized proportionality, necessity, and safeguards against excessive data collection. These principles are relevant to the development of secure genetic databases.

3. S. and Marper v. United Kingdom (2008)

The European Court of Human Rights held that the indefinite retention of fingerprints and DNA profiles of individuals who had not been convicted violated Article 8 of the European Convention on Human Rights. This is particularly important because it recognizes that retaining DNA information can interfere with privacy even without its further disclosure or misuse.

4. Aycaguer v. France (2017)

The European Court of Human Rights examined the retention of DNA profiles in a criminal database and found the applicable retention arrangements disproportionate in the circumstances. The decision highlights the importance of reasonable retention periods and safeguards when storing genetic information.

5. District Registrar and Collector v. Canara Bank (2005)

The Supreme Court of India recognized the importance of privacy in confidential records. Although the case did not specifically concern genetic information, its principles support protection against unjustified access to sensitive personal records.

Institutional safeguards and compliance measures

Organizations maintaining lifetime genetic records should adopt the following measures:

Obtain informed consent explaining the purpose and expected duration of genetic data processing.

Restrict access to authorized medical professionals and research personnel.

Use encryption, secure authentication, and regular security audits.

Separate identifying information from genomic datasets wherever possible.

Establish clear retention, review, and deletion policies.

Control international transfers through applicable data protection requirements.

Provide procedures for correcting inaccurate records and addressing data breaches.

Establish specific rules for secondary research and commercial use.

Importantly, lifetime retention should not automatically be treated as necessary merely because genetic information remains scientifically useful. Retention must have an appropriate legal basis and comply with applicable purpose and storage requirements.

Conclusion

Data protection for lifetime genetic records is essential because genetic information has permanent personal, medical, familial, and scientific significance. Indian constitutional privacy principles, the Digital Personal Data Protection Act, 2023, and international instruments provide important foundations for protecting such information. Decisions such as S. and Marper v. United Kingdom demonstrate that even the continued storage of DNA information may raise serious privacy concerns. A balanced legal framework should protect individual autonomy, regulate long-term retention, prevent unauthorized disclosure, and support responsible genetic research.