1. Introduction

The regulation of storing memories in DNA is an emerging area of biotechnology, information technology, bioethics and intellectual property law. It concerns the use of synthetic DNA molecules to encode, preserve, retrieve and potentially reconstruct digital information, including photographs, documents, audio recordings, personal histories and other forms of human-generated data.

DNA (deoxyribonucleic acid) contains a biological information-storage system based on four nucleotide bases: adenine (A), thymine (T), cytosine (C) and guanine (G). Scientists can translate digital binary information into sequences of these four bases and later retrieve the information through DNA sequencing.

Two distinct applications must be distinguished:

Synthetic DNA data storage: Digital memories, documents and photographs are encoded into artificially produced DNA molecules.

Biological memory storage: Research involving the encoding or preservation of information in living cells, potentially interacting with biological processes.

These technologies raise important legal questions concerning privacy, ownership, consent, genetic information, data protection, cybersecurity, biological safety, research ethics and commercial exploitation.

In the Moroccan context, the regulation of DNA-based memory storage must be examined through existing constitutional protections, personal-data legislation, biomedical research rules, intellectual property law and international bioethics instruments.

Important legal qualification: There is currently no established, comprehensive Moroccan statute specifically regulating commercial DNA-based digital memory storage. Consequently, existing legislation must be interpreted and applied to this developing technology. It would be misleading to present ordinary data-protection cases as direct judicial decisions concerning DNA memory storage.

2. Legal Nature of DNA-Based Memory Storage

DNA-based storage creates a connection between biological material and digital information.

The general process involves:

Converting digital information into binary code.

Translating binary code into nucleotide sequences.

Synthesising DNA molecules containing the encoded information.

Preserving the molecules under controlled conditions.

Sequencing the DNA when retrieval is required.

Reconstructing the original digital information.

WHAT IS LIFE? A 21st CENTURY PERSPECTIVE | Edge.org

Enter the SlipChip: An SoC on the Road to DNA Data Storage | Tom's Hardware

AI breakthrough claimed to make DNA data retrieval 3,200x faster with better accuracy, but still slower than standard storage | Tom's Hardware

8

From a legal perspective, the technology may involve several independently regulated objects:

The digital information itself.

The synthetic DNA sequence.

The biological sample, if human-derived material is used.

The encryption and decoding software.

The storage facility and its security infrastructure.

The personal information of individuals represented in the stored material.

A critical distinction is that encoding a photograph into synthetic DNA does not automatically make that DNA a person's genetic information. However, if the DNA contains identifiable personal information or is derived from an individual's biological sample, additional privacy and biomedical safeguards may apply.

3. Moroccan Legal Framework

A. Constitution of Morocco, 2011

The Moroccan Constitution provides the foundational protection for privacy, dignity and individual rights.

Article 24 – Right to privacy

Article 24 protects the private life of individuals. This protection is relevant when DNA-based memory systems contain personal photographs, private communications, family histories or identifiable biological information.

Article 22 – Human dignity and physical integrity

This provision protects individuals against violations of physical and moral integrity. It may become relevant where DNA storage involves extracting biological material, conducting invasive procedures or manipulating human biological material without appropriate consent.

Article 27 – Right to information

The right to information must be balanced against privacy and other constitutionally protected interests.

Legal significance: A DNA memory-storage company cannot treat the technological possibility of encoding information as an unrestricted right to collect, preserve or disclose an individual's personal information.

CNDP+1

B. Law No. 09-08 on Personal Data Protection

Law No. 09-08 of 18 February 2009 is particularly important to DNA-based memory storage.

It regulates the processing of personal information relating to identified or identifiable individuals.

Article 1: Definition of personal and sensitive data

The law expressly includes genetic information within sensitive personal data.

This creates two important legal situations:

If DNA is obtained from an individual and contains identifiable genetic information, it receives sensitive-data protection.

If synthetic DNA merely encodes a digital photograph or document, without containing identifiable genetic information, the encoded information may nevertheless qualify as personal data under the ordinary definition.

Article 4: Consent

Processing personal data generally requires the individual's unequivocal consent, subject to the statutory exceptions.

A company storing someone's personal memories must establish a lawful basis for collecting and processing the information.

Articles 5–7: Information and access rights

Individuals must receive relevant information about processing and can exercise rights of access to their personal information.

For DNA memory-storage services, this means individuals should be informed about:

What information is encoded.

Why the information is stored.

Who controls the storage system.

Whether third parties can retrieve it.

How long the information will be preserved.

Articles 12–14: Prior formalities

Processing may require prior declaration or authorization before the National Commission for the Control of Personal Data Protection (CNDP), depending on the nature of the processing.

In particular, processing genetic data generally requires prior authorization.

Articles 23–24: Security and confidentiality

These provisions impose security obligations on data controllers, including safeguards against unauthorized access, alteration, destruction and disclosure.

