ARTICLE 29 Data Protection Working Party
This Working Party was set up under Article 29 of Directive 95/46/EC. It is an independent European advisory body on
data protection and privacy. Its tasks are described in Article 30 of Directive 95/46/EC and Article 14 of
Directive 97/66/EC.
The secretariat is provided by Directorate E (Services, Copyright, Industrial Property and Data Protection) of the
European Commission, Internal Market Directorate-General, B-1049 Brussels, Belgium, Office No C100-6/136.
Website: www.europa.eu.int/comm/privacy
12178/03/EN
WP 91
Working Document on Genetic Data
Adopted on 17 March 2004
-2-
Working Document on Genetic Data
THE WORKING PARTY ON THE PROTECTION OF INDIVIDUALS WITH
REGARD TO THE PROCESSING OF PERSONAL DATA,
Having regard to Directive 95/46/EC of the European Parliament and of the Council of
24 October 1995 on the protection of individuals with regard to the processing of
personal data and on the free movement of such data
1
, and in particular Articles 29 and
30 paragraph 1 (a) thereof,
Having regard to the Rules of Procedure of the Working Party
2
, and in particular Article
12 and 14 thereof,
HAS ADOPTED THE PRESENT WORKING DOCUMENT
I. GENERAL OUTLINE OF THE ISSUES
The technical progress which science has made over recent years in the field of genetic
research has given rise to new data protection questions and concerns in relation to the
significance and impact of genetic tests and the processing of genetic data.
The sound protection of genetic data can be considered nowadays to be a prerequisite
in order to ensure respect for the equality principle as well as to make the right to health a
reality. All the most recently published international instruments actually prohibit any
discrimination based on genetic data. Under Article 21 of the Charter of Fundamental
Rights of the EU, “any discrimination based (…) on genetic features” shall be prohibited,
and this prohibition can also be found in the Council of Europe’s Convention on Human
Rights and Bio-Medicine (Article 11) and UNESCO’s Universal Declaration on Human
Genome and Human Rights (Article 6).
Effectiveness of these prohibitions is related to the existence of strict rules limiting
the opportunities for using genetic data. Indeed, the protection of the right to health is
conditional upon the assurance that no genetic data may be known to third parties, who
might use it to discriminate against and/or stigmatise the data subject. In the USA, there
have been many cases in which individuals have decided not to undergo genetic tests –
although they were necessary to protect their health – because they feared that the
findings might come to be known by their employers and insurance companies. This
gave rise to a lively debate as well as to the passing of important legislation. Indeed, in
Section 2(5) of the Genetic Information Nondiscrimination Act recently adopted by the
US Senate, which is currently before the House of Representatives, it is stressed that a
“Federal legislation establishing a national and uniform basic standard is necessary to
fully protect the public from discrimination and allay their concerns about the potential
for discrimination, thereby allowing individuals to take advantage of genetic testing
technology, research, and new therapies”. Based on this assumption, the Act lays down
very strict rules under which genetic information may not be used by either employers or
insurance companies.
1
OJ L 281, 23.11.1995, p. 31, available at:
http://europa.eu.int/comm/internal_market/en/media/dataprot/index.htm
2
Adopted by the Working Party at its third meeting held on 11.9.1996.
-3-
In its opinion 6/2000 on the Human Genome and Privacy, issued on 13 July 2000, the
Working Party already emphasised the necessity of coupling new genetic technologies
with adequate safeguards to protect the right for privacy. In their annual international
conference in Santiago de Compostela in September 1998, the European Data Protection
Authorities expressed their concerns on the creation of a nationwide centralised database
of medical records to be used for genetic research in Iceland. They recommended that the
Icelandic authorities reconsider the project in the light of the EU Data Protection
Directive principles and in particular the importance of securing anonymity and stressed
that economic interests should not lead to an extension of the original purpose of the
database.
