Forensic DNA phenotyping in Europe: How far may it go?

Abstract

The fast evolution of genetic sequencing techniques led to new applications in forensic genetics, one of these being the prediction of the physical appearance of a possible perpetrator from biological traces found at the crime scene. Some European countries recently changed their legislations, to permit this technique, also known as Forensic DNA Phenotyping (FDP). The phenotypical traits that may be analyzed under those revised domestic laws are usually restricted to include no information about the suspect’s health. This article elaborates whether the European legal framework, as set by the Council of Europe and the European Union (EU), defines any boundaries for the analytical scope of FDP. After a brief introduction to FDP and a description of the type of data collected through predictive forensic genetics, this article discusses the relevant European legislation and the case law of the European Court of Human Rights (ECtHR) and the Court of Justice of the European Union (CJEU) around privacy, data protection and the use of genetic data. The article attempts to define possible limits for forensic genetic analysis, by eventually trying to predict the jurisprudence of the two European courts.

I. A SHORT INTRODUCTION TO FORENSIC DNA PHENOTYPING

Following the discovery of the ‘genetic fingerprint’ by Alec Jeffreys in 1984,¹ the analysis of DNA became quickly one of the most prominent investigative tools for the police. For many years, it was the sole purpose of the forensic use of DNA to link a suspect, either previously known or registered in a national DNA database, to a crime scene stain. This is done by comparing the almost individualizing code of numbers, the DNA profile derived from DNA length polymorphisms, between suspect and trace. As early as 2002, however, the first attempts were made to use DNA traces not only as a direct link, but also as a predictive tool. In the case of the ‘Baton Rouge Serial Killer’, who murdered seven women between 1992 and 2003 in Louisiana, the US company DNA Print Genomics predicted the perpetrator to be of African ancestry. At that time, the police was looking for a white individual, due to an erroneous eyewitness testimony. After reorienting the investigation, the police arrested the African-American Derek Todd Lee in 2003, who was convicted shortly thereafter.²

However, the prediction of phenotype from the sole knowledge of genetic ancestry is not very reliable,³ so the technique did not become very popular and DNA Print Genomics stopped operations in 2009.⁴ It was only about ten years after the case of the ‘Baton Rouge Serial Killer’, with the impressive development of new DNA sequencing techniques that FDP started to rise again and make promises for the possible solution of cold cases, where no suspects could be identified by conventional DNA analysis. Today, it is possible to predict with useful accuracy hair, eye and skin color, the biogeographical ancestry (BGA) and the approximate age of a person. Several other features are under development and will be predictable in the near future.⁵

II. RECENT CHANGES OF LEGISLATION IN GERMANY AND SWITZERLAND

Beginning in the 1990s, when the different countries started drafting legislations for the regulation of the generation of DNA profiles, their storage and comparison in databases, application of FDP was still a long way off. Accordingly, there is little surprise that a majority of the countries in Europe has no explicit regulations on the issue. Today, it seems that only three European countries (the Netherlands, Germany and Slovakia) have an explicit regulation for FDP.⁶ Nevertheless, in most European countries, FDP is considered to be permitted to some extent.⁷

The Council of Europe’s Recommendation No R (92)1 on the use of DNA in the criminal justice system leaves it to the discretion of the contracting states if they wish to exploit the coding regions of the human DNA for law enforcement purposes.⁸ When introducing their first regulations for forensic DNA profiling, Germany⁹ and Switzerland¹⁰ had chosen to restrict the forensic use of DNA molecules to the analysis of non-coding regions.¹¹ With the great expectations that have been aroused by the recent advancements in FDP, both countries started to change laws to be more permissive. Germany modified the Code of Criminal Procedure (CCP) accordingly in 2019.¹² Switzerland is just in the final stage to pass a revised version of the Federal Act on the Use of DNA Profiles in Criminal Proceedings and for Identifying Unidentified or Missing Persons (referred to hereinafter as Swiss DNA Profiles Act) alongside with a modification of the Swiss CCP. As of April 2022, the law has already been passed by the parliament and the referendum period has expired but it has not yet entered into force.¹³

