1. Introduction

The Right to Deletion of Biological Data is an emerging dimension of the right to privacy, bodily autonomy, informational self-determination and personal data protection. It concerns an individual's ability to request the deletion, destruction or permanent removal of biological information collected, stored, processed or shared by government authorities, hospitals, biotechnology companies, laboratories, research institutions and private organisations.

Biological data includes:

Genetic information obtained through DNA testing.

Fingerprints, biological identification and biometric records.

Blood, saliva, tissue and other biological sample records.

Genomic sequencing and hereditary information.

Reproductive and embryonic data.

Neural and physiological information.

Microbiome and molecular profiles.

Digitised biological information used in artificial intelligence.

The right becomes particularly important when biological information is collected without valid consent, retained after its original purpose has ended, used for unrelated research, transferred to third parties or maintained despite an individual's request for deletion.

The central legal question is:

Can an individual demand that their biological samples and associated digital biological information be permanently erased once the purpose for collecting them has been fulfilled?

The answer depends on the applicable privacy legislation, consent arrangements, public-interest requirements, criminal investigation laws and legitimate scientific research obligations.

It is important to distinguish between deletion of a biological sample and deletion of the digital information derived from it. Destroying a blood sample, for example, does not automatically erase the DNA sequence already generated and stored in a laboratory database.

2. Meaning and Scope of Biological Data Deletion

The right has two interconnected dimensions.

A. Right to delete biological samples

This concerns physical biological materials collected from an individual, including:

Blood samples collected for genetic testing.

Saliva samples used for DNA identification.

Tissue samples collected during medical procedures.

Embryonic and reproductive biological materials.

Hair, skin and other cellular samples.

Biological specimens stored in research laboratories.

An individual may seek destruction of these materials when the collection purpose has ended, consent has been withdrawn or continued retention lacks a lawful justification.

B. Right to delete digitally stored biological information

This concerns electronic information generated from biological samples, including:

DNA sequencing records.

Genetic databases.

Digital medical records.

Biometric identification databases.

Genomic research datasets.

AI-generated genetic predictions.

Biological identity profiles.

This dimension is particularly significant because digital genetic information can be copied, transferred, analysed and reused without retaining the original biological specimen.

C. Right to deletion of derived information

The issue becomes more complicated when a biotechnology organisation creates additional information from an individual's DNA.

For example, a genetic testing company may generate:

Disease susceptibility predictions.

Ancestry classifications.

Hereditary risk assessments.

Genetic relationship profiles.

AI-generated biological identity scores.

The right to deletion should address identifiable derived information as well as the original data, subject to lawful retention exceptions.

3. Constitutional Foundations in India

The Indian constitutional framework provides an important foundation for protecting biological information.

Article 21 – Right to Life and Personal Liberty

Article 21 protects personal liberty and privacy. Biological information is closely connected with an individual's identity, bodily autonomy, family relationships and personal medical information.

Article 14 – Equality Before Law

The State must avoid arbitrary or discriminatory retention and use of biological information.

Article 19(1)(a) – Freedom of Expression

Privacy and informational autonomy may also intersect with freedom of expression, particularly where genetic information is disclosed or published without justification.

The Puttaswamy privacy framework

In Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, the Supreme Court recognised privacy as a fundamental right under the Constitution.

The judgment established important principles concerning:

Informational privacy.

Personal autonomy.

Individual control over personal information.

Protection against arbitrary State interference.

Proportionality of privacy restrictions.

The judgment is particularly relevant to genetic data because biological information may reveal intimate details about an individual and their relatives.

Accordingly, a biological database cannot be maintained or accessed by public authorities without an appropriate legal justification.

Important qualification: Puttaswamy established the constitutional foundation of privacy; it did not expressly create an unrestricted, standalone right to destroy every biological sample or genetic record.

4. Statutory Framework in India

A. Digital Personal Data Protection Act, 2023

The most relevant provision is Section 12 – Right to Correction and Erasure of Personal Data.

Section 12 provides that:

Individuals have rights concerning correction, completion, updating and erasure of their personal data.

Individuals may request erasure of personal data.

The data fiduciary must erase the information unless retention is necessary for the specified purpose or compliance with applicable law.

Section 8(7) also imposes obligations concerning erasure when consent is withdrawn or the specified purpose is no longer being served, subject to legal retention requirements.