Given the growing importance and sensitivity of the issues related to the protection of the
genetic data as well as the initiatives currently in progress both at national and
supranational level, the Working Party introduced this topic in its Work Programme for
2003.
At regulatory level the situation across the EU appears to be uneven. Indeed, while some
Member States have explicitly listed genetic data as sensitive data in their Data
Protection law with all the safeguards and restrictions associated, in most Member States
the issue of the processing of genetic data is not as such regulated by specific legislation.
However, some Member States do provide for complementary rules in their laws on
patient's rights and legal regulations for the processing of genetic data. As national
authorities become increasingly aware of the risks associated with the processing of
genetic data, a general trend towards new initiatives at the national regulatory level is
anticipated.
Furthermore, at the supranational level, the conditions for the performance of genetic
tests, which are a prerequisite for the subsequent performance of the processing of the
relevant data obtained, have been taken into account and/or are in the process of being
dealt with
3
. The only legally-binding international instrument that exists today remains
the Convention on Human rights and Biomedicine adopted in 1997 in Oviedo and
opened since then for accession and ratification
4
. The Convention bans all forms of
discrimination based on the grounds of a person's genetic profile and allows the carrying
out of predictive genetic tests only for medical purposes.
The main purpose of the present document is to identify areas of concern related to the
processing of genetic data from a data protection perspective and contribute to a more
uniform approach in the light of the national measures adopted in this field under
3
COUNCIL OF EUROPE
• Working Document on the Applications of Genetics for Health Purposes of 7 February 2003,
which is currently the subject of consultation, being closely related to the principles laid down
in the 1997 Biomedicine Convention.
• Draft Explanatory Report of the Steering Committee on Bioethics (CDBI) to the Draft
Additional Protocol to the Convention on Human Rights and Biomedicine, on Biomedical
Research of 22 August 2003 has been transmitted to the Parliamentary Assembly which plans
to discuss it at the end of January 2004.
UNESCO
• International Declaration on Human Genetic Data of the IBC adopted on 16 October 2003.
4
The Chart of signatures and ratifications of the Convention on Human Rights and Biomedicine is
published at the following URL address :
http://conventions.coe.int/Treaty/EN/searchsig.asp?NT=164&CM=1&DF=
-4-
Directive 95/46/EC. Moreover, the Working Party's ambition at this stage is to establish
a common understanding of the different issues relating to the processing of genetic data.
Third pillar issues related to genetics will not be dealt with in detail by the present
document as they do not fall within the scope of the Directive.
II. DEFINITIONS AND MAIN CHARACTERISTISCS OF GENETIC DATA
Definitions:
All data of whatever type concerning the hereditary characteristics of an individual or
concerning the pattern of inheritance of such characteristics within a related group of
individuals (Council of Europe Recommendation N°R(97)5)
Any data concerning the hereditary characteristics of an individual or group of related
individuals (Art 2 (g) of the 2 August 2002 law of Luxembourg on the protection of
persons with regard to the processing of personal data)
Non-obvious information about heritable characteristics of individuals obtained by
analysis of nucleic acids or by other scientific analysis (International Declaration on
Human Genetic data, UNESCO)
Characteristics:
Genetic data show in themselves characteristics which make them singular, in particular
compared to health data. They provide or are likely to provide, in the future, scientific, medical
and personal information relevant throughout the life of an individual. This information can also
have a significant incidence on the family of the data subject, over several generations and in
certain cases on the whole group to which the data subject belongs.
The identification by the genetic print also presents a unique nature. Indeed, genetic data are
likely to reveal information on several people while making it possible to identify only one of
them. They reveal the uniqueness of the data subject.
As a result of these specificities, the processing of genetic data requires and justifies a particular
legal protection. Such is the object pursued by the working paper on genetic data.
But, mankind should not be reduced to its genetic characteristics only, to its sole genetic
cartography, which in any case does not constitute the ultimate universal explanation of human
life.