Article 26: Professional confidentiality

Persons who access protected personal information through their professional activities are subject to confidentiality obligations.

BDJ+1

C. Role of the CNDP

The Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP) is central to the supervision of DNA-based memory-storage services.

Its responsibilities include:

Examining applications for authorization.

Supervising personal-data processing.

Monitoring sensitive-data protection.

Reviewing international data transfers.

Ensuring compliance with confidentiality requirements.

Taking appropriate action in response to violations.

A company offering DNA-based storage in Morocco should determine whether its activities require a CNDP declaration or prior authorization.

The CNDP also requires appropriate arrangements for overseas transfers of personal data.

CNDP+1

D. Consumer Protection Law No. 31-08

Law No. 31-08 concerning consumer protection may apply when DNA memory storage is offered commercially.

For example, a storage company must not misrepresent:

The duration of DNA preservation.

The reliability of information retrieval.

The security of stored data.

The possibility of permanent preservation.

The ability to recover information after damage.

False advertising, misleading contractual terms and unfair commercial practices may create consumer-protection liability.

E. Intellectual Property Law No. 17-97

Morocco's Law No. 17-97 on industrial property, as amended, is relevant to inventions and technological processes used in DNA-based data storage.

Potentially protectable innovations include:

DNA encoding techniques.

Synthetic DNA manufacturing methods.

Sequencing technologies.

Error-correction systems.

Data-retrieval software, subject to applicable intellectual property requirements.

However, ownership of a patented technology does not automatically confer ownership over the personal memories encoded using that technology.

This distinction is essential: intellectual property rights in the storage mechanism must be separated from privacy rights and contractual interests in the underlying information.

4. Consent and Ownership of Stored Memories

Consent is one of the most important legal requirements.

DNA memory-storage systems may involve information relating not only to the person who uploads the information but also to family members, friends and other individuals.

For example, a person might upload:

Family photographs.

Private correspondence.

Medical records.

Voice recordings.

Personal diaries.

Genetic ancestry information.

The uploading person cannot necessarily provide consent on behalf of every other identifiable individual represented in those materials.

A legally compliant service should establish:

Informed consent: The customer must understand the nature of DNA encoding and storage.

Purpose limitation: Information must not be reused for unrelated purposes without an appropriate legal basis.

Third-party protection: Information concerning other identifiable individuals must be handled lawfully.

Withdrawal and deletion: The service should explain how withdrawal of consent and deletion requests will be handled, subject to applicable legal obligations.

Posthumous memories: Contracts should specify what happens after the customer's death, including access by heirs, designated representatives and family members.

A particularly difficult question arises when a deceased person's DNA-based memory archive contains sensitive information about living relatives. The rights of living individuals must remain protected.

5. Biological Safety and Ethical Regulation

DNA storage technology may operate through synthetic DNA, modified microorganisms or living biological systems. Each method creates different regulatory risks.

A. Synthetic DNA safety

Synthetic DNA stored in laboratory containers generally presents different risks from DNA incorporated into living organisms.

Regulatory supervision should address:

Chemical and biological safety of synthesis processes.

Laboratory containment and occupational safety.

Prevention of accidental contamination.

Secure transportation of synthetic DNA.

Disposal of biological and chemical waste.

Prevention of unauthorized biological experimentation.

B. Storage inside living organisms

If information is encoded into living cells, the regulatory issues become more complex.

The technology may involve genetic modification, recombinant DNA or engineered microorganisms.

Depending on the organism, intended use and experimental procedure, relevant Moroccan biosafety, environmental and research requirements must be examined.

A company cannot assume that approval for ordinary digital data storage automatically authorizes genetic engineering.

C. Human dignity and ethical limits

DNA-based memory storage may eventually be proposed for preserving information about human identity, personality or life experiences.

However, storing digital information in DNA is not equivalent to transferring a person's consciousness or preserving their subjective memories.

The distinction is important because commercial companies must not advertise experimental DNA storage as a scientifically established method of preserving human consciousness.

Ethical regulation should therefore require:

Transparent scientific explanations.

Informed consent.

Independent ethical review where human-subject research is involved.

Protection of vulnerable research participants.

Restrictions on deceptive medical claims.

Appropriate oversight of experiments involving human biological materials.

6. International Legal Framework

DNA memory storage is inherently capable of crossing national boundaries. A Moroccan customer might store encoded DNA in a laboratory in Europe, while the decoding software is operated by a company in the United States.

Several international frameworks are relevant.

These instruments do not all have the same legal status. Binding treaty obligations must be distinguished from declarations and non-binding ethical standards.

For Morocco, international obligations must also be considered alongside domestic legislation and applicable ratification arrangements.