These provisions are relevant to digitally stored genetic information when it qualifies as personal data and falls within the Act's application.

India Code+1

Important limitation: The Act does not establish a separate, unconditional deletion right specifically for biological samples. Its application to physical specimens, non-digital materials and particular research records requires careful examination of statutory definitions and scope.

B. Information Technology Act, 2000

Section 43A historically provided a framework for compensation for failure by a body corporate to protect sensitive personal data or information.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 also regulated certain categories of sensitive personal information.

These provisions are relevant to historical data-protection obligations, but should not be treated as a substitute for the current statutory framework.

C. Criminal Procedure and Identification Legislation

The Criminal Procedure (Identification) Act, 2022 provides a legal framework for collecting and retaining specified measurements of persons for identification and criminal investigation purposes.

Its application to biological measurements raises questions concerning:

Necessity of collection.

Duration of retention.

Access to stored information.

Security of biological records.

Retention after acquittal or discharge.

Destruction of records under applicable statutory rules.

The individual's deletion request must be assessed against the specific statutory authority for collection and retention.

5. Important Case Laws

The following judgments establish significant principles concerning the privacy, retention, deletion and proportionality of biological and genetic information.

Case 1. S. and Marper v. United Kingdom (2008)

European Court of Human Rights · Applications Nos. 30562/04 and 30566/04 · Grand Chamber

Facts:

The applicants had been arrested in separate criminal proceedings. One was acquitted, while the proceedings against the other were discontinued.

Despite the absence of convictions, the British authorities retained their fingerprints, DNA profiles and cellular samples.

The applicants challenged the continued retention under Article 8 of the European Convention on Human Rights.

Legal issue:

Could authorities indefinitely retain DNA samples and profiles belonging to individuals who had not been convicted?

Judgment:

The European Court of Human Rights found a violation of Article 8.

The Court recognised that:

Retention of cellular samples interferes with privacy.

DNA profiles contain sensitive personal information.

Genetic information can reveal family relationships and other personal characteristics.

Indefinite retention without sufficient safeguards is disproportionate.

The Court distinguished between physical cellular samples and DNA profiles, recognising the particularly intrusive nature of retaining biological samples.

Legal principle:

The State cannot justify indiscriminate and indefinite retention of biological information merely by relying on the general objective of preventing crime.

Relevance to the right to deletion:

This is one of the most important judgments supporting the right to deletion of biological data. It establishes that the continued storage of DNA information requires a proportionate legal justification and appropriate safeguards.

Bailii+1

Case 2. Justice K.S. Puttaswamy v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1

Facts:

The case concerned the constitutional status of privacy in India, particularly in the context of State collection and use of personal information.

Legal issue:

Whether privacy is a fundamental right protected by the Indian Constitution.

Judgment:

The nine-judge Constitution Bench unanimously recognised privacy as a fundamental right.

The Court identified privacy as encompassing personal autonomy, bodily integrity and informational privacy.

Legal principle:

Any State interference with privacy must satisfy:

Legality – the existence of a valid law.

Legitimate aim – a proper governmental objective.

Proportionality – a reasonable relationship between the objective and the interference.

Relevance:

These principles provide a constitutional basis for challenging unjustified retention of genetic databases, biological identity records and personal genomic information.

Indian Kanoon+1

Case 3. Selvi v. State of Karnataka (2010)

Supreme Court of India · (2010) 7 SCC 263

Facts:

The case concerned the involuntary administration of narcoanalysis, polygraph examinations and brain electrical activation profile tests on individuals accused or suspected of criminal offences.

Legal issue:

Could investigative authorities forcibly subject individuals to scientific techniques that intrude into their mental privacy and personal autonomy?

Judgment:

The Supreme Court held that involuntary administration of these techniques violated constitutional protections under Articles 20(3) and 21.

Legal principle:

Scientific investigative techniques cannot be used in a manner that disregards individual autonomy and constitutional safeguards.

Relevance:

Although this case did not directly concern deletion of DNA records, it supports the broader proposition that biological and neurological information cannot be collected or processed without respecting constitutional rights.

It is particularly relevant to emerging technologies involving neural data, genetic profiling and compulsory biological testing.