One of the first guarantee conditioning the use of genetic data should therefore be to avoid
attributing to these data a universal explanatory value.
Genetic data thus present a number of characteristics which can be summarised as
follows:
- while genetic information is unique and distinguishes an individual from other
individuals, it may also at the same time reveal information about and have
implications for that individual's blood relatives (biological family) including
those in succeeding and preceding generations, Furthermore, genetic data can
characterise a group of persons (e.g. ethnic communities);
genetic data can reveal parentage and family links;
-5-
- genetic information is often unknown to the bearer him/herself and does not
depend on the bearer's individual will since genetic data are non modifiable;
- genetic data can be easily obtained or be extracted from raw material although
this data may at times be of dubious quality;- taking into account the
developments in research, genetic data may reveal more information in the future
and be used by an ever increasing number of agencies for various purposes.
III. APPLICABILITY OF THE 95/46/EC DIRECTIVE
According to Art 2 (a) of the Directive: "personal data" shall mean any information
relating to an identifiable natural person (data subject); an identifiable person is one
who can be identified, directly or indirectly, in particular by reference to an
identification number or to one or more factors specific to his physical, physiological,
mental, economic, cultural or social identity."
There is no doubt that genetic information content is covered by this definition. Indeed,
a link to a specific person, i.e. the fact that the person concerned is identified or
identifiable, is clear in the majority of cases. Nevertheless in some cases it is less clear,
e.g. samples of DNA taken in a given place, such as traces at the scene of a crime.
However, such samples may constitute a source of personal data in so far as it may be
possible to associate samples of DNA with a given person, in particular once their origin
has been confirmed by a court upon the forensic evidence. Therefore, in regulating
genetic data, consideration should also be given to the legal status of DNA samples.
According to Article 8(1) of the Directive, categories of personal data whose sensitivity
requires a higher level of protection includes "data concerning health". Genetic data may
provide to an extent a detailed picture of a person's physical disposition and health
condition and therefore could be considered as "data concerning health". Furthermore,
genetic data may also describe specific forms of a wide range of physical characteristics.
Thus, genetic data which determine the colour of someone's hair, for example, may not
be regarded as data directly concerning health. In this context, genetic data can contribute
e.g. to assess the ethnic origin of an individual and should as well be considered as
falling within the scope of Art 8 (1).
Considering the extremely singular characteristics of genetic data and their link to
information that may reveal the health condition or the ethnic origin, they should be
treated as particularly sensitive data within the meaning of Article 8 (1) of the Directive
and therefore be subject to the reinforced protection provided for in the Directive and the
national laws transposing it.
According to Article 8 (3) of the Directive, the singularity of sensitive data is such that
it may only be processed in exceptional circumstances, i.e. : "where processing of the
data is required for the purposes of preventive medicine, medical diagnosis, the provision
of care or treatment or the management of health care services", and according to specific
conditions. Indeed, data concerning health may only be processed by a health
professional subject to the obligation of medical secrecy or by another person subject to
an equivalent obligation of secrecy. It can be argued that genetic data could be processed
in one of the exceptional circumstances listed above.
According to Art 6 of the Directive, personal data must be collected for specified,
explicit and legitimate purposes and not further processed in a way incompatible with
those purposes (Finality principle). In addition, personal data must be adequate, relevant
-6-
and not excessive in relation to the purposes for which they are collected and further
processed (Proportionality principle).
Considering the complexity and the sensitivity of the genetic information, there is a great
risk of misuse and/or re-use for various purposes by the data controller or third parties.
Risks of re-use might occur e.g. using the genetic information already extracted, or
through additional analysis of the underlying material (e.g. blood sample). The Directive
prohibits further processing that would be incompatible with the purpose for which the
data was collected. Nevertheless, it provides for exemptions to the prohibition to further
process data for historical, statistical or scientific purposes provided that Member States
put in place appropriate safeguards.