7. Important Case Laws and Their Application

There is an important limitation in this developing area: no verified reported Moroccan judgment specifically addresses the storage of digital memories in synthetic DNA. The following decisions are comparative precedents. They provide useful legal principles, but foreign judgments are not automatically binding on Moroccan courts.

Case 1: S. and Marper v. United Kingdom (2008)

Highly relevant DNA privacy precedent

Citation: Applications Nos. 30562/04 and 30566/04, European Court of Human Rights, Grand Chamber, 4 December 2008.

Facts:

The applicants challenged the indefinite retention of their fingerprints, DNA samples and DNA profiles by British police following criminal proceedings that did not result in convictions.

Legal issue:

Whether retaining DNA samples and profiles without adequate justification violated the right to respect for private life under Article 8 of the European Convention on Human Rights.

Judgment:

The Court held that retaining the applicants' DNA samples and profiles constituted an interference with their private life. It found the blanket and indiscriminate retention system disproportionate.

Principle established:

Sensitive genetic information requires strict safeguards, appropriate retention limits and a proportionate legal justification.

Application to DNA memory storage:

A commercial DNA-storage company should not retain personal genetic material indefinitely without a legitimate purpose and appropriate safeguards.

It should establish:

A defined retention period.

Access restrictions.

Secure storage procedures.

Deletion mechanisms.

Clear consent arrangements.

Bailii+1

Case 2: Gaughran v. United Kingdom (2020)

Citation: Application No. 45245/15, European Court of Human Rights, 13 February 2020.

Facts:

The applicant challenged the indefinite retention of his DNA profile, fingerprints and photograph following conviction for a minor offence.

Legal issue:

Whether indefinite retention of biometric information without adequate review violated Article 8.

Judgment:

The Court found a violation of Article 8 because the retention arrangements were disproportionate and lacked sufficient safeguards, including an effective possibility of review.

Application to DNA memory storage:

The decision supports the principle that DNA-storage providers should not adopt unlimited retention policies without justification.

Storage contracts should identify:

The purpose of retention.

The duration of storage.

Conditions for extension.

Procedures for reviewing continued retention.

Circumstances requiring destruction.

Bailii

Case 3: R (S and Marper) v. Chief Constable of South Yorkshire Police (2011)

Citation: [2011] UKSC 21.

Facts:

The United Kingdom Supreme Court considered the consequences of the European Court's decision in the DNA-retention dispute and the treatment of DNA material under police retention rules.

Legal significance:

The decision illustrates the domestic legal consequences of the European Court's privacy principles and the importance of revising national retention practices.

Application:

Moroccan policymakers could consider a similar approach when developing rules for DNA-based digital archives, particularly concerning retention, deletion and independent supervision.

Bailii

Case 4: S. and Marper v. United Kingdom – Family Genetic Privacy Principle

A particularly important aspect of the 2008 judgment concerns the relationship between an individual's DNA and the genetic information of relatives.

The Court recognised that biological samples contain information relevant not only to the individual but also to family members.

Application:

Suppose a company stores DNA obtained from one customer. The stored material may contain genetic information capable of revealing information about relatives.

The company must therefore distinguish the customer's consent from the privacy interests of family members.

This is particularly important for genetic genealogy archives and DNA-based family-memory services.

Bailii+1

Case-law analysis

These judgments concern forensic DNA retention rather than synthetic DNA archives. Their principles are relevant by analogy, not direct rulings on digital DNA storage.

8. Intellectual Property and Ownership Disputes

DNA memory storage creates new questions about who owns the stored information and the technological system.

Consider a situation in which a biotechnology company converts a customer's family photographs into synthetic DNA.

Four separate interests may arise:

Customer: Rights concerning the photographs and personal information.

Storage company: Contractual rights to provide storage services.

Technology developer: Patent or other intellectual property rights in qualifying inventions.

Third parties: Copyright and privacy rights in photographs or documents belonging to others.

Major legal questions

Who owns the DNA sequence?

The answer depends on the nature of the material, applicable intellectual property law, property principles and the contractual arrangements. A customer does not automatically acquire ownership of every laboratory process or patented technique.

Can the company sell stored memories?

It cannot assume that commercial possession of the physical DNA gives it unrestricted authority to sell or disclose the encoded information.

Can stored memories be used for AI training?

Using personal archives to train artificial intelligence may constitute a new processing purpose. Under Moroccan Law No. 09-08, the company must establish an appropriate legal basis and comply with applicable CNDP requirements.

Can memories be inherited?

The physical DNA material, contractual service rights and underlying intellectual property may have different succession rules. Contracts should expressly address death, inheritance and authorized access.

9. Criminal Liability and Cybersecurity

DNA memory storage creates new opportunities for unlawful access, commercial exploitation and destruction of personal information.

Potential offences and legal violations include:

Unauthorized access to DNA storage databases.

Theft of encoded personal information.

Destruction or alteration of stored DNA.