Case 4. Bhabani Prasad Jena v. Convenor Secretary, Orissa State Commission for Women (2010)

Supreme Court of India · (2010) 8 SCC 633

Facts:

The case involved a request for DNA testing in a matrimonial dispute concerning disputed parentage.

Legal issue:

Whether courts should routinely order DNA testing to determine biological relationships.

Judgment:

The Supreme Court explained that DNA testing should not be ordered routinely. Courts must consider the necessity of testing, the interests of the parties and the consequences for privacy.

Relevance:

The judgment is important because genetic information does not concern only the individual tested. It may reveal information about children, parents and other biological relatives.

Consequently, deletion requests should consider the privacy interests of other persons whose information may be embedded in the same genetic record.

Case 5. Dipanwita Roy v. Ronobroto Roy (2015)

Supreme Court of India · (2015) 1 SCC 365

Facts:

The dispute concerned an allegation of adultery and the possibility of DNA testing to determine biological parentage.

Judgment:

The Supreme Court considered DNA testing in the context of matrimonial proceedings and explained the evidentiary consequences of refusing a properly directed test.

Relevance:

The case demonstrates the tension between genetic privacy and the legitimate requirements of judicial proceedings.

It is relevant when determining whether genetic information must be retained for litigation or whether deletion can be requested after the relevant proceedings have concluded.

Limitation: Neither Bhabani Prasad Jena nor Dipanwita Roy directly establishes a right to destroy DNA samples.

Case 6. NG v. Direktor na Glavna direktsia „Natsionalna politsia“ (2024)

Court of Justice of the European Union · Case C-118/22 · ECLI:EU:C:2024:97

Facts:

A Bulgarian citizen challenged the continued retention of his biometric and genetic information in police databases after being convicted of an intentional criminal offence and subsequently rehabilitated.

The national legal framework permitted retention until the individual's death.

Legal issue:

Could police authorities retain genetic and biometric information indefinitely without reviewing whether continued storage remained necessary?

Judgment:

The CJEU ruled that general and indiscriminate retention of biometric and genetic data until death was contrary to EU law.

Authorities must provide appropriate mechanisms for periodic review of whether retention remains necessary.

Individuals must have the possibility of obtaining erasure when the continued retention is no longer justified.

Legal principle:

Even where genetic information was lawfully collected for criminal investigation, continued retention must remain necessary, proportionate and subject to appropriate safeguards.

Relevance:

This judgment is especially important because it confirms that even convicted individuals cannot automatically be subjected to unlimited retention of genetic and biometric information.

Case 7. Gaughran v. United Kingdom (2020)

European Court of Human Rights · Application No. 45245/15 · Judgment of 13 February 2020

Facts:

The applicant had been convicted of a minor road-traffic offence. Authorities retained his fingerprints, photograph and DNA profile without an appropriate time limit.

Legal issue:

Was indefinite retention of biometric and DNA information proportionate when the underlying offence was relatively minor?

Judgment:

The European Court of Human Rights found a violation of Article 8.

It emphasised that the retention regime lacked adequate safeguards and failed to make sufficient distinctions based on the seriousness of the offence.

Legal principle:

The seriousness of the offence, the nature of the data and the duration of retention must be considered when assessing proportionality.

Relevance:

Biological information should not be retained indefinitely merely because it was initially collected lawfully.

Case 8. Google Spain SL v. AEPD and Mario Costeja González (2014)

Court of Justice of the European Union · Case C-131/12

Facts:

Mario Costeja González requested removal of search engine links relating to historical financial proceedings that had become irrelevant to his present circumstances.

Legal issue:

Could individuals require search engines to remove certain personal information from search results?

Judgment:

The CJEU recognised that individuals could request de-referencing of personal information under specified circumstances.

Legal principle:

Personal information that is inadequate, irrelevant, no longer relevant or excessive may qualify for removal from search results, subject to balancing competing rights and public interests.

Relevance:

This case is relevant to genetic information published or indexed online.

For example, an individual may seek removal of outdated genetic test results or improperly disclosed biological identity information from search engine results.

However, de-referencing is not the same as deletion of the original genetic database or laboratory record.

EUR-Lex+1

6. International Legal Framework

A. General Data Protection Regulation (GDPR), 2016

The European Union's GDPR provides one of the clearest statutory foundations for biological data deletion.

