I thought that other students particularly US nationals may find this of interest. Whilst I was researching privacy I came upon the New-born Screening for Genetic and Metabolic Disorders Act (I think that is the correct title or something very similar). What I found interesting is that the Act, intended to be used to establish genetic abnormalities in new-borns, may have a more sinister application. Although US legislation is not my forte it appears prima facie that this Act gives unprecedented access to the DNA profiles of all US New-borns (born after 2007/8). Furthermore, it appears that parents/guardians do not have to give consent for the clinicians to take samples.
What surprises me is the apparent lack of protest against such a database. If a government body is to administer the database, what is to stop other agencies in the future such as the FBI using the database for criminal investigation? If all new-borns have their DNA profiles taken then eventually the US will have an absolute DNA database excluding only those who are born without medical supervision.
In Europe the ECtHR case – S and Marper v United Kingdom [2008] ECHR 1581 was a clear indication of the illegality of collecting such databases. For example, in Scotland if you commit a non-serious crime your DNA profile taken at the police station will be destroyed within a set period. Although, in England and Wales the Home Office is much more unsure on how it should proceed.
Should information which is derived from a biological source be of greater importance for protection? And if so should the state face specific legal obligations for its safe and secure eradication? Most of the Home Office literatures are guidelines.
Should information which is derived from a biological source be of greater importance for protection?
ReplyDeleteTo the extent that the biological data "concerns health," it would likely be subject to a higher standard anyway, by virtue of being a "special category" of data, for the purposes of 95/46/EC.
However, generally, I am not sure of the need of increasing protection for biological data in particular - is it of a sufficiently different character, or poses a significantly greater risk, than the misuse of any form of personal data? Appropriate laws protecting personal data generally should, I would have thought, be sufficient?
(Whether law enforcement agencies should be retaining data - biological or otherwise - in the absence of a conviction, is conversation well worth having, though.)
Baroness Hale in S and Marper v UK [2008] (see above) thought so and went on to differentiate between the collection of fingerprints and biological samples – the latter being more “private to the individual”.
ReplyDeleteIf data derived from a biological source is more private and possibly unique to the individual what steps could be taken to safeguard its storage and deletion? Or as Neil argues is Directive 95/46/EC (as amended) adequate? Can we really differentiate between a numerical sequence profiling DNA and one relating to a bank account? Perhaps the consequences indicate we can - the repercussions for unauthorised access to certain types of data. Would it more damaging if someone used your credit card account to pay for petrol or if your DNA was planted at a crime scene?
An interesting thread. I'm not sure that Baroness Hale does see a particular difference, or envisages the need of a higher standard of protection, for genetic / biological data, though.
ReplyDeleteBaroness Hale comments that "there can be little, if anything, more private to the individual than the knowledge of his genetic make-up" (para 71), but this does not amount to her saying that there needs to be a greater form of protection than is available for other forms of personal data, but rather that, since protection under Art. 8 requires a reasonable expectation of privacy, if genetic information does not give rise to such an expectation, there would be few other circumstances which would qualify. Genetic data, to her mind, certainly give rise to a reasonable expectation of privacy, and are at the lower end of what constitutes private information (i.e. there is less to argue about as to whether they should give rise to a reasonable expectation of privacy), but not that such information justifies somehow special protection.
Similarly, she does not differentiate between fingerprints and biological samples, but rather the differences arising from varying uses:
it is necessary to distinguish between the taking of fingerprints and samples, the deriving of information from those samples, the storage of samples and information, and the use of either samples or information for some particular purpose.
(para 68)
She distinguishes here between the taking ... the deriving ... the storage ... and the use, rather than the subject matter, arguing that each constitutes an interference of Art. 8.
She goes on to argue that:
[The samples] are not kept for their intrinsic value as mouth swabs, hairs or whatever. They are kept because they contain the individual's unique genetic code within them. They are kept as information about that person and nothing else. Fingerprints and profiles are undoubtedly information. The same privacy principles should apply ...