Unauthorized disclosure of confidential information.

Fraudulent sale of another person's memories.

Manipulation of DNA sequences to corrupt stored information.

Unauthorized processing of sensitive genetic data.

Illustrative legal disputes

Scenario 1: Unauthorized access

A hacker obtains access to a DNA memory archive and extracts private family photographs and personal documents.

The company may face liability if it failed to implement appropriate security measures under Articles 23 and 24 of Law No. 09-08.

Scenario 2: Unauthorized commercial use

A company uses customers' encoded personal archives for AI training without an appropriate legal basis.

This may create liability under personal-data protection legislation, particularly where the new processing purpose is incompatible with the original purpose.

Scenario 3: Destruction of stored DNA

A laboratory employee deliberately destroys a customer's only DNA archive.

Depending on the circumstances, this may generate contractual, civil and potentially criminal consequences under applicable Moroccan law.

10. Cross-Border DNA Memory Storage

International DNA storage creates complex jurisdictional problems.

For example:

A Moroccan customer provides information to a Moroccan company.

The company converts it into synthetic DNA.

The DNA is physically stored in Germany.

A decoding platform operates in the United States.

The customer retrieves the information from Morocco.

This arrangement raises questions concerning international data transfers, contractual jurisdiction, applicable law and enforcement.

Under Law No. 09-08, international transfers of personal data are subject to specific legal conditions and CNDP procedures.

The CNDP identifies foreign data transfers as a matter requiring appropriate formalities.

BDJ+1

Important regulatory safeguards include:

Identification of the data controller and overseas processors.

Prior examination of applicable transfer requirements.

Appropriate contractual safeguards.

Security standards for foreign storage facilities.

Clear rules governing government access.

Effective procedures for deletion and data recovery.

International cooperation in investigating data breaches.

A physical DNA sample that contains no identifiable personal information may raise different legal questions from a DNA sample containing personal genetic information. Regulators must examine both the material and its informational content.

11. Major Regulatory Challenges

12. Recommendations for Morocco: A Special Regulatory Framework

Morocco could develop a dedicated regulatory framework for DNA-based information storage.

A proposed framework could contain the following provisions.

1. DNA Memory Storage Licensing

Companies offering commercial DNA-memory services should satisfy appropriate technical, cybersecurity and laboratory standards.

2. Genetic Information Protection

Sensitive genetic information should receive heightened protection under Law No. 09-08.

3. Mandatory Informed Consent

Customers should receive clear information about encoding, preservation, retrieval, secondary uses and deletion.

4. Independent Scientific Oversight

Research involving human biological materials or living genetically modified organisms should receive appropriate scientific and ethical scrutiny.

5. Data Security Certification

DNA storage facilities should implement encryption, restricted access, physical security and disaster-recovery procedures.

6. Retention and Destruction Rules

Providers should establish transparent retention schedules and procedures for destroying DNA material and associated personal information.

7. Posthumous Data Governance

Customers should be able to designate representatives and provide instructions regarding access to their archives after death.

8. International Cooperation

Morocco should strengthen regulatory cooperation concerning overseas storage, foreign processors and cross-border enforcement.

9. Consumer Protection

Commercial providers should disclose the scientific limitations, reliability and actual preservation capabilities of their services.

10. Liability and Compensation

Legislation should clarify civil liability, contractual remedies and appropriate sanctions for unauthorized access, destruction, disclosure and misuse.

13. Conclusion

The regulation of storing memories in DNA represents an important emerging challenge for biotechnology and information law.

DNA can function as a highly dense medium for storing digital information, but its use introduces questions that traditional digital storage legislation does not always adequately address.

In Morocco, Law No. 09-08 provides a significant foundation because it expressly recognises genetic information as sensitive personal data. Constitutional privacy protections, consumer protection legislation and industrial property law provide additional legal safeguards.

The comparative judgments in S. and Marper v. United Kingdom and Gaughran v. United Kingdom demonstrate the importance of proportionality, limited retention, confidentiality and independent review in the handling of genetic information.

Ultimately, Morocco should consider a specialised legal framework that distinguishes synthetic DNA data storage from the storage and manipulation of human genetic material. Such a framework should protect individual autonomy, scientific innovation, family privacy and the security of digital memories.

14. Important Legal References

Primary research sources:

Moroccan Law No. 09-08 – Official legal text.

Moroccan CNDP – Laws and regulations.

CNDP – Data protection requirements.

European Court of Human Rights – S. and Marper judgment.

European Court of Human Rights – Gaughran judgment.

WIPO – Moroccan Industrial Property Law.

Research note: The case-law discussion uses comparative judgments because a directly applicable Moroccan reported precedent on DNA-based digital memory storage has not been identified. The proposed licensing and certification requirements are legislative recommendations, not claims about existing Moroccan statutory obligations.