Article 17 – Right to Erasure

An individual can request deletion of personal data where, among other circumstances:

The information is no longer necessary for its original purpose.

Consent has been withdrawn and no other lawful basis exists.

The individual has successfully objected to processing in circumstances covered by the provision.

The information has been unlawfully processed.

Erasure is required by law.

Genetic and biometric information used for unique identification can qualify as special-category personal data under Article 9.

Article 9 – Special Categories of Personal Data

Processing genetic data and biometric data for uniquely identifying an individual is generally prohibited unless a recognised legal exception applies.

Article 5 – Data Minimisation and Storage Limitation

Personal data must be adequate, relevant and limited to what is necessary. It must not be retained longer than necessary for its processing purpose, subject to applicable exceptions.

Legislation.gov.uk+1

B. UNESCO International Declaration on Human Genetic Data, 2003

The UNESCO Declaration establishes important ethical principles for collecting, processing and storing human genetic information.

Its major concerns include:

Human dignity.

Confidentiality.

Informed consent.

Protection against discrimination.

Appropriate handling of genetic samples.

Respect for the interests of individuals and families.

It provides an important international ethical foundation for developing biological data deletion policies.

C. Council of Europe Convention 108+

Convention 108 and its modernised framework address personal data protection, including sensitive data.

The framework emphasises data quality, proportionality, security and safeguards against excessive retention.

D. International Covenant on Civil and Political Rights

Article 17 protects individuals against arbitrary or unlawful interference with privacy, family and correspondence.

Unjustified retention or disclosure of highly sensitive biological information may raise concerns under this provision.

7. Circumstances in Which Biological Data Deletion Can Be Requested

8. Exceptions to the Right to Deletion

The right to deletion is not absolute. There are situations where biological data may legitimately be retained despite an individual's request.

A. Criminal investigations

Authorities may retain DNA evidence where retention is legally authorised and necessary for an ongoing investigation or prosecution.

However, retention must comply with applicable safeguards and proportionality requirements.

B. Medical treatment

Hospitals may need to preserve medical and genetic records for:

Continuing treatment.

Patient safety.

Medical history.

Clinical decision-making.

Legal and regulatory obligations.

C. Scientific research

Genetic information may be retained for legitimate scientific research where an applicable legal basis and safeguards exist.

Under the GDPR, Article 17(3)(d) provides an exception for certain scientific or historical research and statistical purposes where erasure is likely to render the research impossible or seriously impair it, subject to the applicable legal conditions and safeguards.

D. Public health protection

Biological information may need to be preserved for disease surveillance, outbreak management and public health investigations where authorised by law.

E. Judicial proceedings

Genetic samples may be retained where necessary for ongoing litigation, the preservation of evidence or the establishment, exercise or defence of legal claims.

Important distinction: Refusing complete deletion does not necessarily justify unrestricted access or continued use. Restricting processing, anonymising records or separating identifying information may be appropriate alternatives.

Information Commissioner's Office+1

9. Special Issues in Biotechnology and Genetic Research

The right to deletion creates several difficult legal questions.

A. Deletion of family-linked genetic information

DNA contains information not only about the person who provided the sample but also about biological relatives.

For example, deleting one person's genetic record may affect research involving hereditary diseases or family relationships.

The law must balance individual privacy with the legitimate interests of relatives.

B. Deletion of AI-generated genetic predictions

Biotechnology companies increasingly use AI to generate predictions from genomic information.

Suppose a company uses an individual's DNA to predict the possibility of developing a hereditary disease and stores that prediction in its commercial database.

Even if the original DNA sample is destroyed, the prediction may continue to identify the individual.

A meaningful deletion framework should therefore consider identifiable derivative information, not just the original biological material.

C. Deletion from international databases

Genetic information may be transferred between laboratories in different countries.

This creates jurisdictional difficulties:

Which country's deletion law applies?

Can a foreign research institution refuse deletion?

Who is responsible for deleting copied information?

How can an individual verify that deletion occurred?

What happens to information already shared with international research partners?

These questions become particularly significant in multinational genomic research.

D. Blockchain and immutable biological records

Some biotechnology platforms use blockchain systems to record genetic consent, research transactions and biological identities.

