Governance of Synthetic DNA Data Storage Systems in Medical Archiving

1. Introduction

Synthetic DNA data storage is an emerging technology in which digital information is encoded into artificially synthesized DNA sequences, preserved under suitable conditions, and later retrieved through DNA sequencing and computational decoding. In medical archiving, it could potentially be used to preserve large collections of medical research records, genomic datasets, clinical-trial documentation, pathology records, and historical public-health information.

Unlike conventional digital storage, which depends on electronic media, synthetic DNA storage uses biological molecules as an information-bearing medium. However, the legal governance of such systems must distinguish between synthetic DNA used to encode digital information and natural human DNA or biological samples containing identifiable genetic information. These categories raise overlapping but different legal questions.

For example, an archive containing artificially synthesized DNA that encodes a hospital's research records may principally raise questions of information security, medical confidentiality, and archival integrity. If the encoded information includes identifiable patient genomes, the system also raises questions concerning genetic privacy, informed consent, and the potential identification of relatives.

There is currently no single comprehensive international statute specifically governing synthetic DNA-based medical archives. Their regulation must therefore be assessed through applicable privacy legislation, healthcare confidentiality rules, research-ethics requirements, biotechnology regulations, information-security standards, and relevant judicial decisions.

2. Meaning and technological operation

A synthetic DNA data storage system generally involves four stages:

Encoding: Digital information is converted into a sequence of nucleotide symbols—adenine, cytosine, guanine, and thymine.

Synthesis: Artificial DNA molecules are produced to represent the encoded information.

Archival preservation: The molecules are stored under appropriate conditions, with safeguards against degradation, contamination, and loss.

Retrieval and decoding: The DNA is sequenced, and computational methods reconstruct the original digital information.

Medical archives may also use redundancy, error-correction codes, checksums, and separate copies to improve reliability.

The technology may offer high information density and long-term archival potential. Nevertheless, actual performance depends on synthesis and sequencing costs, error rates, storage conditions, retrieval time, and the particular system architecture. It should not be assumed that DNA storage is already superior to conventional medical-record systems for routine clinical access.

A further distinction is essential: DNA used as a storage medium does not automatically constitute a living organism or a gene-editing intervention. Its regulatory treatment depends on the material, intended use, and applicable law.

3. Objectives of legal governance

The primary objectives are:

Confidentiality: Prevent unauthorized access to medical and genomic information.

Integrity: Ensure that archived records remain accurate and unaltered.

Availability: Preserve records for legitimate clinical, scientific, and legal purposes.

Consent and lawful use: Establish a valid basis for collecting, encoding, retaining, and sharing information.

Accountability: Identify institutions responsible for security failures, inaccurate records, or unlawful disclosure.

Long-term preservation: Maintain reliable retrieval mechanisms and documented retention policies.

Equity: Ensure that the benefits of archival technology do not undermine fair access to medical information.

Interoperability: Support reliable exchange of records between authorized institutions while maintaining appropriate privacy safeguards.

These objectives must be balanced. Excessive retention may create privacy risks, while premature deletion may destroy information necessary for patient care, scientific reproducibility, or legal accountability.

4. International legal framework

A. Universal Declaration of Human Rights, 1948

Article 12 protects individuals against arbitrary interference with privacy, family, and correspondence. Article 25 recognizes the importance of an adequate standard of living, including health and well-being.

These principles provide a normative foundation for protecting medical records and sensitive genomic information. They are relevant when synthetic DNA archives are operated by hospitals, research institutions, or public authorities.

The Declaration is not itself a comprehensive, directly enforceable international medical-data statute.

B. International Covenant on Civil and Political Rights, 1966

Article 17 protects against unlawful or arbitrary interference with privacy and correspondence. Article 7 prohibits medical or scientific experimentation without the free consent of the person concerned.

Article 17 is particularly relevant where archived patient information is accessed, retained, or disclosed without sufficient legal justification. Article 7 may become relevant if the creation or use of an archive involves human experimentation rather than merely storing previously generated digital information.

The legal assessment depends on the nature of the activity and the applicable obligations of the state concerned.

C. International Covenant on Economic, Social and Cultural Rights, 1966

Article 12 recognizes the right to the highest attainable standard of physical and mental health.

Reliable medical archives may support continuity of care, clinical research, disease surveillance, and scientific knowledge. However, the pursuit of these benefits must be reconciled with privacy, equality, and applicable consent requirements.

D. UNESCO Universal Declaration on the Human Genome and Human Rights, 1997

This Declaration addresses human dignity, genetic characteristics, confidentiality, informed consent, and protection against discrimination based on genetic characteristics.

It is especially relevant where synthetic DNA storage is used to preserve identifiable genomic datasets. It reinforces the importance of safeguarding sensitive genetic information and preventing discriminatory use.

