Re identification risks in genomic databases

Introduction

Re-identification risks in genomic databases refer to the possibility of identifying an individual from supposedly anonymised or de-identified genetic information by combining genomic data with other available information. Genomic databases contain highly sensitive biological information, including DNA sequences, genetic variations, hereditary characteristics, and information about potential health conditions.

Although researchers frequently remove names, addresses, and other direct identifiers before sharing genomic information, genetic data can still reveal an individual's identity. This is because every person's genome contains distinctive characteristics and may also reveal information about biological relatives.

The growing use of genomic databases in medical research, biotechnology, personalised medicine, forensic investigations, and pharmaceutical development has increased concerns regarding privacy, confidentiality, and misuse of genetic information. Therefore, preventing re-identification has become an important legal and ethical responsibility.

Meaning and nature of re-identification risks

Re-identification occurs when information that has been separated from an individual's identity is linked with additional information to determine the identity of the person concerned.

For example, a research institution may publish genomic information without including participants' names. However, an external researcher might combine the genomic information with publicly available family genealogy records, demographic information, or medical databases and identify the individual.

Genomic information presents special privacy challenges because it is:

Uniquely identifying: Genetic variations can distinguish individuals and sometimes identify them through matching databases.

Familial in nature: An individual's genetic information may reveal information about parents, siblings, and children.

Permanent: Unlike passwords or identification numbers, genetic characteristics cannot ordinarily be changed.

Predictive: Genomic information may indicate susceptibility to certain inherited conditions.

Cross-linkable: Genetic information can be compared with genealogical, medical, forensic, and demographic databases.

Consequently, removing direct personal identifiers does not always guarantee complete anonymity.

Major sources of re-identification risks

1. Public genomic databases

Genomic research platforms sometimes make genetic information available for scientific research. If the information is combined with publicly accessible records, individuals may become identifiable.

2. Genetic genealogy services

Genealogy databases allow individuals to identify biological relationships through genetic matching. Such information may indirectly reveal the identity of people who have not personally submitted their DNA.

3. Data linkage

Researchers or unauthorised third parties may combine genomic records with hospital records, demographic databases, public registries, or other datasets.

4. Insufficient anonymisation

Traditional anonymisation methods may be inadequate for genomic information because genetic sequences contain distinctive and persistent characteristics.

5. Cybersecurity breaches

Unauthorised access, data theft, or inadequate security controls may expose genomic information and increase the possibility of identity disclosure.

Legal framework governing genomic privacy in India

India does not currently have one comprehensive statute exclusively regulating genomic databases. However, several legal provisions are relevant.

1. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data. Genomic information connected with an identifiable individual falls within the general concept of personal data.

The Act establishes obligations concerning lawful processing, consent, security safeguards, and individual rights, subject to its applicable provisions and exemptions.

2. Information Technology Act, 2000

Section 43A historically provided compensation for failure by a body corporate to maintain reasonable security practices concerning sensitive personal data or information. However, its operation must be considered alongside the commencement and repeal provisions of the DPDP Act.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 also historically addressed sensitive personal information, including medical and biometric information.

3. Constitution of India

Article 21 protects the right to life and personal liberty, which includes the right to privacy. Article 14 also provides protection against arbitrary State action.

These constitutional protections are important when government institutions collect, store, process, or disclose genomic information.

4. Indian Council of Medical Research guidelines

The ICMR National Ethical Guidelines for Biomedical and Health Research Involving Human Participants, 2017 provide ethical standards for research involving human participants, including informed consent, confidentiality, privacy, and responsible handling of biological samples and associated information.

Important judicial decisions and case laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

The Supreme Court of India unanimously recognised privacy as a fundamental right under the Constitution.

The judgment established that privacy includes informational privacy and protection against unjustified interference with personal information.

Its importance for genomic databases is substantial because genetic information reveals intimate details about individuals and their families. Collection, storage, and disclosure of such information must satisfy constitutional requirements, including legality, legitimate purpose, and proportionality where applicable.

2. District Registrar and Collector v. Canara Bank (2005)

The Supreme Court examined the protection of privacy in relation to confidential financial records and the limits of State access to private information.

The judgment recognised the importance of protecting personal records against arbitrary interference. Its reasoning is relevant to genomic databases because genetic records similarly contain confidential personal information requiring appropriate legal safeguards.

3. Selvi v. State of Karnataka (2010)

The Supreme Court considered the constitutional validity of involuntary narcoanalysis, polygraph examinations, and brain electrical activation profile tests.

The Court emphasised personal liberty, privacy, and protection against compelled testimonial responses under Article 20(3).

Although the case did not directly concern genomic databases, its constitutional reasoning is relevant to the collection and use of biological information without appropriate legal authority or consent.

4. R. Rajagopal v. State of Tamil Nadu (1994)

The Supreme Court recognised the right to privacy and examined the circumstances in which private information may be published without consent.

The judgment established important principles concerning confidential personal information and unauthorised disclosure. These principles are relevant when genomic research institutions or database operators consider publishing identifiable genetic information.

5. X v. Hospital Z (1998)

The Supreme Court considered confidentiality and disclosure of medical information in the context of an individual's HIV-positive status.

The Court recognised that medical confidentiality is important but may be subject to competing public-interest considerations in particular circumstances.

The judgment is relevant to genomic privacy because genetic information may reveal medically significant information about individuals and their biological relatives.

Preventive measures and regulatory safeguards

Preventing re-identification requires a combination of technological, institutional, and legal safeguards.

1. Strong access controls: Genomic databases should restrict access to authorised researchers and institutions.

2. Encryption: Genetic information should be encrypted during storage and transmission.

3. Controlled data sharing: Researchers should receive only the genomic information necessary for their approved research purposes.

4. Informed consent: Participants should be informed about data collection, storage, sharing, future research uses, and possible privacy risks.

5. Privacy-preserving technologies: Techniques such as differential privacy, secure multiparty computation, and federated learning can reduce unnecessary exposure of individual-level information.

6. Independent audits: Institutions should regularly evaluate database security, access permissions, and compliance with privacy requirements.

7. Data governance policies: Clear rules should establish retention periods, disclosure procedures, breach reporting, and accountability.

Challenges in regulating genomic databases

Several difficulties affect the effective protection of genomic information. First, technological developments continuously improve the ability to identify individuals through genetic matching. Second, genomic databases frequently operate across international boundaries, creating differences in privacy regulations. Third, genetic information can reveal details about relatives who have never consented to its collection or processing.

Another major challenge is balancing scientific research with individual privacy. Excessively restrictive data-sharing requirements may affect medical discoveries, while unrestricted access may expose individuals to discrimination, profiling, and unauthorised disclosure.

Conclusion

Re-identification risks in genomic databases represent a significant challenge for biotechnology, biomedical research, and data protection law. Genetic information cannot always be considered anonymous merely because names and direct identifiers have been removed. Its distinctive, permanent, and familial characteristics create additional privacy concerns.

In India, constitutional privacy protections recognised in Justice K.S. Puttaswamy v. Union of India, together with the Digital Personal Data Protection Act, 2023 and ICMR ethical guidelines, provide important foundations for genomic data governance. Strong encryption, informed consent, controlled access, independent audits, and responsible data-sharing practices are essential to protect individuals from re-identification and preserve public confidence in genomic research.