Cross linkage of biometric and genetic databases

Introduction

Cross-linkage of biometric and genetic databases refers to the process of connecting, comparing, and analysing information stored in separate biometric and genetic information systems. Biometric databases generally contain fingerprints, facial images, iris scans, voice patterns, and other physiological or behavioural identifiers. Genetic databases contain DNA profiles, genomic sequences, hereditary information, and other biological characteristics obtained through scientific testing.

The integration of these databases is increasingly relevant to criminal investigations, forensic science, healthcare research, national identification systems, and biotechnology development. For example, law enforcement agencies may compare DNA profiles with biometric identification records to establish the identity of individuals involved in criminal investigations.

Although such integration can improve identification accuracy and support scientific investigations, it creates serious legal concerns relating to privacy, informational autonomy, discrimination, surveillance, data security, and unauthorised identification. Genetic information is particularly sensitive because it may reveal hereditary conditions, family relationships, and biological characteristics that extend beyond the individual concerned.

Cross-linkage regulation therefore seeks to establish legal limits on connecting biometric and genetic databases while ensuring that their use remains necessary, proportionate, transparent, and consistent with fundamental rights.

Legal framework governing biometric and genetic database linkage

The legal regulation of biometric and genetic databases depends on the purpose of collection, the nature of information, and the jurisdiction in which processing takes place.

The European Union's General Data Protection Regulation (GDPR) provides an important legal framework. Article 4(14) defines biometric data as personal data resulting from specific technical processing relating to physical, physiological, or behavioural characteristics that allow or confirm unique identification.

Article 9 provides special protection for biometric data processed for the purpose of uniquely identifying an individual and for genetic data. Their processing is generally prohibited unless a recognised legal exception applies.

Article 5 establishes principles of purpose limitation, data minimisation, accuracy, storage limitation, and confidentiality. Accordingly, an organisation cannot automatically connect a biometric database with a genetic database merely because both are technically accessible.

In India, the Digital Personal Data Protection Act, 2023 provides a framework for processing digital personal data. Biometric and genetic information may fall within its scope when they constitute digital personal data. The Act does not create a separate statutory category for biometric or genetic information, but its general requirements concerning lawful processing, consent, security safeguards, and accountability remain relevant.

The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 also establishes specific restrictions concerning the collection, storage, and use of Aadhaar-related identity information. Section 29 restricts the sharing and disclosure of core biometric information, while Section 30 recognises identity information, including biometric information, as sensitive personal data or information for the purposes of the Act.

Purpose limitation and restrictions on database integration

Purpose limitation is one of the most important principles governing cross-linkage.

Biometric information collected for identity verification should not automatically be connected with genetic information collected for medical research or forensic investigations.

For example, a government authority collecting fingerprints for identity verification cannot assume that those fingerprints may also be linked with genetic information for unrelated surveillance activities.

Under GDPR Article 5(1)(b), personal data must be collected for specified, explicit, and legitimate purposes. Further processing for scientific research may be permitted under applicable legal conditions and appropriate safeguards.

Database integration should therefore satisfy the following requirements:

A clearly identified and legitimate purpose.

An appropriate legal basis for processing.

Necessity and proportionality of the proposed linkage.

Appropriate consent or another recognised legal justification.

Restrictions on secondary use and onward disclosure.

Effective protection against unauthorised identification.

These restrictions are particularly important when biometric and genetic information is combined for large-scale government monitoring or commercial profiling.

Privacy and constitutional protection

The integration of biometric and genetic databases creates significant privacy risks because both categories of information can be used to identify individuals.

Genetic information has an additional dimension because it may reveal information about biological relatives who have not directly participated in the original data collection.

In India, Article 21 of the Constitution protects the right to life and personal liberty, which includes the right to privacy. Article 14 also provides protection against arbitrary state action.

The Supreme Court's decision in Justice K.S. Puttaswamy (Retd.) v. Union of India established that privacy restrictions must satisfy constitutional requirements of legality, legitimate state purpose, proportionality, and appropriate safeguards.

Consequently, large-scale integration of biometric and genetic databases must be supported by a valid legal framework and safeguards against arbitrary access or misuse.