The Declaration is an ethical and normative instrument, not a universally binding treaty establishing a complete technical regime for DNA data storage.

E. Convention on Human Rights and Biomedicine, 1997

The Oviedo Convention addresses informed consent, private life, and the protection of persons in biomedical activities. It applies as a binding treaty to states that are parties, subject to its provisions.

Its relevance depends on whether the archived information is connected to biomedical interventions, research, genetic testing, or related activities within its scope.

It should not automatically be treated as a universal law governing every synthetic DNA storage platform.

F. Convention 108 and Convention 108+

The Council of Europe's data-protection framework provides important principles for the processing of personal data, including sensitive health information. Convention 108 and its modernizing protocol, Convention 108+, are relevant according to their applicable legal status and implementation.

Their principles support lawful processing, appropriate safeguards, data security, and protection against misuse. Applicability depends on the relevant state and its treaty obligations.

G. General Data Protection Regulation (GDPR)

In the European Union, the GDPR provides a major statutory framework for personal-data processing.

Relevant provisions include:

Article 5: Principles of processing, including purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

Article 6: Lawful bases for processing personal data.

Article 9: Restrictions on processing special categories of personal data, including genetic data and health data, subject to specified exceptions.

Article 17: The right to erasure, subject to exceptions.

Article 32: Security of processing.

Article 89: Safeguards and derogations relevant to certain archiving, scientific, and research purposes.

The GDPR does not require automatic deletion of every medical archive upon request. Article 17 contains exceptions, and Article 89 addresses safeguards for specified processing purposes.

Where the GDPR applies, placing personal data in synthetic DNA form does not itself remove the information from data-protection law. The key issue is whether the encoded information remains personal data and whether the processing falls within the Regulation's territorial and material scope.

5. Governance framework in India

A. Constitutional protection of privacy

Articles 14 and 21 of the Constitution of India provide important safeguards for evaluating the processing of medical and genomic information.

Article 21 protects life and personal liberty, while Article 14 requires equality before the law and equal protection of the laws. These guarantees are relevant when public authorities or institutions establish extensive medical archives containing sensitive information.

B. Digital Personal Data Protection Act, 2023

The Act provides a statutory framework for processing digital personal data, subject to its commencement provisions and applicable exemptions. Its implementation is phased, so the relevant provisions must be checked against the dates on which they come into force. <Cite refs={["turn792252search24","turn792252search25"]}/>

The Digital Personal Data Protection Rules, 2025 include provisions concerning research, archiving, and statistical purposes. Rule 16 provides a conditional exemption for processing necessary for those purposes when the specified standards are followed. This is not an unconditional exemption for every medical archive. <Cite refs={["turn792252search2","turn792252search6"]}/>

For synthetic DNA storage systems, institutions should determine whether the encoded material constitutes digital personal data, whether the Act applies to the processing, and which obligations or exemptions are operative.

C. Information technology and medical confidentiality

The Information Technology Act, 2000, its applicable rules, and other relevant legislation may govern aspects of electronic records, security, and unauthorized access, depending on the circumstances and the provisions currently in force.

Medical institutions must also consider applicable professional confidentiality requirements, clinical-record obligations, research-ethics guidelines, and sector-specific rules.

D. Biomedical research regulation

Where DNA data storage is used in research involving human participants, the institution should comply with applicable ethics committee review, consent, confidentiality, and research-governance requirements.

Research involving synthetic DNA as an information medium should be distinguished from research involving human biological samples, genetic testing, or genome editing. Different regulatory obligations may apply.

6. Major judicial decisions and case laws

There is no widely established judicial precedent directly deciding the legality of synthetic DNA data storage for medical archiving. The following cases provide relevant legal principles by analogy.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Court: Supreme Court of India
Citation: (2017) 10 SCC 1

Facts: The case arose from constitutional challenges concerning the Aadhaar scheme and the recognition of privacy as a fundamental right.

Decision: A nine-judge bench unanimously recognized privacy as a fundamental right under the Constitution.

The judgment established that an infringement of privacy must satisfy constitutional requirements, including legality, a legitimate state aim, and proportionality. <Cite refs={["turn345318search3","turn345318search5"]}/>

Relevance: A medical archive containing identifiable patient records or genomic datasets can reveal highly personal information. Public authorities cannot justify unrestricted collection or disclosure merely by invoking administrative convenience.

A synthetic DNA archive should therefore have a defined purpose, appropriate legal authority, and safeguards proportionate to the sensitivity of its contents.

Case 2: S. and Marper v. the United Kingdom (2008)

Court: European Court of Human Rights, Grand Chamber
Applications: Nos. 30562/04 and 30566/04

Facts: The applicants challenged the retention of their fingerprints, cellular samples, and DNA profiles after criminal proceedings had ended without convictions.

