1. Introduction

Cross-border ancestry database regulation concerns the legal rules governing the collection, storage, processing, transfer, sharing and commercial use of genetic information obtained through ancestry and genealogical DNA testing services operating across national borders.

Companies offering direct-to-consumer DNA testing allow individuals to submit saliva, blood or cheek-swab samples to discover:

Geographical and ethnic ancestry.

Biological relationships and unknown relatives.

Genetic family histories.

Migration patterns and ancestral origins.

Hereditary genetic characteristics.

Potential biological connections with individuals living in other countries.

These databases create complex legal problems because genetic information is not ordinary personal information. It can reveal information about the individual who provided the sample as well as their biological relatives, including relatives who never consented to testing.

For example, an Indian citizen may submit a DNA sample to a US-based ancestry company. The company may store the genetic profile in the United States, use a laboratory in another country, and disclose matching information to relatives in Europe or Australia.

This arrangement raises questions of privacy, informed consent, international data transfers, genetic discrimination, law-enforcement access, data ownership, cybersecurity and jurisdiction.

Central legal issue: How can governments regulate genetic ancestry databases when the individuals, biological samples, companies, laboratories, servers and relatives involved are situated in different countries?

2. Nature and Scope of Cross-Border Ancestry Databases

Cross-border ancestry databases generally involve five interconnected activities.

Genetic collection: Obtaining DNA samples from consumers.

Genetic analysis: Extracting genetic markers and generating ancestry reports.

International storage: Maintaining DNA profiles and associated personal information in foreign jurisdictions.

Database matching: Comparing genetic profiles with information belonging to other users.

International disclosure: Sharing results with relatives, researchers, commercial partners or law-enforcement authorities.

Ancestry.com cuts workforce, cites ‘marketplace realities’ – Deseret News

Genetic Affairs

Whole Genome Sequencing - MyHeritage Wiki

8

The regulatory challenge is that a single DNA profile may simultaneously be:

Personal data.

Sensitive genetic information.

A source of familial information.

Scientific research material.

Potential forensic evidence.

A commercially valuable dataset.

Consequently, ancestry database regulation requires coordination between privacy law, biotechnology law, consumer protection, intellectual property, criminal procedure and international data-transfer rules.

3. International Legal Framework

A. European Union: GDPR

The General Data Protection Regulation (GDPR) provides one of the most significant legal frameworks for regulating cross-border genetic information.

Genetic data receives special protection under Article 9 because it constitutes sensitive personal data.

Important provisions include:

Article 9: Special-category genetic information

Processing genetic data is generally prohibited unless a specified exception applies, such as explicit consent or another applicable legal basis.

A DNA ancestry company cannot assume that consent to receive an ancestry report automatically authorises:

Medical research.

Pharmaceutical research.

Commercial genetic profiling.

Law-enforcement searches.

Transfer to unrelated foreign companies.

Each additional purpose must have its own legal justification.

Articles 44–49: International transfers

A company transferring genetic information outside the European Economic Area must satisfy the GDPR's international-transfer requirements.

Relevant mechanisms include:

Adequacy decisions under Article 45.

Appropriate safeguards, including standard contractual clauses under Article 46.

Specific derogations under Article 49, where applicable.

The European Court of Justice's Schrems II judgment is particularly important because contractual safeguards alone may not resolve risks arising from foreign government surveillance.

B. United States: Genetic Privacy and Consumer Protection

The United States follows a fragmented regulatory approach.

Important legislation includes:

Genetic Information Nondiscrimination Act 2008 (GINA).

Health Insurance Portability and Accountability Act (HIPAA).

Federal Trade Commission Act.

State genetic privacy laws.

State consumer privacy legislation.

State biometric and genetic information laws.

GINA 2008

GINA restricts genetic discrimination in health insurance and employment.

However, it does not provide comprehensive protection against every possible use of ancestry information.

For example, GINA does not generally cover life insurance, disability insurance and long-term-care insurance in the same manner as health insurance and employment.

HIPAA

HIPAA applies to covered entities and business associates, rather than automatically applying to every commercial ancestry-testing company.

A direct-to-consumer genealogy platform may therefore fall outside HIPAA when operating independently of a regulated healthcare relationship.

This distinction creates a regulatory gap between commercial ancestry databases and clinical genetic databases.

C. Australia: Privacy Act 1988

Australia regulates genetic information through the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Genetic information is treated as sensitive information.

Important requirements include:

Appropriate consent for collection and use.