Furthermore, an evaluation of the respect for proportionality and the respect for
legitimacy is necessary, taking into account the risks for the protection of fundamental
rights and freedoms of individuals and notably whether or not the intended purpose could
be achieved in a less intrusive way. Genetic data may only be used if adequate, relevant
and not excessive. This implies a strict assessment of the necessity and proportionality of
the processed data. (Example Case: the Spanish Data Protection Authority (DPA)
deemed that the creation of a file of genetic samples to identify newborns through DNA
testing was not in order. The aim of such files would be to prevent mother-infant
mismatches. The Spanish DPA took the view that the creation of a genetic file would
contravene the principle of proportionality since the same result could be reliably
obtained with other means e.g. identity bracelets or footprints.) Proportionality has been
the main criterion in almost all decisions taken until now by the Data Protection
Authorities on the processing of genetic data.
The respect of the finality and proportionality principles imply a clear determination of
the purpose for which genetic data are collected and further processed. To avoid
incompatible re-use it is essential that the purposes for processing genetic data are clearly
defined.
According to Article 10 of the Directive, the data subject has a right to receive information
from the controller (or his representative) when the data is collected directly from said data
subject. According to Article 11 of the Directive, the data subject also has a right to
receive information from the controller (or his representative) when the data has not been
obtained from said data subject. Given the sensitivity of genetic data, the right to
information is particularly relevant in the context of the processing of such data. In cases
where the exemption provided for under Article 8.3 is applicable, the health professional
might be confronted with the following dilemma: on the one hand he could be bound by the
obligation of secrecy, while on the other hand he could be obliged under article 11 to
provide information to the data subject (e.g.: in the case where information is extracted from
genetic material received from relatives).
-7-
IV. PURPOSES FOR WHICH THE COLLECTION AND PROCESSING OF GENETIC DATA
MAY TAKE PLACE AND RELEVANT ISSUES
Due to the special nature and characteristics of genetic data and the impact their use may
have on the individual's life and on the members of his family, it is very important to
determine the purposes for which genetic data may be processed.
• Health care/ medical treatment
Genetic testing has proved to be a great tool to assess an individual's health.
Understanding how genetics influence every aspect of health can lead to far more
effective ways to treat, cure or even prevent diseases. Collection of genetic data to
enhance health care is deemed the main legitimate purpose for their further processing.
Diagnostic genetic tests serve to clarify the causes of an already clinically manifest
illness. Genetic investigation carried out for diagnostic purposes can either take the place
of conventional diagnostic instruments or be used to complement them. Diagnostic tests
may also have a predictive health component as well, with regard to members of the
family of the person concerned.
Predictive genetic tests are designed to identify genetic changes which are highly likely
to lead to an illness at a later point in the life of the person tested. A particular problem
associated with predictive diagnostics is that, even if genetic changes can be identified
which are demonstrably linked to certain illnesses, it often cannot be predicted with
certainty if and when a particular illness will occur in the later life of the person
concerned.
In both cases, the data subject should be duly informed about the necessity of carrying
out such tests and give its explicit consent for that purpose and for the processing of its
genetic data (Art 8. 2 (a)). Informed consent is particularly crucial in the field of genetic
testing as the information that individuals will receive about themselves could have
serious implications. Free consent should mean that an individual is not coerced into
undergoing genetic testing and without it being his express will to do so.
Right to know/access to the genetic information by the members of the biological family
of the person concerned:
Right to know:
One of the fundamental features of genetic data consists both in its marking out an
individual from others and the fact that this data – and more precisely: the characteristics
to which it refers - is structurally shared by all the members of the same biological group
– whereas other mechanisms by which personal data are shared depend on the data
subjects’ will, on social custom, or on legal rules.
Since the results of genetic testing may have serious implications/consequences for
the members of a biological family, questions on the information to be given to the
relatives from a data protection perspective are raised.
