Protection of Genomic Databases

Protection of Genomic Databases refers to the legal, technical, and ethical measures adopted to safeguard databases containing genetic information, DNA sequences, genomic profiles, and related biological data from unauthorized access, misuse, disclosure, alteration, or destruction.

Genomic databases are used in medical research, disease diagnosis, forensic investigations, biotechnology, personalized medicine, and population genetics. They may contain highly sensitive information about individuals and their biological relatives.

For example, a genomic database maintained by a hospital may contain DNA information relating to inherited diseases. Unauthorized disclosure of this information could result in genetic discrimination, privacy violations, identity-related risks, or misuse of sensitive medical information.

Central principle: Genomic databases must be protected through strong privacy safeguards, informed consent, cybersecurity, responsible data sharing, and legal accountability.

1. Legal principles governing genomic database protection

A. Privacy and confidentiality

Genetic information is highly sensitive because it may reveal inherited diseases, biological relationships, ancestry, and other personal characteristics.

The protection of genomic databases must therefore respect the constitutional right to privacy under Article 21.

B. Informed consent

Individuals should understand why their genetic data is collected, how it will be stored, who may access it, and whether it may be shared for future research or commercial purposes.

C. Purpose limitation

Genomic information collected for medical diagnosis should not automatically be used for unrelated purposes such as employment screening, commercial profiling, or law enforcement.

D. Data minimization

Institutions should collect and retain only the genetic information reasonably necessary for the specified purpose.

E. Security and accountability

Genomic databases should be protected through encryption, access controls, audit trails, cybersecurity assessments, and appropriate incident-response procedures.

2. Important case laws

A. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court of India recognized privacy as a fundamental right under Article 21.

The Court explained that informational privacy protects personal information from unauthorized collection, storage, and disclosure. It also held that restrictions on privacy must satisfy legality, legitimate purpose, and proportionality.

Legal significance: This is the foundational Indian constitutional authority for protecting genomic databases. Genetic information is particularly sensitive because it may reveal personal and familial information.

Indian Kanoon+1

B. Selvi v. State of Karnataka (2010)

The Supreme Court examined the constitutionality of involuntary narco-analysis, polygraph examinations, and brain electrical activation profile tests.

The Court emphasized the protection of personal autonomy, mental privacy, and the right against compelled self-incrimination.

Legal significance: The judgment supports the principle that biological and personal information cannot be obtained or used without respecting constitutional safeguards. Its relevance to genomic databases is by analogy; it did not directly decide genetic-data storage or database security.

C. District Registrar and Collector v. Canara Bank (2005)

The Supreme Court examined the right to privacy in relation to the inspection of private documents held by a financial institution.

The Court emphasized that confidential personal information is entitled to protection against unjustified state intrusion.

Legal significance: The judgment supports the principle that sensitive records held by institutions must be protected against unauthorized access and disclosure.

D. S. and Marper v. United Kingdom (2008), European Court of Human Rights

The European Court of Human Rights examined the retention of DNA samples and profiles of individuals who had not been convicted of offences.

The Court held that the indefinite retention of such information violated Article 8 of the European Convention on Human Rights.

Legal significance: The decision is an important comparative authority on genetic privacy, DNA retention, and the proportionality of storing sensitive biological information.

Indian Kanoon

3. Indian statutory framework

The Digital Personal Data Protection Act, 2023, does not create a separate statutory category exclusively for genetic data. However, its data-protection principles are relevant to genomic information held in digital form.

Live Law+1

4. Major risks associated with genomic databases

Unauthorized access to genetic records.

Disclosure of inherited diseases or family relationships.

Genetic discrimination in employment or insurance.

Misuse of DNA information for unrelated purposes.

Cyberattacks targeting genomic research institutions.

Re-identification of supposedly anonymized genetic data.

Uncontrolled commercial sharing of genetic information.

A major concern is that genetic information is relational: a person's DNA may reveal information about biological relatives who never provided their own data.

5. Illustrative example

Suppose a hospital creates a genomic database for diagnosing inherited diseases. A biotechnology company later requests access to the database for commercial research.

The hospital must examine whether the original consent covers the proposed research, whether the data can be anonymized, whether additional consent or legal authorization is required, and whether the proposed disclosure is consistent with applicable data-protection obligations.

If the company uses the genetic data to identify individuals or disclose inherited disease risks without authorization, legal consequences may arise under applicable privacy, data-protection, contractual, and other laws.

Conclusion

Protection of Genomic Databases is an essential component of modern biotechnology governance. It requires a balance between scientific research, medical innovation, individual privacy, and public interest.

The judgments in Puttaswamy, Selvi, Canara Bank, and S. and Marper establish important principles concerning privacy, autonomy, confidentiality, and the retention of sensitive biological information.

The fundamental principle is that genomic databases must be managed responsibly, with appropriate consent, strict access controls, purpose limitation, and accountability, so that scientific progress does not compromise human dignity or genetic privacy.