Restrictions on secondary use and disclosure.

Reasonable security safeguards.

Access and correction rights.

Regulation of overseas disclosures.

Australian Privacy Principle 8

APP 8 regulates cross-border disclosure.

Before disclosing personal information to an overseas recipient, an Australian entity generally must take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles.

Section 16C can make the Australian entity accountable for certain overseas recipient conduct.

OAIC+2

This is particularly relevant where an Australian ancestry company transfers genetic profiles to overseas laboratories or database operators.

D. India: Digital Personal Data Protection Act 2023

India's Digital Personal Data Protection Act 2023 provides a general framework for digital personal data processing.

Its important provisions include:

Section 16 empowers the Central Government to restrict transfers of personal data to notified countries or territories.

An important distinction is that the Act does not create a separate, comprehensive genetic-data category equivalent to the GDPR's special-category regime. Genetic information must nevertheless be assessed within the Act's general personal-data protections.

The earlier SPDI Rules under the Information Technology Act framework also matter when analysing the historical regulation of genetic information, particularly where information qualifies as sensitive personal data or information.

India Code+2

For an Indian consumer using a foreign ancestry platform, additional questions include whether the foreign platform is subject to Indian law, what information it collects, where it stores the genetic information, and whether any foreign disclosure is authorised.

4. Major Legal Issues

4.1 Informed Consent and Genetic Autonomy

Informed consent is a foundational requirement of ancestry database regulation.

Consent must be meaningful, voluntary, specific and sufficiently informed.

A consumer may agree to DNA testing for ancestry identification without agreeing to:

Permanent storage of genetic material.

Research involving unrelated diseases.

Pharmaceutical development.

Commercial licensing of genetic information.

Law-enforcement access.

International sharing with third-party databases.

The legal difficulty is that ancestry databases frequently contain information about individuals other than the person who submitted the sample.

Example: A person uploads DNA information and discovers a biological sibling who never consented to genetic testing. The database may reveal information about that sibling's parentage, family relationships or previously unknown biological connections.

This raises questions concerning collective genetic privacy and the limits of individual consent.

4.2 Familial Privacy and Third-Party Genetic Information

DNA is inherently relational.

An individual's genetic profile may reveal information about:

Parents.

Children.

Siblings.

Half-siblings.

Cousins.

Previously unknown biological relatives.

Consequently, one individual's consent cannot necessarily be treated as unlimited consent to expose the genetic information of every biological relative.

Regulation should distinguish between:

The individual's own genetic information.

Information inferred about relatives.

Identifiable relationship matches.

Information belonging to deceased relatives.

Information about minors.

4.3 International Data Transfers

Cross-border ancestry services frequently use different countries for sample processing, database storage and customer support.

The legal questions include:

Which country's privacy law applies?

Is the transfer a disclosure or merely processing by a contractor?

Does the recipient provide equivalent safeguards?

Can foreign authorities compel access?

Can an individual enforce their rights abroad?

Who is responsible for a foreign data breach?

A contractual agreement between companies does not automatically resolve conflicting national surveillance, disclosure or retention requirements.

4.4 Law-Enforcement Access

One of the most controversial aspects of ancestry database regulation concerns forensic genetic genealogy.

Investigators may compare DNA recovered from crime scenes with genetic information held in commercial ancestry databases.

This may identify a suspect through a relative who voluntarily uploaded genetic information.

The resulting legal conflict concerns:

Consent.

Search warrants.

Reasonable expectations of privacy.

Criminal investigation powers.

Familial privacy.

Evidentiary reliability.

4.5 Genetic Discrimination

Genetic ancestry information may reveal characteristics that could be misused in:

Employment decisions.

Insurance underwriting.

Immigration screening.

Financial risk assessment.

Social profiling.

Commercial targeted advertising.

The law must distinguish legitimate ancestry research from discriminatory genetic profiling.

4.6 Database Security and Cybersecurity

Genetic data cannot be changed in the same manner as a password following a data breach.

A compromised DNA profile may remain useful for identification and familial inference for decades.

Therefore, ancestry database operators should adopt:

Encryption at rest and in transit.

Strict access controls.

Pseudonymisation.

Multi-factor authentication.

Audit logs.

Data retention limitations.

Independent cybersecurity assessments.

International incident-response procedures.

4.7 Data Deletion and Genetic Material Destruction

An individual may request deletion of an ancestry profile.

However, deletion of a user account does not necessarily establish that every copy of the underlying genetic information has been destroyed.