-8-
In the European Convention on Bio-medicine as well as in the Universal Declaration
on Human Genome, the approach to protecting data confidentiality would appear to be
based on an individualistic concept. A totally different approach has been followed by
other equally significant instruments, which are more mindful of the importance
attributed nowadays to genetic data – such as the Council of Europe’s Recommendation
No. R(97)5, Clinton’s Executive Order of 8 February 2000 (“To Prohibit Discrimination
in Federal Employment Based on Genetic Information”), the Statement on DNA
Sampling by the Hugo Ethics Committee, the 2003 International Declaration on Human
Genetic Data of UNESCO, and the Genetic Information Non-discrimination Act.
5
Given the highly sensitive nature of this issue, a balance must be found between a
data subject’s right not to disclose hits or her genetic information and the potential
serious implications/consequences the disclosure and use of such information could have
on the members of a biological family.
Indeed, the specificity of genetic data makes it necessary to view some aspects of the
regulations applying to them in a more than merely individualistic perspective – with
particular regard to access to these data by kindred members inside the relevant
biological group. Furthermore, issues related to the mechanisms for circulating genetic
information within this group arise. These issues concern, in particular, a possible
obligation, for an individual to disclose his/her genetic data to his/her kindred where such
data are relevant in view of safeguarding their health, and the exercise of the right not to
know inside the group.
In this context, questions arise as to whether or not genetic data belong exclusively to
the single, specific individual from whom they are collected, and to whether family
members have the right to access to such data even in the absence of the individual’s
consent.
To the extent that genetic data has a family dimension, it can be argued that it is
“shared” information, with family members having a right to information that may have
implications for their own health and future life.
The precise legal consequences of this argument are not clear yet. At least two
scenarios can be imagined. One is that other family members could also be considered as
“data subjects” with all the rights that follow from this. Another option is that other
family members would have a right of information of a different character, based on the
fact that their personal interests may be directly affected. However, in both scenarios
5
In the Recommendation by the Council of Europe, genetic data are defined as any data of whatever type
“concerning the hereditary characteristics of an individual or concerning the pattern of inheritance of such
characteristics within a related group of individuals”. Under the Executive Order, “protected genetic
information” also includes information “about the occurrence of a disease, or medical condition or disorder
in family members of the individual
” (see Section 2(e)C). The Hugo Ethics Committee recommended that
“special consideration should be made for access by immediate relatives”, and actually attached special
importance to the relatives’ role by making destruction of collected data conditional upon their lack of
interest in accessing such data. In the International Declaration on Human Genetic Data it is pointed out
that such information has a “special status” because of its “significant impact on the family”. The Genetic
Information Nondiscrimination Act provides that “the term ‘genetic information’ means information about
(i) an individual’s genetic tests; (ii) the genetic tests of family members of the individual” (see Section
101(6) and elsewhere).
-9-
further options and conditions would have to be considered to accommodate the various
conflicts that are likely to arise between the different claims of family members, either to
have access to information or to keep it confidential.
A case was addressed in this connection in Italy, in 1999, through a decision issued
by the Garante per la protezione dei dati personali, which granted a lady the possibility to
access her father’s genetic data although the latter had denied his consent. This request
was granted by considering that the father’s right to privacy was to be overridden by the
lady’s right to health – the latter meaning her “psychological and physical well-being”.
6
Thus, a new, legally relevant social group can be said to have come into existence –
namely, the biological group, the group of kindred as opposed, technically speaking, to
one’s family. Indeed, such group does not include family members such as one’s spouse
or foster children, whereas it also consists of entities outside the family circle – whether
in law or factually – such as gamete donors or the woman who, at the time of childbirth,
did not recognise her child and requested that her particulars should not be disclosed –
this right being supported in certain legal systems. The anonymity granted to the latter
entities raises a further issue, which is usually dealt with by providing that the personal
data required for genetic testing be communicated exclusively to a physician without
referring to the identity of the relevant individual.