Forensic investigation and criminal justice applications

Cross-linkage of biometric and genetic databases can support forensic identification and criminal investigations. DNA profiling may assist investigators in comparing biological evidence with legally maintained forensic records, while fingerprints and facial recognition systems may provide additional identification information.

However, the use of these technologies must respect criminal procedure, evidentiary standards, privacy rights, and statutory restrictions.

In India, the Criminal Procedure (Identification) Act, 2022 provides a statutory framework for collecting certain measurements of convicted persons and other specified categories of persons under its provisions.

The Act authorises the collection of prescribed measurements and their preservation and use according to statutory requirements. It should not, however, be interpreted as a general authorisation to combine every biometric database with every genetic database.

The Bharatiya Nagarik Suraksha Sanhita, 2023 also contains provisions concerning medical examination and the collection of specimens in specified criminal investigations.

DNA evidence must be collected, preserved, analysed, and presented according to applicable legal and evidentiary requirements. Database matching alone does not automatically establish criminal liability.

Genetic privacy and protection against discrimination

Genetic information creates special concerns because it can reveal hereditary diseases, biological relationships, and inherited characteristics.

When genetic records are linked with biometric identification systems, organisations may gain the ability to connect an individual's biological information with identity records, employment information, healthcare records, and other personal datasets.

Such integration may create risks of discrimination in employment, insurance, healthcare access, and public administration.

International human rights principles support protection against arbitrary interference with privacy and discrimination. Article 17 of the International Covenant on Civil and Political Rights protects individuals against arbitrary or unlawful interference with privacy, family, and correspondence.

The UNESCO International Declaration on Human Genetic Data, 2003, also provides important ethical principles concerning the collection, processing, storage, and use of human genetic information.

It emphasises informed consent, confidentiality, privacy, and the importance of protecting individuals and their families against discrimination.

International cooperation and cross-border database sharing

International criminal investigations and scientific collaborations sometimes require biometric and genetic information to be exchanged between countries.

However, international sharing creates jurisdictional difficulties because different countries apply different standards concerning consent, database retention, criminal investigations, and privacy protection.

The GDPR establishes international transfer requirements under Articles 44–49. Organisations transferring personal data outside the European Economic Area must satisfy the applicable transfer conditions.

The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), as modernised by Convention 108+, provides another important international framework for protecting personal information.

International cooperation should therefore include clear data-sharing arrangements, access restrictions, security safeguards, retention limits, and mechanisms for investigating unauthorised disclosure.

Important judicial decisions and case laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1

The Supreme Court of India unanimously recognised the right to privacy as a fundamental right under Article 21 of the Constitution.

The judgment established that privacy includes bodily privacy, informational privacy, individual autonomy, and protection against arbitrary interference.

Its principles are directly relevant to biometric and genetic database linkage because combining these datasets can expose highly personal information. Any state-authorised integration must satisfy legality, legitimate purpose, proportionality, and procedural safeguards.

2. K.S. Puttaswamy v. Union of India, (2019) 1 SCC 1

In the Aadhaar judgment, the Supreme Court examined the constitutional validity of the Aadhaar framework and its associated biometric identification system.

The Court upheld Aadhaar's constitutional validity subject to important limitations and restrictions on the use and disclosure of identity information.

The judgment is particularly relevant to biometric database governance because it demonstrates that large-scale biometric identification systems require statutory safeguards and cannot be used without appropriate legal restrictions.

It also reinforces the importance of limiting the use of biometric information to legally authorised purposes.

3. S. and Marper v. United Kingdom, Applications Nos. 30562/04 and 30566/04 (ECtHR, 2008)

The European Court of Human Rights examined the retention of fingerprints, cellular samples, and DNA profiles of individuals who had not been convicted of criminal offences.

The Court held that the indiscriminate and indefinite retention of such information violated Article 8 of the European Convention on Human Rights.

The judgment is highly relevant to cross-linkage because it recognises the sensitive nature of biometric and genetic information and the need for proportionate retention policies.

It supports restrictions against unrestricted storage and integration of forensic databases.