There seems to be some common ground among European legislators and scientists that FDP, if considered permitted, should be restricted to externally visible characteristics, excluding information about personality, mental state or disease.¹⁴ The argument often put forward by the proponents of FDP, why the technique should be permitted under this restriction, is that, in contrast to disease or personality related traits, externally visible traits are not private in a strict sense, since they are visible to everyone.¹⁵ In addition, the information that can be derived from those traits, such as hair, eye and skin pigmentation or age is considered comparatively little sensitive.¹⁶ The same does not apply for BGA that is not externally visible and will usually not be known to the data subject. Consequently, this trait has not been accepted by the German legislator.¹⁷ Comparing BGA to medically relevant genetic information, it must nevertheless be considered as less sensitive, because knowing one’s biogeographical roots will usually have only little to no impact on life.¹⁸

Notwithstanding what appears to be widespread common views among scientists and lawmakers, representatives of law enforcement agencies formulated a desire to use medically relevant genetic information as well.¹⁹ During the consultation procedure for the draft of the Swiss DNA Profiles Act, the representatives of the police and public prosecutors offices, as well as several cantons claimed that they would prefer to not restrict the scope of the FDP analysis at all and instead to ‘allow the identification of all those characteristics which could serve to clarify the criminal act’ [citation translated by the author].²⁰ The rationale behind this is probably that some hereditary diseases might again be visible²¹ or need some rare special treatment that might possibly lead to a suspect by checking sales records of pharmaceuticals, patient registries or other health related data repositories.²²

However, the Swiss Federal Council took the view that neither health-related nor personal characteristics such as character, behavior, and intelligence may be evaluated, considering such an analysis as generally ‘disproportionate’.²³ Claiming a lack of proportionality without conducting a concrete balancing of competing rights gives the impression that the Swiss government assumes an interference with some core of the right to privacy that could be justified by no means. Referring to the modification of the German CCP, Zöller and Thörnich made a similar claim, stating that the untouchable core of privacy is violated when psychological, character-related or disease-related traits are analyzed.²⁴ In this article, I will examine the European legislation and the case law of the CJEU and the ECtHR, trying to anticipate whether this claim might actually hold up in the European courts.

III. DEFINING THE TYPE OF DATA

III.A. Health-Related FDP Generates Sensitive Data

In the following, I will use the terms ‘health-related FDP’ or ‘health-related forensic genetic data’ when writing about the analysis of genetic variants associated with the psychological, medical or character status of a person for the purpose of law enforcement.²⁵ Definitely, this appears to be a very broad term that could be further differentiated. The intrusion into a person’s private life by health-related FDP is not always the same; it is rather dependent on the medical condition revealed. If we investigate the genetic causes for monogenic diseases like Trisomy 21, manifesting at birth and diagnosed with certainty and in probably all of the prevailing cases, this information will not be new to the data subject and in addition, it will be obvious to almost everyone who encounters this person. Therefore, it cannot be considered as equally sensitive as the discovery of an increased risk of developing an incurable disease at a later stage in life, such as early onset Alzheimer²⁶ or even as confirming a carrier status that will lead to such a disease with almost certainty such as Huntington’s disease. Actually, in the US and Europe, it has been demonstrated that less than 20% of the people at risk for Huntington’s disease choose to test for it, the major reasons given for this choice being the ‘lack of an effective cure or treatment […] and inability to undo knowledge’.²⁷ The examples of early onset Alzheimer and Huntington’s disease demonstrate that any genetic analysis done without informed consent has to undergo a balancing between the right to know and the right not to know of the data subject, with respect to the type of information obtained.²⁸

How difficult the balancing between those two competing rights of the same individual can be in practice, can be seen from the ongoing debate in medical genetics about incidental findings. There seems to be some consensus that incidental findings, indicating an actionable health problem, e.g. a curable or treatable disease, should be proactively disclosed to the patient. However, who decides what is actionable? Due to the complexity of the ethical questions arising in the interplay between the right to know and the right not to know, there exists no fully consistent handling of the matter by health care professionals and no universal rules.²⁹ Health-related FDP extents this open issue beyond bioethical assessment in the clinics to law enforcement.