Given the complexity of the issues described above, the Working Party takes the view at
this stage that consideration should be given to a case by case approach in deciding how
to address possible conflicts between the interests of the data subjects and those of their
biological family.
Right not to know: It is the case where the person concerned chooses not to be informed
of the results of the genetic test nor receive any further information (i.e. as to whether it
is carrying a defective gene or is going to suffer a disease) particularly if the disease is
highly serious and at the time there are no scientific means to prevent or treat it. The
same applies to the family members who may wish to assert a right not to know about the
results of a test taken by a family member to determine the presence or absence of a
serious genetic disorder, preferring to live their lives without the shadow of such
information. This is particularly true when there is no prevention or treatment available.
(Case example: The CNIL came to the conclusion that it was not appropriate to
systematically inform the family of patients who carry a gene of an incurable disease and
to generate in this way permanent anxiety without a possible direct benefit for the
members of the family, as no useful treatment would be available to them in the near
future.)
6
The lady had requested disclosure of the data to carry out a genetic test and
subsequently take a fully informed reproductive decision – upon assessing the risk of
transmitting a genetic disease that affected her father. The authorisation granted by the
Garante could be reached by taking account of the peculiar features of genetic data,
which are transmitted from one generation to the next one and thereby represent the
common heritage of several entities; the Council of Europe’s Recommendation was
expressly referred to in the decision, which was published in the Garante’s Bulletin
(Cittadini e società dell’informazione 1999, no. 8, p. 13-15).
-10-
Counselling: Genetic testing inevitably poses certain ethical and legal questions and
informed decision making is very important in this respect. Therefore, extraordinary
conditions such as preliminary counselling may apply in certain cases (e.g. counselling to
couples that wish to undergo genetic testing before taking the decision to give birth to a
child). This aspect, although an important issue, will not be developed in the present
paper.
• Employment
From the employer's point of view, the processing of genetic data could be used in a pre-
recruitment stage in order to help him/her identify candidates that are not fit for a specific
job e.g in case of a declared disease or are likely to suffer from diseases and therefore not
hire such candidates. From the employee's perspective, genetic tests may provide him
/her with information on whether a particular job is suitable for him/her and what
protective measures can be taken to improve its workplace.
The Working Party has had the opportunity to examine the processing of genetic data in
the employment context on the basis of the consultation document on a "Community
framework concerning the protection of worker's personal data in the employment
context". In its concluding document, dated 24
th
of September 2003, the Working Party
considered that the processing of genetic data in the field of employment should be
prohibited in principle. The Working Party added that the processing of the latter should
only be authorised under really exceptional circumstances and by taking also account of
the ban against their processing that is already in force in several Member States.
Furthermore, as pointed out in the opinion of July 2003 by the European Group on
Ethics in Science and New Technology concerning “Ethical Aspects of Genetic Testing
in the Workplace”, “there is, up to now, no proven evidence that the existing genetic tests
have relevance and reliability in the context of employment. They still have uncertain
predictive value”. Therefore, it is not to be allowed that individuals may be discriminated
against on the basis of information that, in predictive terms, should not be regarded as
final in most cases – both because its effects depend on the association with other factors,
such as environmental factors, and because of its probabilistic nature
• Insurance
The Working Party believes at this stage that the processing of genetic data in the field of
insurance should be prohibited in principle and only authorised under really exceptional
circumstances, clearly provided for by law. Indeed, the use of genetic data in the
insurance field could lead to an insurance applicant or members of his family being
discriminated against on the basis of their genetic profile. In some cases insurance
applicants might, as a result of an unfavourable finding in a genetic test, be required to
pay exorbitant premiums for insurance cover or even be regarded as uninsurable on the
basis of a potential illness which may even never arise. This position is in line with the
positions adopted in most Member States, where the processing of genetic data in the
field of insurance does not constitute a legitimate purpose.