(para 70)
I certainly share her views as to the dangers of abuse by future accessors of the information - as demonstrated in Germany under the Nazi regime - but, as the German situation demonstrates, the linkage to genetic information does not necessarily pose a particular risk here, over and above the excessive processing of other personal information.
Her conclusion - the thrust of her whole argument - is that "[t]he general tenor of the jurisprudence of the European Court and Commission of Human Rights is that the retention, keeping or storage of private information by state institutions is an interference with article 8(1) rights" and that the multiple uses of the personal data in the case at hand therefore constitute an interference. I don't read her judgment as indicating that genetic data are somehow different, but that they are clear examples of personal information for the purposes of 95/46/EC, and that processing by a third party constitutes an interference under Art. 8.
Her only real commentary on the difference between personal information generally, and biological / genetic data, is at the end of her judgment, where she comments that policy makers should be considering the scope of police databases as a whole, but "particularly the DNA samples and profiles" (para 78), but, again, this suggests that she sees DNA samples as being within the general tenure of personal information, but towards the higher end, rather than deserving of particularly special or separate treatment?
(For anyone else looking to follow up on / comment on this thread, the House of Lords' decision in Marper was 2004, rather than 2008 - here.)
In terms of the crime scene scenario you posit, the same dichotomy could be made of fingerprint data and credit card data, or, indeed, using any personal data for a fraudulent transaction versus using any personal data to implicate criminality.
ReplyDeleteThe misuse of any personal data - DNA or otherwise - to frame someone is likely to constitute greater harm to that individual than "merely" stealing from them / a third party in their name. Perhaps, if anything, this should point towards greater understanding of the problems of reliance on biological forensic information, and the possibilities of incorrect conclusions being drawn, albeit a discussion clearly outside the scope of data protection law.
Like Craig, i am not an expert on US law but how is the sample of dna taken in a way that they say does not require consent from the parent/guardian? Would they not have to take blood or tissue sample ? Or do they use samples taken for other reasons ? Most people accept new born screening is essential as some severe conditions such as PKU can be treated but only if detected within days of birth.
ReplyDeleteHello Moria, I am not sure- the Act is the Newborn Screening Saves Lives Act of 2007. I am not sure if the sample is taken without consent. I meant that DNA can be extracted from any sample taken without consent. The sample is then stored on a database again without consent. I think the samples usually involve taking blood from the child's heal. I believe that 29 conditions can be tested for. However, the fact that the samples do not get destroyed and populate a DNA database with many parents/guardians being none the wiser is concerning.
ReplyDeleteI still believe that DNA data or perhaps any data held on the PNC derives a greater deal of protection. I do not just mean to keep the data safe but also to ensure that the retention of the data is justifiable and proportionate and that legislation rather than guidelines exists (see Khan v UK [2000]).
ReplyDeleteIf we look at the Information Commissioner's report on the DNA Retention Bill (see the Crime and Security Act 2010 & Protection of Freedoms Bill) we see yet again that Parliament is ignoring Data Protection Principles (particularly principles 1, 3, 5 & 6). The protection of such data (in this case data derived from a biological source) requires greater care. That is to ensure that the data is not only stored safely but that it is erased (correctly) when it is no longer justifiable to keep. The security of information goes beyond what is necessary to keep data safe you must also look at how and when it is destroyed.
Why do I think this data is more important? Well the consequences - the Human Rights Commission voiced concern relating to the re-arrest rates for Black citizens. Arguably - as the Information Commissioner indicates - the police are more likely to re-arrest those who already have records on the PNC. The Government are continuing to undermine the protection afforded by the Data Protection Principles and the rights enshrined in Article 8 ECHR. The Government intend to retain certain data for six years (those aged 16-17 and arrested but not convicted of serious crime). However, research suggests that any data retained beyond 2 years is not justifiable. How can young black men expect to live without fear of being arrested when they stand greater risk of being re-arrested due to the Government's unjustifiable data retention policies?
And for those who have a sample taken under the Terrorism Act 2000 they can expect their DNA profile to be kept until "after it has fulfilled the purpose for which it was taken or derived" (see s17(2)2 Crime and Security Act 2010).