Besides those difficulties arising from the fact that the data subject itself may not be aware of the data generated through health-related FDP, such data can also render an individual vulnerable to third parties such as insurance companies. For example, illegal discrimination by health insurers based on data from predictive genetic testing has recently been revealed in Australia.³⁰ One might argue that insurers will not have access to police files and that data breaches can be prevented to a large extend by appropriate regulatory safeguards. However, also within the law enforcement agencies human beings are working, who might not be flawless in every situation. Data breaches even from police agencies are not a mere theoretical possibility, as may be best demonstrated by the example of a massive data leak at Europol, uncovered in 2016. It was caused by a collaborator, simply copying sensitive data about hundreds of people possibly involved in terrorism to a private, non-secured hard disk.³¹ Another risk for the confidentiality of genetic data might arise from the criminal procedure itself. For instance, medical data has already been released in the past by courts in public hearings or through publicly available judgments.³²

III.B. Health-Related FDP Interferes with Privacy

If we assume that a state adopts legislation permitting FDP for ‘the identification of all those characteristics which could serve to clarify the criminal act’³³ and therefore also of health-related genetic data, we encounter a unique situation: Here, the law enforcement agency, as a representative of the state, is not making use of already existing information, such as is the case with conversations in phone calls or chat protocols, website traffic, or the recordings of certain actions on video tape. For all the given examples, the person that is subjected to surveillance is well aware of what they say, write, where they go or which websites they use in which way. All of this requires a more or less conscious action. In contrast, if we look into the genetic make-up of an individual, revealing medical information, we are genuinely generating new, highly sensitive data and we must not at all assume that the person concerned is actually aware of it. We can rather be sure that such an analysis will generate an asymmetry of knowledge where the state holds more, potentially life-changing, information on the citizen than the citizen himself does. This asymmetry is much larger than for the common biometric identifiers, their knowledge having no impact on someone’s live, maybe with the exception of kinship information deceivable from DNA profiles. Therefore, we must conclude that the intrusion into someone’s privacy by health-related FDP would be more intense than by any other investigative measure already permitted by law. Consequently, the ECtHR in S and Marper considered the retention of cellular samples as ‘particularly intrusive’ compared to the retention of DNA profiles, primarily because the samples contain plenty of ‘much sensitive’ health related information.³⁴

Strictly speaking, the generation of health-related forensic genetic data is nothing completely new, since already the forensic determination of blood groups from bloodstains recovered from crime scenes for the purpose of identification revealed medical predispositions in the past. In addition, some of the STR markers currently used to establish standard DNA profiles could reveal medical conditions, such as Klinefelter syndrome revealed with high indicative value through sex determination by the amelogenin locus. However, what makes a difference is the intention. All of those already existing potential revelations concerning medical conditions are unintentional secondary findings that will usually not find their way out of the laboratory analyzing the sample.³⁵ The revised Swiss DNA Profiles Act even explicitly forbids the communication of all secondary findings to bodies outside the laboratory.³⁶ In contrast, if we start to explicitly search for medical conditions for the purpose of a criminal investigation, such information would be useless if it would not be communicated to law enforcement authorities outside of the lab. However, the more widespread the genetic data, the higher the risk of data leakage.

One argument that has frequently been put forward in the debate around FDP is that the data is generated from ‘anonymous’ crime scene stains, implying that they cannot be seen as personal data in the sense of data protection law, as defined in Article 2 lit. a of the Council of Europe’s Convention 108, in Article 4(1) of the EU General Data Protection Regulation (GDPR) or in the identical wording in Article 3(1) of the Law Enforcement Directive (LED) of the EU.³⁷ Under Article 3(1) LED, data is considered as personal and therefore under the scope of the regulation, if it is identifiable. Referring to recital 21 of the LED, a natural person is considered identifiable if it is reasonably likely to be identified.³⁸ The recital also provides some guidance on what should be considered for the decision whether an identification is reasonably likely or not:

To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.