-11-
• Medical and scientific research
In recent years large volumes of genetic data have been collected and stored for research
activities. The main reason for this processing is to advance the understanding of the
human genome and its potential in medicine, following the work of genetic scientists
with regard to DNA. Research databases or the so-called bio-banks have proved to make
an important contribution to health care.
The establishment of large genetic research databases is, however, a potential cause of
concern from a data protection perspective. Issues such as a) the further processing of
the data for purposes that may have not even been conceived at the time of their
collection b) the duration of storage of genetic data, and c) the appropriate security
measures, should be thoroughly examined.
Bio banks are an ongoing study. Once established, such databases are potentially subject
to a number of different uses or appetites. In fact, many of the research uses are
secondary to some of the original purposes. Given the potential financial ramifications
linked to scientific research on genetics, it is currently unrealistic to predict how fast this
research will develop.
In this respect the issue of prescribing practices applying anonymisation could be a
possibility to address issues from the data protection perspective.
Nevertheless, it seems that during a certain period and for the research purpose, the
person carrying out the research needs to be able to link the data with the data subject
(e.g. to assess the evolution of a sickness, the reaction to a treatment etc.). In addition,
there has been evidence that stored DNA is capable of being linked to a particular person
- provided certain additional knowledge is available, even though it may not be stored in
a directly person-specific way. According to a definition of the task group established by
the Danish government to assess the need for further legislative proposals in Denmark, a
bio-bank is defined as a structured collection of human biological material which is
accessible under certain criteria and where information contained in the biological
material can be traced back to individuals.
The question on the duration of storage of genetic data is also linked to the feasibility of
the anonymisation process. Usually, after some years, identifiable characteristics can be
stripped from the research data base and thus the data become anonymous and
irretrievably unlinked to an identifiable person. In France, for example, the "Huriet" Act
of 20/12/1988 on clinical trials provides that data cannot be anonymised before 15 years
after their collection. The Dutch data protection authority has been confronted with
situations where anonymisation or deletion of data kept in biobanks could substantially
diminish the value and functions of such data bases, since the data would no longer be
linked to identifiable individuals. Examples are databases for longitudinal researches,
sometimes encompassing several generations, such as the cancer registration. Arguments
from the field for longer retention periods should be taken into account in such cases.
Another issue is the security measures employed to protect the data used for medical and
scientific research purposes. Concerning the use of bio banks, high level security
measures, both organisational and technical, should be taken to protect the data contained
therein, in compliance with Article 17 of the Directive. For instance, data controllers
should be encouraged to carry out surveys of potential risks, establish policies for
-12-
security, inform and train staff on an on-going basis, set up restricted access controls in
order to avoid undue access by administrative staff and other persons, etc.
• Identification
Genetic data has proved to be an important tool in the process of identification in various
fields. The most important to mention would be to aid criminal investigations aimed at
identifying offenders as well as to enhance the identification of missing persons . In this
latter case the processing performed, while undertaken without the consent of the missing
data subject, would be justified on the grounds of the existence of circumstances of vital
interest to the individual concerned. As far as the criminal investigations are concerned,
according to the penal law of some Member States the consent of the individual
suspected of having committed an offence is not a perquisite for the processing of its
genetic data. From a data protection perspective the most important area where genetics
can be used for identification purposes is to test the existence of paternal or other family
links. In most of the cases such testing is decided by the Court during a civil suit and the
explicit consent of the parties involved is required.
However, there is a proliferation of Internet-based offers of genetic tests aimed especially
at establishing fatherhood. It is a new emerging technology known as ‘genetic testing
direct to the public’ or 'genetic home testing'. This kind of test allows an individual to
determine the paternity of a child, for example, by sending samples from the relevant
individuals by post to a testing laboratory to undergo analysis. This results in a
determination as to whether the 'father' is the genetic father of the child. Such services are
advertised on the Internet and the necessary samples can be obtained covertly, for
example by taking a sample of hair from a pillow. The covert nature of the sampling
could mean that an individual is in effect subject to genetic testing without any
knowledge of the testing and consequently without his or her consent.
