LEGAL REGULATION OF LONGITUDINAL GENOMIC DATA TRACKING

1. INTRODUCTION

Longitudinal genomic data tracking refers to the repeated collection, storage, comparison, and analysis of an individual's genomic information over an extended period. It may involve monitoring genetic variants, disease susceptibility, treatment response, inherited conditions, tumour evolution, or changes in genomic biomarkers throughout clinical care and scientific research.

Unlike a single genetic test, longitudinal tracking creates a continuing record that can reveal increasingly detailed information about an individual's health, biological relatives, and future disease risks. It may also combine genomic sequences with electronic health records, wearable-device measurements, prescription histories, and environmental information.

The principal regulatory challenge is to balance scientific progress and personalised medicine against privacy, confidentiality, informed consent, cybersecurity, and protection against discriminatory uses. A sound legal framework must regulate not only the initial collection of genomic data but also subsequent updates, linkage, sharing, retention, re-identification, and secondary research.

2. LEGAL AND REGULATORY FRAMEWORK

A. EUROPEAN UNION GENERAL DATA PROTECTION REGULATION

The General Data Protection Regulation (GDPR) provides a central legal framework for longitudinal genomic tracking where it applies.

Article 5: Requires lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality.

Article 6: Requires a lawful basis for processing personal data.

Article 9: Generally prohibits processing genetic and health data unless an applicable exception permits it, including qualifying healthcare or scientific research processing subject to relevant safeguards.

Article 25: Requires data protection by design and by default.

Article 32: Requires security measures appropriate to the risks.

Article 35: Requires a Data Protection Impact Assessment (DPIA) for processing likely to create high risks to individuals.

For genomic monitoring, these provisions support controlled access, periodic necessity reviews, secure linkage of datasets, documented research purposes, and proportionate retention schedules. Pseudonymised genomic information generally remains personal data where re-identification is reasonably possible.

B. INDIAN LEGAL FRAMEWORK

Article 21 of the Constitution of India protects the right to privacy as part of the right to life and personal liberty. The Digital Personal Data Protection Act, 2023, provides a statutory framework for digital personal data, including processing relevant to genomic tracking where its territorial and material scope is satisfied.

However, its implementation is phased. As of 27 October 2026, the substantive processing obligations in sections 3–17 are scheduled to commence on 14 May 2027 under the 2025 commencement notification. Organisations should therefore verify which provisions are operative at the relevant time rather than treating the entire Act as already enforceable. The Information Technology Act, 2000, and the applicable provisions of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, may also be relevant, depending on the organisation and processing activity. <Cite refs={["turn505743search24","turn505743search5"]}/>

C. INTERNATIONAL RESEARCH AND BIOETHICS STANDARDS

The Declaration of Helsinki and the CIOMS International Ethical Guidelines for Health-related Research Involving Humans provide important ethical guidance on informed consent, research governance, confidentiality, and the use of biological materials and associated data. Their legal status differs from binding legislation, but they may inform research ethics review, institutional policies, and professional obligations.

3. ESSENTIAL REGULATORY REQUIREMENTS

A. INFORMED AND ONGOING CONSENT

Participants should be informed about the duration of monitoring, types of genomic information collected, possible incidental findings, data-sharing arrangements, and foreseeable future uses. Broad consent may be appropriate for certain ethically approved research programmes, but it should not be treated as unrestricted permission for every future use. Applicable legal bases and withdrawal rights must be assessed separately.

B. PURPOSE LIMITATION AND SECONDARY USE

Researchers must distinguish between monitoring for clinical treatment, longitudinal population research, pharmaceutical development, and commercial analytics. Any proposed change of purpose must be assessed under the applicable legal framework, research approval, participant permissions, and data-sharing agreements.

C. DATA SECURITY AND ACCESS CONTROL

Organisations should implement encryption, multifactor authentication, role-based permissions, secure audit trails, pseudonymisation, and tested incident-response procedures. Direct identifiers should be separated from genomic datasets wherever practicable.

D. RETENTION AND PERIODIC REVIEW

Long-term retention may be justified where scientifically necessary or legally required, but indefinite storage should not be automatic. Organisations should establish review dates, deletion or archival criteria, and procedures for reviewing whether continued collection remains necessary.

E. GENETIC RELATIVES AND RE-IDENTIFICATION

Genomic information can reveal inherited characteristics of relatives who never enrolled in a study. Data controllers should assess family-related disclosure risks, restrict access to identifiable findings, and establish appropriate procedures for clinically significant results. De-identification alone is not a guarantee of anonymity because genomic data can sometimes be linked with other datasets.