A complete deletion policy should distinguish:

Account information.

Raw genetic sequence data.

Derived ancestry profiles.

Research datasets.

Backup copies.

Information already shared with third parties.

Physical saliva or biological samples.

This distinction is essential when assessing whether a company has genuinely complied with a deletion request.

5. Important Case Laws and Judicial Principles

The following decisions are particularly relevant. Some concern forensic DNA databases or general data transfers rather than commercial ancestry databases directly. Their principles are nevertheless important when courts assess ancestry database practices.

Case 1. S. and Marper v. United Kingdom (2008), Application Nos. 30562/04 and 30566/04

Leading DNA privacy authority

Court: European Court of Human Rights.

Facts:

Two individuals had their fingerprints and DNA samples collected following criminal arrests. One was acquitted, while proceedings against the other were discontinued.

Despite their requests, the authorities retained their DNA information.

Legal issue:

Whether indefinite retention of DNA samples and profiles belonging to individuals who had not been convicted violated Article 8 of the European Convention on Human Rights.

Judgment:

The Grand Chamber found a violation of Article 8, which protects private and family life.

The Court considered the indiscriminate and indefinite retention of DNA information disproportionate.

Principles established:

Genetic information deserves strong privacy protection.

Retention of DNA must have a legitimate legal basis.

Indefinite retention requires particularly strong justification.

The status of an individual who has not been convicted must be considered.

Familial searching can reveal sensitive information about previously unknown biological relationships.

Relevance to ancestry databases:

This decision provides a strong foundation for challenging disproportionate retention of genetic information.

A commercial ancestry company should not assume that an individual's initial consent authorises permanent retention or unlimited secondary use.

The European Convention on Human Rights+2

Case 2. Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Schrems II) (2020), Case C-311/18

Court: Court of Justice of the European Union.

Facts:

Maximillian Schrems challenged the transfer of personal information from the European Union to the United States, raising concerns about access by US intelligence authorities.

Legal issue:

Whether international personal-data transfers could continue using standard contractual clauses when the destination country's surveillance laws might undermine effective privacy protection.

Judgment:

The Court invalidated the EU-US Privacy Shield adequacy decision but upheld the validity of standard contractual clauses, subject to effective assessment of the protection available in the destination country.

Principles established:

International transfers must maintain an essentially equivalent level of protection.

Contractual safeguards must be assessed in practice.

Foreign government surveillance laws are relevant.

Data exporters and supervisory authorities must assess whether safeguards are effective.

Additional technical and organisational measures may be necessary.

Relevance to ancestry databases:

Suppose a European ancestry platform transfers millions of genetic profiles to a foreign cloud-storage provider.

A contractual promise of confidentiality may not be sufficient if the destination country's legal framework permits government access inconsistent with the required protection.

The company must assess the actual risks of the transfer.

EUR-Lex+2

Case 3. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), (2017) 10 SCC 1

Leading Indian constitutional authority

Court: Supreme Court of India, nine-judge Constitution Bench.

Facts:

The litigation concerned whether privacy was a constitutionally protected fundamental right in India.

Legal issue:

Whether privacy is protected under the Indian Constitution, particularly Article 21.

Judgment:

The Supreme Court unanimously recognised privacy as a fundamental right.

The judgment recognised informational privacy as an important component of the right to privacy.

It also explained that restrictions on privacy must satisfy:

Legality.

Legitimate state necessity.

Proportionality.

Relevance to ancestry databases:

Genetic ancestry information concerns an individual's identity, bodily integrity, family relationships and personal autonomy.

Under the reasoning of Puttaswamy, state-mandated collection or disclosure of genetic information must satisfy constitutional requirements.

The judgment is also important when evaluating government demands for access to private ancestry databases.

Important qualification: The judgment does not establish a specific statutory right to genetic-data ownership or directly decide the legality of commercial ancestry databases. Its constitutional privacy principles provide the foundation for analysing those questions.

Indian Kanoon+1

Case 4. Maryland v. King (2013), 569 U.S. 435

Court: Supreme Court of the United States.

Facts:

Maryland authorities collected a DNA sample through a cheek swab from an individual arrested for a serious offence.

The DNA profile was matched against an existing forensic database and connected him to an earlier crime.

Legal issue:

Whether DNA collection from certain individuals arrested for serious offences violated the Fourth Amendment prohibition against unreasonable searches.

Judgment:

The Supreme Court upheld the relevant DNA collection procedure as a reasonable booking procedure under the circumstances.