In this respect, the ease with which genetic material can be obtained without the data
subject's knowledge (and therefore consent) and further used with a view to carrying out
paternity tests must be prevented by a clear rule, as is the case in several Member States.
Moreover, exemptions in this field should specifically safeguard the data subject's
interests/rights. For instance, the Dutch DPA has decided that each individual involved in
genetic testing should sign a declaration stating that the collected DNA samples belong
to itself and that it consents to participate in the test. With regard to minors, the Dutch
DPA stated that a written declaration should be produced by their legal representatives.
In their written declaration, each representative should stipulate that he/she consents to
the child's participation and assert that the DNA samples belong to the child. Finally, the
concerned representative should indicate whether there are other legal representatives,
and if so, he/she should declare that they do no object to the genetic testing.
-13-
V. CONCLUSIVE REMARKS
Given the fast moving age of technological, scientific and economic developments in the
field of genetics and taking into account the variety of purposes for which the processing
of genetic data may take place, the Working Party felt it was necessary at this stage to
define a common approach with a view to establishing the appropriate safeguards for the
processing of genetic data. The main lines of this approach can be summarised as
follows:
• Any use of genetic data for purposes other than directly safeguarding the data
subject's health and pursuing scientific research should require national rules to
be implemented, in accordance with the data protection principles provided for in
the Directive, and in particular the finality and proportionality principles. The
application of these principles render the blanket implementation of mass genetic
screening unlawful.
Furthermore, in accordance with these principles, the processing of genetic data
should be authorised in the employment and insurance fields only in very
exceptional cases provided for by law, so as to protect individuals from being
discriminated against on the basis of their genetic profile.
In addition, the ease with which genetic material can be obtained unbeknownst to
the data subject and the relevant information can be susbsequently extracted from
such material, requires strict regulations in order to prevent the dangers related to
new forms of "identity theft" – which would be especially dangerous in this
sector and might affect fatherhood and motherhood, or even the possibility of
using the material for cloning puposes. This is why, in regulating genetic data,
one should not fail to consider the legal status of the DNA samples used for
obtaining the information at stake. Among the issues addressed, special
importance should be attached to the application of a wide range of data subjects'
rights to the management of such samples, as well as to destruction and/or
anonymisation of the samples after obtaining the required information.
Finally, procedures should be put in place in order to ensure that genetic data are
only processed under the supervision of qualified professionals who are entitled
to such processing on the basis of specific authorisations and rules.
• In Member States where the purposes and the appropriate safeguards for the
processing of genetic data are not established by law, the DPAs are encouraged to
play an even more active role in ensuring that the finality and proportionality
principles of the Directive are fully respected.
In this respect, the Working Party recommends that Member States should
consider submitting the processing of genetic data to prior checking by DPAs, in
accordance with Article 20 of the Directive. This should in particular be the case
with regard to the setting up and use of bio banks.
Moreover, closer cooperation and exchange of best practices between DPAs
could prove to be an efficient way to compensate the present absence of
-14-
regulatory framework in the field of the on-line "genetic testing direct to the
public".
• It is worth noting that a new, legally relevant social group is coming into
existence – namely, the biological group, the group of kindred as opposed,
technically speaking, to one's family. Indeed, such a group does not only include
family members such as one's spouse or foster children, but it can also consist of
entities outside this family circle – whether in law or factually (e.g. : gamete
donors).
The Working Party intends to revisit this working document in the light of the experience
acquired by the data protection authorities with regard to the processing of genetic data.
This document should be regarded as a stepping stone towards further discussions on the
issues at stake. The Working Party will closely monitor the evolution of said issues and
may decide to focus in detail on specific areas at a later stage, in order to keep in line
with the technological developments linked to the processing of genetic data.
Done at Brussels, on 17th March 2004
For the Working Party
The Chairman
Peter Schaar