4. RELEVANT CASE LAWS

1. JUSTICE K.S. PUTTASWAMY (RETd.) v. UNION OF INDIA (2017)

Direct authority on constitutional privacy; analogous to genomic tracking. The Supreme Court of India recognised privacy as a fundamental right under Article 21 and other freedoms guaranteed by Part III of the Constitution. The judgment emphasised legality, legitimate state objectives, proportionality, and safeguards against arbitrary interference. Applied to longitudinal genomic tracking, it supports requiring a lawful basis, a legitimate purpose, and proportionate restrictions on the collection and continued use of sensitive genetic information.

2. S. AND MARPER v. UNITED KINGDOM (2008)

Direct authority concerning DNA retention. The European Court of Human Rights held that the blanket and indefinite retention of DNA samples and profiles belonging to individuals who had not been convicted violated Article 8 of the European Convention on Human Rights. The judgment is particularly relevant to long-term genomic databases because it highlights the sensitivity of genetic information and the importance of retention limits, individual circumstances, and adequate safeguards.

3. Z v. FINLAND (1997)

Direct authority on medical confidentiality. The European Court of Human Rights examined the disclosure of confidential medical information in criminal proceedings and recognised that protecting medical data is essential to private life. For longitudinal genomic monitoring, the case supports strict controls on access to genetic histories and the disclosure of health-related findings to third parties.

4. I v. FINLAND (2008)

Direct authority on healthcare data security. The European Court of Human Rights found that inadequate protection of a patient's medical records against unauthorised access violated Article 8. The case illustrates that organisations must implement effective technical and organisational controls rather than relying solely on confidentiality policies. Genomic tracking systems should therefore maintain access logs, enforce least-privilege permissions, and investigate suspicious access.

5. Gaughran v. UNITED KINGDOM (2020)

Direct authority concerning long-term retention of biometric information. The European Court of Human Rights found an Article 8 violation in the indefinite retention of a convicted person's biometric data, including fingerprints and a DNA profile, without adequate review mechanisms. Although the case arose from criminal justice rather than clinical research, it supports periodic review of whether retaining genomic information remains necessary and proportionate.

6. CASE C-118/22, DIREKTOR NA GLAVNA DIREKTSIA “NATSIONALNA POLITSIA” PRI MVR (2024)

Direct authority on retention safeguards for sensitive data. The Court of Justice of the European Union considered the indefinite storage of personal data, including biometric and genetic data, in a police register. It held that retention must satisfy strict necessity requirements and be accompanied by appropriate safeguards, including effective review of continued storage. This judgment is relevant by analogy to genomic repositories that maintain data over many years. <Cite refs={["turn505743search12"]}/>

These decisions do not establish a single universal legal code for longitudinal genomic tracking. Their precise binding effect depends on jurisdiction, the nature of the organisation, and whether the data are collected for healthcare, research, or law enforcement.

5. PRACTICAL COMPLIANCE MEASURES

Biotechnology companies, hospitals, laboratories, and genomic research institutions should:

Establish a documented legal basis and defined purpose before collecting genomic information.

Obtain appropriate consent and research ethics approval where required.

Conduct a DPIA or equivalent risk assessment for high-risk monitoring programmes.

Maintain a longitudinal data register recording collection dates, permitted uses, access, transfers, and retention periods.

Apply encryption, pseudonymisation, access restrictions, and regular security audits.

Review secondary use, AI model training, and commercial data-sharing arrangements before implementation.

Provide appropriate mechanisms for correcting data, exercising applicable rights, and managing withdrawal requests.

Create protocols for incidental findings, clinically significant discoveries, and potential risks to biological relatives.

Periodically review retention necessity and securely delete or anonymise data when legally and scientifically appropriate.

Establish breach reporting, incident investigation, and accountability procedures under applicable law.

6. CONCLUSION

Longitudinal genomic data tracking can improve precision medicine, disease prevention, and scientific understanding, but continuous collection increases the risk of surveillance, re-identification, unauthorised disclosure, and misuse of inherited information. Effective regulation must therefore address the entire data lifecycle, from initial consent and collection to secondary use, retention, sharing, and eventual deletion.

The GDPR provides an extensive framework for lawful processing, data minimisation, security, and privacy by design. In India, constitutional privacy protections and the applicable statutory framework must be considered alongside the phased commencement of the Digital Personal Data Protection Act, 2023. The decisions in Puttaswamy, S. and Marper, Z v. Finland, I v. Finland, Gaughran, and Case C-118/22 offer important principles for protecting sensitive information. Ultimately, responsible longitudinal genomic tracking requires scientific necessity, transparent governance, proportionate retention, and enforceable safeguards throughout the monitoring period.