1. Meaning of Genetic Data

Genetic data refers to information obtained from a person’s DNA, RNA, chromosomes, or other genetic material that reveals biological characteristics, ancestry, health risks, hereditary conditions, or relationships between individuals.

Examples:

• DNA sequencing results
• Genetic disease predisposition information
• Ancestry test results
• Family relationship information obtained through DNA analysis

Because genetic information is unique, permanent, and shared with biological relatives, it raises significant privacy concerns.

2. Meaning of “Secondary Use” of Genetic Data

Secondary use of genetic data means using genetic information for a purpose different from the original purpose for which it was collected.

Primary use:

The initial purpose for collecting genetic data.

Example:

• A hospital collects DNA samples to diagnose a patient’s illness.

Secondary use:

Later use of the same genetic information for another purpose.

Examples:

• Using patient DNA samples for medical research
• Sharing genetic databases with pharmaceutical companies
• Using stored DNA samples for forensic investigations
• Using genetic information for insurance or employment decisions

Secondary use can create ethical and legal problems because individuals may not have expected or agreed to those additional uses.

3. Key Legal Principles Governing Secondary Use of Genetic Data

A. Consent

Consent is the central principle in genetic data protection.

A valid consent should generally be:

• Informed
• Specific
• Voluntary
• Based on adequate information about future uses

A person who agrees to genetic testing for medical diagnosis may not automatically have consented to:

• Commercial research
• Police access
• Data sharing with third parties

B. Purpose Limitation

The principle of purpose limitation requires that personal data should be collected for a specific purpose and not reused in incompatible ways.

Example:
A DNA sample collected for cancer treatment should not automatically be used for unrelated research without proper legal authority or consent.

C. Data Minimisation

Only the minimum amount of genetic information necessary for a particular purpose should be used.

Because genetic data can reveal:

• Health conditions
• Family information
• Ethnic ancestry
• Future disease risks

excessive collection creates privacy risks.

D. Confidentiality and Security

Organizations holding genetic databases must protect them from:

• Unauthorized access
• Data breaches
• Misuse by third parties

4. International Legal Framework

A. European Union — General Data Protection Regulation (GDPR)

The European Union’s GDPR treats genetic data as a special category of personal data.

Article 9 GDPR:

Processing genetic data is generally prohibited unless an exception applies, such as:

• Explicit consent
• Medical diagnosis and healthcare purposes
• Scientific research with appropriate safeguards
• Public interest grounds provided by law

Secondary Use under GDPR

Secondary processing is allowed when:

• The new purpose is compatible with the original purpose, or
• Another lawful basis exists
• Appropriate safeguards are applied

B. United States Law

The United States does not have one comprehensive genetic privacy law. Protection comes from several laws.

1. Genetic Information Nondiscrimination Act (GINA), 2008

GINA prohibits discrimination based on genetic information in:

• Employment
• Health insurance

However, it does not fully regulate:

• Direct-to-consumer genetic testing companies
• Life insurance
• Long-term care insurance
• All secondary research uses

2. Health Insurance Portability and Accountability Act (HIPAA)

HIPAA protects genetic information when held by covered healthcare entities.

However:

• Many consumer genetic testing companies may not fall under HIPAA.
• Secondary uses may depend on company policies and consent agreements.

5. Indian Legal Position on Secondary Use of Genetic Data

India currently does not have a separate comprehensive genetic data protection law.

Protection mainly comes from:

A. Digital Personal Data Protection Act, 2023 (DPDP Act)

The DPDP Act regulates processing of digital personal data.

Genetic data is not separately classified as a special category like under GDPR, but genetic information may qualify as personal data because it relates to an identifiable individual.

Important principles include:

• Consent-based processing
• Purpose limitation
• Data security
• Restrictions on unauthorized processing

B. Constitutional Right to Privacy

The Supreme Court of India recognized privacy as a fundamental right under Article 21.

Justice K.S. Puttaswamy v. Union of India (2017)

Facts:
The case challenged the constitutional validity of the Aadhaar scheme and examined whether privacy is protected under Indian law.

Judgment:
The Supreme Court held:

• Privacy is a fundamental right under Article 21.
• Informational privacy is an important part of personal liberty.
• Individuals have control over personal information.

Relevance to genetic data:
Genetic information is highly personal and its secondary use without proper safeguards may violate informational privacy.

6. Important Case Laws on Genetic Data and Secondary Use

1. Moore v. Regents of the University of California (1990)

Facts:

John Moore underwent treatment for leukemia. Doctors used his cells to develop a commercially valuable cell line without informing him.

Issue:

Did Moore have ownership rights over his biological materials after removal?

Decision:

The court held that Moore did not have a property right over the cells once removed.

However, it recognized that doctors had a duty to disclose conflicts of interest.

Importance:

The case established that:

• Biological materials can have commercial value.
• Informed consent is essential when biological samples are used for additional purposes.

2. Association for Molecular Pathology v. Myriad Genetics (2013)

Facts:

Myriad Genetics claimed patents over BRCA1 and BRCA2 gene sequences related to breast cancer risk.

Decision:

The US Supreme Court held that naturally occurring DNA sequences cannot be patented.

Importance:

The case emphasized that genetic information has a special relationship with human identity and biological existence.

3. S and Marper v United Kingdom (2008)

Facts:

Police retained DNA samples and profiles of individuals who were arrested but not convicted.

Decision:

The European Court of Human Rights held that indefinite retention violated the right to privacy under Article 8 of the European Convention on Human Rights.

Importance:

The case established that:

• DNA databases create serious privacy risks.
• Retention and secondary use require strict safeguards.

4. United States v. Jones (2012)

Although not a genetic-data case, it influenced privacy jurisprudence by recognizing that modern technology can create detailed personal profiles.

Relevance:

Genetic databases similarly allow authorities and organizations to derive extensive information about individuals.

5. Gautam Navlakha v. National Investigation Agency

The Supreme Court discussed privacy concerns arising from surveillance technologies.

Relevance:

It supports the principle that collection and use of personal information must have:

• Legal authority
• Legitimate purpose
• Proportionality

7. Ethical Issues in Secondary Use of Genetic Data

A. Lack of Meaningful Consent

Genetic research may involve future uses that cannot be fully predicted.

Example:
A person may agree to medical research but later find their data used for commercial drug development.

B. Family Privacy

Unlike ordinary personal data, genetic data reveals information about relatives.

Example:
A DNA test revealing a hereditary disease risk may affect siblings or children.

C. Discrimination Risks

Improper use may result in:

• Employment discrimination
• Insurance discrimination
• Social stigma

D. Commercial Exploitation

Companies may profit from genetic databases while individuals receive little control or benefit.

8. Safeguards for Lawful Secondary Use

A strong genetic data protection framework should include:

1. Broad but informed consent models
2. Independent ethics review
3. Data anonymisation
4. Strict access controls
5. Transparency about commercial partnerships
6. Right to withdraw consent
7. Limits on law enforcement access
8. Penalties for misuse

9. Conclusion

Secondary use of genetic data creates a conflict between scientific progress and individual privacy rights. Genetic databases can advance medicine, disease prevention, and forensic science, but their misuse can permanently affect individuals and families.

Modern legal approaches, including GDPR, GINA, and emerging Indian privacy principles after Justice K.S. Puttaswamy, emphasize that genetic data requires strong safeguards based on consent, purpose limitation, proportionality, and accountability.