REGULATORY GOVERNANCE OF GENETIC RISK SCORING MODELS

1. INTRODUCTION

Genetic risk scoring models are computational tools that analyse genetic variations to estimate an individual's likelihood of developing particular diseases or health conditions. Polygenic risk scores (PRS), for example, combine the effects of multiple genetic variants to estimate susceptibility to conditions such as cardiovascular disease, diabetes, and certain cancers. These models can support preventive healthcare, personalised medicine, and clinical decision-making. However, their use raises significant legal concerns involving privacy, informed consent, discrimination, scientific validity, medical liability, and algorithmic fairness.

The regulation of genetic risk scoring models therefore requires a coordinated framework combining data protection law, medical-device regulation, anti-discrimination safeguards, research ethics, and professional accountability.

2. LEGAL AND REGULATORY FRAMEWORK

A. DATA PROTECTION AND GENETIC PRIVACY

Genetic information is highly sensitive because it can reveal inherited characteristics and provide information about biological relatives. Where applicable, the European Union's General Data Protection Regulation (GDPR), particularly Articles 5, 6, 9, 13–15, and 22, governs lawful processing, transparency, special-category genetic data, and certain automated decisions.

B. MEDICAL-DEVICE REGULATION

Where a genetic risk scoring model is intended for diagnosis, prevention, prognosis, or treatment decisions, it may fall within medical-device or in-vitro diagnostic software regulation. In the European Union, the Medical Device Regulation (EU) 2017/745 and In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 may apply depending on the product's intended purpose and design.

C. ANTI-DISCRIMINATION PROTECTION

Genetic scores must not be used as unjustified grounds for employment exclusion, insurance discrimination, or denial of healthcare. In the United States, the Genetic Information Nondiscrimination Act 2008 (GINA) restricts specified uses of genetic information in health insurance and employment, although important limitations and exceptions remain.

3. PRINCIPAL REGULATORY REQUIREMENTS

A. VALIDATION AND SCIENTIFIC RELIABILITY

Developers should demonstrate analytical validity, clinical validity, and clinical utility. A score must be validated against appropriate populations and relevant clinical outcomes. Models trained predominantly on one ancestry group may produce less reliable estimates for other populations, creating risks of unequal treatment.

B. INFORMED CONSENT AND TRANSPARENCY

Individuals should receive understandable explanations of the purpose of testing, data use, limitations, potential familial implications, and relevant data-sharing practices. Consent should not be misleading or treated as a substitute for every other legal requirement.

C. DATA SECURITY AND GOVERNANCE

Organisations should implement access controls, encryption, retention limits, secure data sharing, incident response procedures, and appropriate safeguards for research reuse. Genetic data should not be repurposed for unrelated commercial or employment decisions without a lawful basis.

D. HUMAN OVERSIGHT AND ACCOUNTABILITY

Clinicians should interpret scores alongside family history, clinical examinations, environmental factors, and established diagnostic evidence. Developers and healthcare providers should document model versions, monitor performance, correct errors, and provide suitable review mechanisms for consequential decisions.

4. RELEVANT CASE LAWS

1. S AND MARPER v. UNITED KINGDOM (2008) — DIRECTLY RELEVANT BY ANALOGY

The European Court of Human Rights held that the blanket retention of fingerprints and DNA profiles from unconvicted persons violated Article 8 of the European Convention on Human Rights. Although the case did not concern genetic risk scoring, it establishes an important privacy principle: retaining sensitive genetic information requires proportionate justification and appropriate safeguards.

2. MYRIAD GENETICS, INC. v. ASSOCIATION FOR MOLECULAR PATHOLOGY (2013) — ANALOGOUS AUTHORITY

The United States Supreme Court held that naturally occurring DNA segments are not patent-eligible merely because they have been isolated, while synthetically created cDNA may be patent-eligible subject to the Court's reasoning. The decision concerns genetic testing and biotechnology rather than risk-scoring regulation, but it informs debates about ownership, access, and commercial control of genetic technologies.

3. FEDERATION FRANÇAISE DES SOCIÉTÉS D'ASSURANCE v. MINISTÈRE DE L'AGRICULTURE (C-44/95, 1997) — LIMITED ANALOGICAL RELEVANCE

This Court of Justice of the European Union decision concerned the interpretation of European biotechnology legislation in the context of genetically modified organisms. It is not a genetic risk scoring case and offers only a broad regulatory analogy concerning the interpretation of specialised biotechnology rules.

4. GOOGLE SPAIN SL v. AGENCIA ESPAÑOLA DE PROTECCIÓN DE DATOS (C-131/12, 2014) — ANALOGOUS AUTHORITY

The CJEU recognised, in the context of search-engine processing, that data protection rights may require a balance between individual privacy and competing public interests. Its reasoning is relevant by analogy to transparency, control over personal information, and the limits of commercial data processing.

5. BARBER v. GUARDIAN ROYAL EXCHANGE ASSURANCE GROUP (1990) — NOT A GENETIC-SCORING PRECEDENT

This employment equality decision of the CJEU concerned equal treatment in occupational pension arrangements. It does not establish rules for genetic discrimination; its relevance is limited to the broader principle that employment-related decisions may be subject to enforceable equality requirements.

6. ASSOCIATION FOR MOLECULAR PATHOLOGY v. MYRIAD GENETICS (2013) — DIRECTLY RELEVANT TO GENETIC TESTING, NOT SCORING

The same United States Supreme Court judgment is particularly relevant to the genetic-testing context because it distinguishes naturally occurring genetic material from patent-eligible inventions. It does not determine the legality of polygenic risk scores, algorithmic discrimination, or clinical deployment.

5. PRACTICAL COMPLIANCE MEASURES

Healthcare institutions and developers should establish documented validation protocols, assess ancestry-related performance differences, conduct privacy and impact assessments where required, obtain appropriate consent, and maintain secure records of data access and model updates. High-impact clinical recommendations should be subject to qualified professional review, and patients should be informed that a probabilistic score does not establish that a disease will or will not develop.

Regulators should also clarify responsibility among laboratories, software developers, healthcare professionals, and institutions when defective data or unreliable predictions cause harm.

6. CONCLUSION

Genetic risk scoring models offer substantial potential for preventive and personalised medicine, but their legitimacy depends on scientific reliability, privacy protection, fairness, and accountable clinical use. Existing genetic privacy, data protection, medical-device, and equality laws provide important foundations, although their precise application varies by jurisdiction. The cited cases supply privacy and biotechnology principles rather than a settled body of direct genetic-risk-scoring precedent. Effective regulation must therefore combine enforceable legal safeguards with continuing scientific validation, human oversight, and proportionate monitoring.