Considering the fact that ‘genetic data are intrinsically self-identifying’³⁹ and that they are routinely and successfully used in forensics for exactly this purpose, thereby accepting the costs and the time needed for the genetic analysis, we must conclude that a crime scene stain, containing the full genetic makeup of its source that can be used for the identification of this source, has to be considered as identifiable.⁴⁰ As the ECtHR stated in S and Marper, cellular samples from which personal data can be deduced because those samples relate to identifiable individuals, can be considered as personal data themselves.⁴¹ As Urgessa argues, there is no logical reason to consider a certain type of information as identifiable but not the source from which this data can be readily retrieved.⁴² To summarize, we can therefore conclude that a biological crime scene stain and the human genetic information derived from it for the purpose of identification have to be considered as identifiable or personal data, what brings into application the respective legal provisions for privacy and data protection. In the following, this legal framework, as established by the institutions of the EU and the Council of Europe, is examined in more detail.

IV. REGULATIONS OF PRIVACY BY THE COUNCIL OF EUROPE

IV.A. No Barriers in Recommendations and Convention 108+

The Council of Europe issued a variety of legal instruments applying to data protection. However, none of the different recommendations, resolutions or declarations provides guidance to define how broad forensic genetic analysis can be to stay in line with the ECHR. More specifically, neither the Recommendation CM/Rec(2019)2 of the Committee of Ministers to member states on the protection of health-related data, nor Convention 108+ provide any guidance on whether such an analysis would actually be considered permitted or not. Even though the highly influential Nuffield Council on Bioethics report on the forensic use of bioinformation referred to the predecessor Recommendation No. R (97)5 on the Protection of Medical Data to explain why it believes health-related forensic genetic data should not be gathered,⁴³ provision 7.3 of the new Recommendation CM/Rec(2019)2 does not prohibit such an analysis. The last half sentence of provision 7.3 that has been added in the course of the modernization of the guidelines from Recommendation No. R (97)5 to Recommendation CM/Rec(2019)2, leaves the door wide open for domestic legislation permitting a broad application of FDP, including the generation of health-related forensic genetic data. Whereas the Recommendation No. R (97)5 proscribed the determination ‘of other characteristics which may be linked genetically’ in a categorical manner, the new guidelines now submit such an analysis to ‘appropriate safeguards provided for by law’.⁴⁴

We must hold that the specific data protection instruments of the Council of Europe provide no arguments against health-related FDP. Therefore, Article 8 of the ECHR remains the pivotal point for the ECtHR to check whether such a restriction of the fundamental right to privacy could be legitimate.

IV.B. Scope of Article 8 ECHR

The right to privacy has first been instated as a formal international human right in Article 12 of the Universal Declaration of Human Rights in 1948. Soon thereafter, in 1950, the European Convention on Human Rights (ECHR) was drafted, protecting the right for privacy in the contracting states under Article 8 since then in a broad sense.⁴⁵ Article 8 ECHR is formulated as mainly imposing negative obligations on the contracting states, protecting individuals from infringements on their fundamental rights primarily by the state authorities.⁴⁶ However, there are also positive obligations that can be inferred from Article 8 ECHR, such as the obligation to investigate and punish serious crimes.⁴⁷ Therefore, we will frequently encounter situations where the negative obligation to leave someone’s privacy untouched and the positive obligation of the state to protect the life of right holders are in conflict.