Decision: The Court found a violation of Article 8 of the European Convention on Human Rights, emphasizing the privacy implications of retaining sensitive biological and genetic information indiscriminately. <Cite refs={["turn345318search0","turn345318search7"]}/>

Relevance: The judgment demonstrates that privacy concerns may arise from retention itself, even without proof that information has already been misused.

For medical DNA archives, this supports careful retention policies, access restrictions, purpose limitation, and periodic review of whether continued storage remains justified.

Limitation: The case concerned law-enforcement databases rather than medical archives or synthetic DNA data storage.

Case 3: District Registrar and Collector, Hyderabad v. Canara Bank (2005)

Court: Supreme Court of India
Citation: (2005) 1 SCC 496

Facts: The dispute concerned statutory powers to inspect private documents and the protection of confidential information held by an institution.

Decision: The Supreme Court examined privacy interests in private documents and the constitutional implications of state access to confidential records.

Relevance: Medical archives may be held by hospitals, laboratories, universities, and private storage providers. Their records should not be treated as freely accessible simply because they are maintained by an institution.

The legality of access must be determined by the applicable statutory authority, confidentiality obligations, and constitutional safeguards.

Case 4: Google Spain SL v. Agencia Española de Protección de Datos (2014)

Court: Court of Justice of the European Union
Case: C-131/12

Facts: The case concerned the display of links to older personal information in search-engine results.

Decision: The Court recognized, under the EU data-protection framework then applicable, circumstances in which individuals could seek removal of search results associated with their names.

Relevance: Medical archives may contain outdated, inaccurate, or unnecessarily exposed personal information. The case illustrates the importance of balancing individual privacy against public interest and lawful retention.

However, removing a public search result is different from deleting an underlying medical record. Clinical retention duties, research requirements, and applicable archival exceptions may justify continued preservation.

Case 5: Association for Molecular Pathology v. Myriad Genetics, Inc. (2013)

Court: Supreme Court of the United States
Citation: 569 U.S. 576

Facts: The case concerned patents on naturally occurring DNA sequences associated with hereditary cancer susceptibility.

Decision: The Court held that naturally occurring DNA does not become patent-eligible merely because it has been isolated from the human body, while distinguishing synthetically created complementary DNA.

Relevance: This case may be relevant when an archive uses synthesized DNA sequences, proprietary encoding methods, or patented technologies.

It does not establish that all synthetic DNA storage methods are patentable. Patentability depends on the invention, applicable law, and relevant exclusions.

7. Major legal and ethical challenges

Privacy and re-identification: Encryption or pseudonymization may reduce risk, but it does not guarantee that encoded medical information cannot be identified or reconstructed.

Data integrity: Sequencing errors, molecular degradation, contamination, and decoding failures may corrupt archived records. Institutions should maintain verification procedures and independently recoverable copies.

Consent and secondary use: Permission to use information for treatment does not necessarily authorize every future research or commercial use.

Long-term responsibility: Medical archives may outlast their original operators. Governance should specify succession arrangements, access rights, migration plans, and secure disposal where appropriate.

Cross-border transfers: International storage and retrieval may engage different privacy, confidentiality, and data-transfer regimes.

Liability: Contracts and applicable law should identify responsibility for data loss, unauthorized access, incorrect decoding, and failures to maintain required records.

8. Recommended governance safeguards

A legally responsible medical DNA archive should implement:

Documented legal authority and defined archival purposes.

Appropriate consent or another valid legal basis for processing.

Encryption, access controls, and separation of identifying information from archived data.

Error correction, checksums, validation, and periodic retrieval testing.

Retention schedules and procedures for lawful deletion or restricted access.

Independent security audits and incident-response plans.

Clear agreements governing research use and international transfers.

Continuity plans for institutional closure or changes in storage technology.

Procedures for patient complaints and correction of inaccurate records.

Regular legal and ethical review as technology and applicable regulations evolve.

9. Conclusion

Synthetic DNA data storage may offer a new method for preserving medical and scientific information, but its long-term archival potential does not remove the legal obligations associated with medical confidentiality, privacy, research ethics, and information security.

The principles established in Puttaswamy and S. and Marper are especially relevant to privacy and retention. Canara Bank supports the importance of confidentiality in institutional records, while Google Spain illustrates the need to balance personal privacy against legitimate information-retention interests. Myriad Genetics addresses the separate question of intellectual-property protection for naturally occurring and synthetic DNA.

These cases do not directly establish a comprehensive legal regime for synthetic DNA archives. Rather, they provide principles that must be applied alongside the relevant legislation and technical standards.

Ultimately, responsible governance requires more than preserving the molecular storage medium. It requires preserving the accuracy, confidentiality, lawful accessibility, and ethical integrity of the medical information encoded within it.

This explanation is intended for academic study. The precise legal position depends on the jurisdiction, the type of archived data, the institution's role, and the legislation in force.