4. Gaughran v. United Kingdom, Application No. 45245/15 (ECtHR, 2020)

The European Court of Human Rights examined the retention of a convicted individual's DNA profile, fingerprints, and photograph.

The Court found a violation of Article 8 because the retention regime lacked sufficient safeguards and did not provide an adequate proportionality assessment.

The decision demonstrates that even where information has been lawfully collected during criminal proceedings, its continued retention must satisfy privacy and proportionality requirements.

This principle is relevant when institutions consider maintaining interconnected biometric and genetic databases for extended periods.

5. Aykut v. Turkey, Application No. 40565/17 (ECtHR, 2021)

The European Court of Human Rights examined issues involving the collection and retention of personal identification information in criminal proceedings.

The case illustrates the importance of examining the legal basis and safeguards governing state retention and processing of personal information.

Its relevance to biometric and genetic database integration lies in the broader requirement that criminal justice authorities must exercise their data-processing powers consistently with privacy protections.

6. District Registrar and Collector, Hyderabad v. Canara Bank, (2005) 1 SCC 496

The Supreme Court of India examined the protection of privacy and confidentiality in private documents and financial records.

The judgment recognised that unauthorised access to confidential personal information raises important privacy concerns.

Although it did not directly concern biometric or genetic databases, its principles are relevant to institutional access restrictions and confidentiality obligations governing interconnected identification systems.

Regulatory responsibilities of database administrators

Government authorities, forensic laboratories, hospitals, research institutions, and private technology providers must establish effective compliance systems before linking biometric and genetic information.

Their principal responsibilities include:

Legal authorisation: Ensure that database integration is supported by applicable legislation or another valid legal basis.

Purpose specification: Clearly define the objective of linking biometric and genetic records.

Consent and safeguards: Obtain valid consent where required and comply with applicable exceptions.

Access control: Restrict database access to authorised personnel.

Data security: Apply encryption, authentication, and secure storage systems.

Retention limitation: Establish appropriate periods for storing biometric and genetic information.

Audit mechanisms: Maintain records of database searches, transfers, and access activities.

Independent oversight: Provide mechanisms for reviewing misuse and unlawful disclosure.

Cross-border compliance: Ensure that international transfers satisfy applicable privacy and data protection laws.

Failure to comply with these obligations may result in regulatory penalties, constitutional challenges, civil liability, and criminal consequences where applicable.

Challenges in regulating cross-linkage

Cross-linkage of biometric and genetic databases presents several regulatory and technological challenges.

First, different jurisdictions apply different legal standards to biometric identification and genetic information. This creates difficulties when information is shared internationally.

Second, advances in artificial intelligence and computational genomics make it increasingly possible to identify individuals through combinations of information that may initially appear anonymous.

Third, unclear institutional responsibilities can make it difficult to determine who is legally responsible when linked information is disclosed or misused.

Other significant challenges include:

Unauthorised government or commercial surveillance.

Re-identification of individuals through combined datasets.

Discrimination based on genetic characteristics.

Excessive retention of forensic information.

Inadequate transparency in automated identification.

Unauthorised access by third-party technology providers.

Limited international coordination concerning genetic privacy.

Effective regulation requires independent supervision, clear statutory limits, technical security standards, and enforceable accountability mechanisms.

Conclusion

Cross-linkage of biometric and genetic databases represents an important development in forensic science, healthcare, biotechnology, and digital identification. However, combining these information systems creates serious concerns involving informational privacy, genetic confidentiality, discrimination, surveillance, and individual autonomy. International frameworks such as the GDPR, Convention 108+, and UNESCO International Declaration on Human Genetic Data provide important regulatory principles, while India's constitutional privacy framework and Aadhaar legislation establish domestic safeguards. Judicial decisions including Puttaswamy, S. and Marper, and Gaughran demonstrate that the collection, retention, and integration of sensitive identification information must satisfy legality, necessity, proportionality, and appropriate safeguards. Ultimately, cross-linkage should be permitted only for clearly justified purposes under transparent legal authority, effective institutional supervision, and strong individual privacy protections.