The ECHR does not differentiate explicitly between a right to personal data protection and a right to the protection of privacy. When the state performs a genetic test on someone’s DNA, thereby generating health-related forensic genetic data that might not even be known by the data subject, several aspects of Article 8 ECHR might be at stake:

First, even though Article 8 ECHR does not explicitly state it, the right for data protection, also understood as the ‘right to a form of informational self-determination’⁴⁸ is interfered with. At the heart of the right for data protection lays the notion of control, more precisely control over one’s own personal data.⁴⁹ As a consequence of health-related FDP, the data subject is no longer in control (or has actually never been) of the sensitive personal data concerning them, without giving this control voluntarily out of hands.⁵⁰

Second, the right for personal development might be interfered with.⁵¹ If we take the previously mentioned example of the Huntington’s disease again, a young person who inadvertently learns through a forensic examination that he or she will later develop Huntington’s disease will not continue living as before. Such an information will affect in one way or another relations to other people, including family planning, mental state and quality of life in general. This person could therefore claim with good reason that their personal development is severely impaired by the unsolicited revelation of this untreatable disease.

Third, we have a sort of forced medical procedure without consent that constitutes an interference with privacy under article 8 ECtHR, as has been held by the Court for the collection of blood and saliva samples.⁵² Since FDP is conducted on crime scene traces and not on samples taken directly from the body of a suspect, one might argue that this is not applicable here. However, if we consider a genetic test revealing health-related information as a medical procedure,⁵³ and a medical procedure as generally interfering with the right to privacy, it cannot be of any importance, whether this procedure is carried out on a crime scene stain or e.g. on a blood sample taken in a hospital.

For judicial decisions concerning paternity, we might also encounter situations where a compulsory genetic test reveals previously unknown information and might even be enforced physically. It might be tempting to draw parallels from those paternity cases to health-related FDP. However, those cases are not perfectly comparable to predictive genetic testing for forensic investigative purposes, for several reasons: In a paternity dispute, there is already substantial suspicion about the possible paternity of the concerned man, hence the decision for the test, ordered by the respective authority. The result of the analysis is restricted to the question of paternity vs. non-paternity. Since the man has to give a sample explicitly for the test, the analysis is more transparent than health-related FDP and the alleged father can express his objection, if he is not willing to participate. In addition, confirming or excluding the biological paternity will usually contribute to a clarification of the uncertain family situation. It can therefore be assumed as beneficial for the child in most of the cases.⁵⁴ Related to this interest of well-being of the concerned child, the Court will have to decide which one of two fundamental rights it will prioritize: the right of the alleged father to personal privacy, or the one of the child for knowledge of its biological father. In Mifsud the ECtHR has decided this question in favor of the later, thereby stating that.

Article 8 of the Convention does not as such prohibit recourse to a medical procedure in defiance of the will of a suspect, or in defiance of the will of a witness, in order to obtain evidence. ⁵⁵

Even though the situation in Mifsud is not perfectly comparable to the more privacy-intrusive and less purposeful health-related FDP, this dictum, considering genetic testing for paternity issues as a form of coercive medical treatment, clearly demonstrates that Article 8 ECHR does not constitute an absolute barrier for compulsory genetic testing revealing health-related data. However, what we can hold at this stage is that health-related FDP interferes with various aspects of private life as protected by Article 8 of the ECHR.

IV.C. Is Health-Related FDP ‘Necessary in a Democratic Society’?

The rights under article 8 are not absolute.⁵⁶ To restrict someone’s rights under Article 8 ECHR, the conditions of its second paragraph have to be fulfilled. To be in accordance with the law, the interference with Article 8 needs to have sufficiently robust legal grounds in the domestic law. This signifies not only that a formal law exists permitting the interference, but also that the rule of law is respected, what means that the law has to be accessible and its effects foreseeable.⁵⁷ However, carefully drafted domestic laws will usually fulfil this condition.

The possible legitimate aims for an interference with Article 8 ECHR are very broadly defined. In line with the positive obligation of the state to protect its citizens, as mentioned before, public security and the prevention of crime are explicitly stated in the provision.⁵⁸ Therefore, health-related FDP pursues a legitimate aim in accordance with Article 8(2) ECHR.

