I found it intriguing that the EU GDPR explicitly recognizes genetic data as something that it covers under PII - and thus you a have "right to request deletion" of your genomic data, I assume?
"GDPR, in contrast, explicitly recognizes the sensitive nature of genetic data collected in a variety of settings. In Article 9, an adjusted definition of special categories of personal data has been provided that includes genetic data and biometric data, among others." [1]
Which is fine, I suppose, but your relatives don't have to do delete theirs, and the similarity of their DNA to your DNA means that someone could back out, to a certain level of confidence, whether you might be a match based on DNA contributed by them, with the familial relationship obtained and substantiated from other sources (vital statistics, etc.).
This is not new -- I believe there have been at least a couple of arrests made as the result of a suspect's relatives contributing DNA in lieu of actually obtaining one from the suspect directly -- and provided there's consent from the relatives, I can't see much grounds from restraining someone from allowing their own DNA to be used to build a case against someone else. It becomes a bit murkier if you start compelling people to contribute DNA to build a case against a family member, but even there I can see parallels to other types of evidence and it's not a clear slam-dunk to me that it ought to be barred unless the familial relationship is one where testimony would normally be covered by marital confidence or other privilege.
Yep. I do understand re: this not being new - worked in a forensic genetics laboratory, and I tell my family what they give up and expose us to if they contribute to one of these db's.
So caveat emptor as always...but yep I had just wondered in general about "right to delete" with respect to genomic data.
What exactly do you tell them that they're giving up and expose your family to? Kind of an odd thing to mention in a thread about a case where a family member's DNA exposed a criminal.
The problem isn't deleting your DNA. The problem is you cannot delete your relative's DNA. Which is how I've read that they found him. Found a relative match from a 3rd-party, made sure he would have been in the area the years of the rapes, tailed him for a verification DNA sample, made arrest.
If this were to come before the CJEU[1], it would not be clear-cut at all. There was a landmark case where home CCTV was ruled inadmissible in a robbery by virtue of the fact that it included footage of a public road, and the thieves did not consent to the use of their personal data[2], i.e., the recording of their images in public using a home CCTV system.
And the definition of personal data extends to any data that can be linked to you. For example, if a server records a log entry with your name and IP, and the server also records log entries with just the IP, all of the log entries are considered personal data, even for dynamic IPs in some instances[3].
There are some exceptions around criminal justice and the protection of persons and property, however, I still wouldn't be surprised if this DNA evidence were ruled inadmissible in the EU.
Is the metadata that you requested deletion something police in Europe can subpoena?
It sure would seem awful suspicious if someone requested DNA deletion out of the blue. Not convictably-suspicious, but suspicious enough to warrant followup investigation. ;)
"GDPR, in contrast, explicitly recognizes the sensitive nature of genetic data collected in a variety of settings. In Article 9, an adjusted definition of special categories of personal data has been provided that includes genetic data and biometric data, among others." [1]
[1] - https://www.nature.com/articles/s41431-017-0045-7