Principles established:

DNA collection constitutes a search.

The purpose and circumstances of collection matter.

Identification interests can justify appropriately regulated DNA collection.

The privacy intrusion must be assessed against legitimate governmental interests.

Relevance to ancestry databases:

The decision illustrates the difference between DNA collected by the state under criminal procedure and DNA voluntarily submitted to a commercial ancestry database.

It does not give private ancestry companies general authority to disclose consumer genetic information to law-enforcement authorities.

LII / Legal Information Institute

Case 5. Association for Molecular Pathology v. Myriad Genetics, Inc. (2013), 569 U.S. 576

Court: Supreme Court of the United States.

Facts:

Myriad Genetics claimed patent rights over isolated DNA sequences associated with the BRCA1 and BRCA2 genes.

Legal issue:

Whether naturally occurring human DNA becomes patent-eligible merely because it has been isolated.

Judgment:

The Court held that naturally occurring DNA is not patent-eligible merely because it has been isolated. Synthetically created cDNA may be patent-eligible, subject to the applicable patent requirements.

Relevance to ancestry databases:

The case helps distinguish between:

Naturally occurring genetic information.

Laboratory-created genetic materials.

Genetic analysis methods.

Database compilation and organisation.

Patentable technological inventions.

It does not establish ownership rights over consumer DNA profiles or settle whether an ancestry database may commercially exploit uploaded genetic information.

LII / Legal Information Institute

6. Forensic Genetic Genealogy: The Golden State Killer Example

Golden State Killer and Genetic Genealogy | ForensicSpot

forensicspot.com

The identification of the Golden State Killer in 2018 is a significant practical example of the regulatory challenges involving commercial genealogy databases.

Investigators used forensic genetic genealogy, comparing crime-scene DNA with information available through GEDmatch.

The approach enabled investigators to identify possible relatives and develop investigative leads.

The case demonstrated that a person who has never submitted DNA to a commercial ancestry service may nevertheless become identifiable through the genetic information submitted by relatives.

Legal significance:

Genetic privacy extends beyond the person who uploads DNA.

Database terms of service can become relevant to criminal investigations.

Law-enforcement access raises questions of consent and proportionality.

Commercial databases can become sources of forensic intelligence.

Familial genetic searching requires appropriate legal safeguards.

The Golden State Killer investigation is an investigative example, not itself a binding judicial precedent establishing a general right of police access.

The Federal Judicial Center's discussion of commercial genetic databases identifies the resulting legal and privacy concerns.

Federal Judicial Center+2

7. Jurisdictional Conflicts and Applicable Law

A major difficulty arises when several countries claim regulatory authority over the same ancestry database.

Consider this hypothetical situation:

Customer: Indian resident.

Company headquarters: United States.

Laboratory: Australia.

Cloud storage: European Union.

Biological relative: United Kingdom.

Law-enforcement request: Another foreign jurisdiction.

The following legal questions arise:

The jurisdictional challenges

A. Extraterritorial application

A company may be subject to the laws of countries in which it offers services or monitors individuals, even when its headquarters are elsewhere.

B. Conflicting retention requirements

One jurisdiction may require deletion, while another may impose a preservation obligation under a valid legal order.

C. Conflicting disclosure obligations

A foreign government may compel disclosure, while the originating jurisdiction imposes restrictions on international disclosure.

D. Enforcement difficulties

An individual may win a privacy complaint in one country but face difficulties obtaining practical remedies against a company or laboratory located abroad.

E. Forum and applicable law

Contractual terms selecting a foreign court cannot automatically eliminate mandatory privacy rights or constitutional protections applicable in another jurisdiction.

8. Liability of Ancestry Database Operators

Database operators may face different forms of liability.

Important corporate responsibilities

An ancestry database operator should:

Obtain informed consent.

Clearly identify overseas processing locations.

Explain law-enforcement disclosure policies.

Maintain appropriate security controls.

Provide access, correction and deletion mechanisms.

Establish contractual safeguards with foreign processors.

Prevent unauthorised secondary use.

Maintain a record of disclosures.

Notify individuals and regulators where legally required.

Establish a process for responding to foreign government requests.

9. Regulatory Accountability and Governance Doctrine

Cross-border ancestry database regulation can be understood through six major governance doctrines.

9.1 Genetic Autonomy Doctrine

Individuals should have meaningful control over the collection, use and disclosure of their genetic information.

Consent to ancestry analysis should not automatically become consent to unrelated research or commercial exploitation.

