Sensitive Data Classification: Biotech Genomics

Introduction

Biotechnology and genomics generate information about an individual’s DNA, genetic variations, inherited traits, disease susceptibility, ancestry, and biological relationships. Such information may be collected through genetic testing, genome sequencing, medical research, biobanks, or personalised healthcare.

Sensitive Data Classification in Biotech Genomics concerns identifying genomic information that requires stronger privacy and security protections because its misuse may cause discrimination, stigma, loss of confidentiality, or harm to biological relatives.

Genomic data is particularly sensitive because it is enduring, difficult to change, and potentially informative about both the person tested and their family. However, not every genetic record carries the same level of risk. Legal protection should therefore consider identifiability, purpose of processing, and potential harm.

Legal Framework in India

1. Constitutional Right to Privacy

Article 21 of the Constitution protects life and personal liberty, including informational privacy. Genetic data collection and processing may therefore require a lawful basis, a legitimate purpose, and proportionate safeguards—particularly where the State is involved.

2. Digital Personal Data Protection Act, 2023

The DPDP Act regulates digital personal data relating to identifiable individuals. It does not create a separate statutory category called “sensitive personal data” for genetic or genomic information. Consequently, identifiable genomic data may fall within the Act’s general personal-data framework rather than receiving a distinct heightened classification solely because it is genetic.

RK Singh, Vini Singh, 2024+1

3. Information Technology Act, 2000 and SPDI Rules, 2011

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 identify certain categories of sensitive information, including medical records and biometric information. The rules do not expressly name genetic data as a separate category. Whether a particular genomic record falls within a listed category depends on its nature and use.

The distinction is important: genomic data may be highly sensitive in practical terms, even where the law does not expressly classify every form of it as a separate statutory category.

RK Singh, Vini Singh, 2024+1

Important Case Laws

1. K.S. Puttaswamy v. Union of India (2017) 10 SCC 1

The Supreme Court unanimously recognised privacy as a fundamental right under Article 21 and other constitutional freedoms. It identified informational privacy as an essential aspect of individual autonomy and required privacy intrusions to satisfy legality, legitimate purpose, and proportionality.

This judgment provides the constitutional foundation for protecting genomic information against unjustified collection, disclosure, or misuse.

Indian Kanoon

2. Selvi v. State of Karnataka (2010) 7 SCC 263

The Supreme Court held that involuntary narco-analysis, polygraph examinations, and brain-mapping techniques violate constitutional protections when conducted without consent. The decision emphasised personal autonomy and the protection of information associated with an individual’s mind and body.

Although the case did not directly concern genome sequencing, its reasoning is relevant to compulsory genetic testing and the need for consent and constitutional safeguards.

Indian Kanoon

3. Sharda v. Dharmpal (2003) 4 SCC 493

The Supreme Court held that courts may direct medical examinations, including DNA testing, in appropriate cases. However, such directions must be justified by the circumstances and cannot be ordered as a routine matter. The case demonstrates the need to balance evidentiary interests against personal privacy and bodily autonomy.

Classification and Safeguards

A risk-based genomic data framework may distinguish:

Identifiable genomic data: DNA sequences directly linked to a named or identifiable person; requires strong access controls.

Health-linked genomic data: Genetic results associated with disease risks or treatment; requires confidentiality and careful use.

Family-linked genomic data: Information revealing hereditary conditions or biological relationships; may affect relatives who did not provide consent.

De-identified genomic data: Data stripped of direct identifiers; still requires safeguards because re-identification may be possible.

Aggregated genomic data: Population-level information; requires protection against group stigma and discriminatory inferences.

Conclusion

Sensitive Data Classification in Biotech Genomics is essential for protecting privacy, autonomy, and dignity in the genomic age. Indian law currently does not provide a separate, comprehensive statutory classification for all genetic data. Nevertheless, constitutional privacy principles and existing data-protection provisions offer important safeguards.

The decisions in Puttaswamy, Selvi, and Sharda establish that bodily and informational privacy cannot be disregarded merely because genetic information may be useful for research, healthcare, or litigation. A robust legal framework should adopt risk-based classification, informed consent, limited access, secure storage, and protection against discriminatory use.