Because blockchain records may be difficult to alter, deletion presents a technical and legal challenge.

Possible solutions include:

Storing identifying information separately from blockchain records.

Destroying encryption keys where legally appropriate.

Removing access permissions.

Deleting identifiable off-chain records.

Preventing further processing of retained records.

However, deleting an encryption key does not necessarily amount to legal erasure if identifiable information remains recoverable.

10. Responsibilities of Biotechnology Organisations

Organisations collecting biological data should establish a formal deletion policy.

A particularly important obligation is ensuring that deletion requests reach third-party processors and organisations holding copies of the information.

11. Major Legal Challenges

The right to deletion of biological data faces several unresolved legal challenges.

1. Conflict between privacy and scientific progress

Deleting genetic information may affect long-term scientific studies and research continuity.

2. Conflict between individual rights and public safety

Police authorities may argue that retaining DNA records assists criminal investigations, while individuals may argue that indefinite retention violates privacy.

3. Lack of uniform international standards

Different jurisdictions have different rules governing biological samples, genetic information and research databases.

4. Difficulty proving permanent deletion

Individuals may find it difficult to establish whether their information has been removed from backup systems, cloud servers and research databases.

5. Biological information and family privacy

A single genetic record can reveal sensitive information about several members of a family.

6. Artificial intelligence and derivative information

Deleting the original dataset may not eliminate all information previously extracted, modelled or incorporated into analytical systems.

7. Historical research records

Scientific institutions may argue that long-term retention is essential for reproducibility, research integrity and verification of published findings.

12. Proposed Legal Reforms

A comprehensive legal framework should recognise the following safeguards:

1. Express deletion rights: Individuals should have a clear mechanism to request destruction of biological samples and erasure of identifiable genetic information.

2. Purpose-based retention: Biological samples should not be retained indefinitely without a legitimate purpose.

3. Separate treatment of samples and data: Physical specimens, DNA profiles, genomic sequences and derived predictions should have separate retention policies.

4. Independent review: Authorities should periodically assess the necessity of retaining criminal DNA records.

5. Third-party deletion: Organisations should communicate valid deletion requests to relevant processors and recipients.

6. Research safeguards: Scientific institutions should distinguish identifiable information from genuinely anonymised research datasets.

7. Special protection for children: Children's biological information should receive heightened protection, including appropriate safeguards when they reach adulthood.

8. International cooperation: Countries should develop mechanisms for handling deletion requests involving cross-border genetic databases.

9. Verification of deletion: Individuals should receive appropriate confirmation of the action taken, including any information that must legally be retained.

10. Effective remedies: Individuals should have access to complaints procedures, regulatory oversight and judicial remedies.

13. Comparative Legal Position

The Indian framework should be understood with an important qualification: the DPDP Act contains phased commencement provisions, so the applicability of particular obligations must be checked against the commencement notifications and rules in force on the relevant date. It also does not establish an unconditional right to destruction of every physical biological specimen.

14. Conclusion

The Right to Deletion of Biological Data represents an important development in modern biotechnology law and constitutional privacy protection.

Genetic information is fundamentally different from ordinary personal information because it may reveal hereditary characteristics, biological relationships, medical vulnerabilities and information about future generations.

The judgments in S. and Marper v. United Kingdom, Puttaswamy v. Union of India and NG v. Direktor na Glavna direktsia establish important principles concerning privacy, proportionality and the limits of indefinite biological data retention.

The central legal principle is that the lawful collection of biological information does not automatically create an unlimited right to retain it forever.

A balanced legal framework must protect individual autonomy while recognising legitimate medical, scientific, criminal justice and public health interests.

Ultimately, the right to deletion should extend beyond destroying physical samples to addressing identifiable genetic records, derived biological information and unauthorised copies, subject to legally justified exceptions.

15. Important Cases for Academic and Legal Research

Research note: The Indian cases listed above provide constitutional and evidentiary foundations rather than direct holdings establishing a standalone right to delete biological data. The strongest direct judicial authorities on DNA retention and erasure are the European cases S. and Marper and NG.

Important primary legal sources

India – Digital Personal Data Protection Act, 2023

S. and Marper v. United Kingdom – Full judgment

GDPR – Article 17, Right to Erasure

K.S. Puttaswamy – Supreme Court judgment