9.2 Familial Privacy Doctrine

Genetic information is relational rather than exclusively individual.

Regulators should consider the privacy interests of biological relatives who may be identified through genetic matching.

9.3 Purpose Limitation Doctrine

Ancestry data collected for genealogical purposes should not automatically be repurposed for medical research, pharmaceutical development, commercial profiling or criminal investigations.

9.4 Cross-Border Accountability Doctrine

A company should not escape responsibility simply because it transfers genetic information to a foreign subsidiary, contractor or cloud provider.

The GDPR and Australian APP 8 framework provide important examples of accountability mechanisms.

9.5 Data Minimisation and Retention Doctrine

Companies should collect only information necessary for clearly identified purposes and retain it only for an appropriate period.

9.6 Genetic Non-Discrimination Doctrine

Genetic information should not be misused to discriminate against individuals in employment, insurance, education or other important areas of social and economic life.

10. Regulatory Challenges and Emerging Issues

Special issue: Database mergers and corporate acquisitions

Suppose an American ancestry company acquires an Australian genealogy company.

The acquiring company may obtain millions of genetic profiles collected under different privacy notices and consent arrangements.

The legal questions include:

Can historical genetic information be transferred to the acquiring company?

Does the original consent cover the new corporate owner?

Can the acquiring company introduce new research purposes?

Must customers be notified?

Can customers withdraw their consent?

What happens to samples when the acquired company is dissolved?

A corporate acquisition should not automatically be treated as permission for unrestricted secondary use of genetic information.

11. Suggested International Regulatory Model

A coordinated international regulatory system should include the following elements.

Proposed cross-border ancestry database governance framework

1. Individual genetic rights

Informed consent, access, correction, withdrawal and deletion rights

2. Database operator obligations

Security, purpose limitation, retention and transparency

3. International transfer safeguards

Destination-country assessment, contractual protection and audit rights

4. Independent regulatory supervision

Audits, investigations, complaints and penalties

5. International cooperation and remedies

Mutual assistance, cross-border enforcement and effective compensation

Recommended reforms

1. International genetic-data transfer certification

Ancestry database operators should demonstrate that overseas recipients maintain appropriate genetic-data protection standards.

2. Separate consent categories

Separate permissions should be provided for ancestry matching, medical research, commercial research and law-enforcement access.

3. Familial privacy safeguards

Companies should provide appropriate protections against exposing identifiable information about non-consenting relatives.

4. Mandatory transparency reports

Companies should publish information about government requests, international transfers, data breaches and third-party disclosures.

5. Independent audits

High-risk ancestry database operators should undergo regular independent privacy and cybersecurity assessments.

6. International complaint mechanisms

Individuals should have practical avenues to challenge misuse of genetic information even when the database operator is located abroad.

12. Conclusion

Cross-border ancestry database regulation represents an important intersection of biotechnology law, international data-protection law, constitutional privacy, consumer protection and criminal justice.

The central problem is that genetic information is simultaneously personal, familial, identifiable and commercially valuable. Its international transfer creates risks that cannot be adequately addressed through ordinary contractual privacy notices.

The judicial principles emerging from S. and Marper, Schrems II, Puttaswamy, Maryland v. King and Myriad Genetics provide important foundations for regulating genetic information, retention, international transfers, government access and the legal status of biological material.

However, no single judgment comprehensively determines the regulation of commercial cross-border ancestry databases.

A coherent regulatory framework must balance scientific research, individual genetic autonomy, familial privacy, legitimate criminal investigations and international commercial activity.

The ultimate legal principle is that international accessibility of genetic information should not mean unrestricted international authority over that information.

13. Important Legislation and Authorities for Academic Research

Primary judicial authorities:

S. and Marper v United Kingdom (2008), ECHR.

Data Protection Commissioner v Facebook Ireland Ltd and Schrems, C-311/18 (2020).

Justice K.S. Puttaswamy v Union of India (2017) 10 SCC 1.

Maryland v King, 569 U.S. 435 (2013).

Association for Molecular Pathology v Myriad Genetics, 569 U.S. 576 (2013).

Research qualification: These authorities establish related legal principles, not a uniform international ancestry-database code. Their application depends on the jurisdiction, type of genetic information, identity of the data controller and purpose of processing.

For a deeper legal dissertation, the most useful comparative approach is to examine India, Australia, the European Union and the United States together, particularly their differing approaches to genetic privacy, international data transfers and familial DNA searches.