In addition to the two previously mentioned conditions, a justified interference with the fundamental right to privacy has to be ‘necessary in a democratic society’. Finding the answer to the question whether a certain interference is ‘necessary in a democratic society’ amounts to a question of proportionality. The Court will assess two aspects here: Is there a ‘pressing social need’ and is the interference ‘proportionate to the legitimate aim pursued’?⁵⁹ Since fighting crime can be seen with no doubt as a ‘pressing social need’, the actual proportionality test will eventually be crucial for a decision whether health-related FDP is acceptable under Article 8 ECHR or not.

The Court leaves a certain margin of appreciation to the national authorities for the assessment of this balancing. If a particularly important aspect of a person’s identity is at risk, the margin granted to the state is restricted. However, the margin will be wider for issues of morality or ethical issues, as long as there exists no common position among the contracting states.⁶⁰ Consequently, the margin is narrower, when there is strong consensus among the contracting states on the issue at hand.⁶¹ The sensitivity of genetic and health data and the universally accepted need to broadly protect them, as reflected inter alia in Article 6 of Convention 108, as well as the impact such data may have at a personal level, also argue for a narrow margin of appreciation.⁶²

However, in S and Marper, the landmark ruling for the protection of genetic data used for law enforcement purposes, the ECtHR defined the margin largely based on the consensus among the contracting states.⁶³ The Court had to assess the question whether the indefinite retention of DNA samples and suspect DNA profiles in the national database of the United Kingdom could be justified under the Convention. The Court found that:

the protection afforded by Article 8 of the Convention would be unacceptably weakened if the use of modern scientific techniques in the criminal-justice system were allowed at any cost and without carefully balancing the potential benefits of the extensive use of such techniques against important private-life interests. In the Court's view, the strong consensus existing among the Contracting States in this respect is of considerable importance and narrows the margin of appreciation left to the respondent State […] ⁶⁴

Therefore, to anticipate how the Court could potentially decide on the permissibility of health-related FDP, we need to have a look into the domestic regulations of the contracting states, to see whether they permit such an analysis or not.

As mentioned previously, only three contracting states are currently known to have explicit legislation about FDP and the Swiss parliament just passed a law on the matter that did not yet enter into force.⁶⁵ In Germany and the Netherlands, FDP is restricted to a number of explicitly listed traits, being eye color, hair color, skin color and age in Germany⁶⁶ as well as BGA, eye color, hair color and skin color in the Netherlands.⁶⁷ Legislation in Slovakia is less restrictive, referring more generally to the prediction of visible traits, albeit enumerating the examples of hair color, eye color and skin color in the law.⁶⁸ The Swiss law will explicitly allow for the analysis of the three previously named pigmentation traits, age and BGA. In addition, the law will delegate legislative power to the Swiss Federal Council, to add more physical appearance traits, without passing the law through parliament again.⁶⁹ However, the revised Swiss DNA Profiles Act explicitly forbids the analysis of ‘health-related […] or personal characteristics such as character, behavior and intelligence’.⁷⁰ Therefore, there seems consensus among the states holding explicit legislation on FDP that phenotyping should be restricted to appearance traits with no obvious link to health conditions.

Evidently, it is more difficult to assess the scope of the analysis in the countries holding no explicit legislation. According to a 2018 report drafted by researchers from the scientific VISAGE consortium, in none of the European countries included in the study health-related FDP seemed to be practiced. This observation lends some support to the assumption that also in countries with no explicit legislation on FDP, the consensus is to preclude the analysis of health-related data for forensic purposes.⁷¹ For example, the judgment, based on which FDP is practiced in France refers only to apparent morphological characters as well.⁷² In the UK, the Nuffield Council on Bioethics Report of 2007, mentioned among the relevant domestic material in S and Marper,⁷³ holds that uncovering health data for law enforcement purposes would be ‘contrary to the Council of Europe’s Recommendation on the Protection of Medical Data’.⁷⁴ Even if the respective provision has been amended in the modernized Recommendation CM/Rec(2019)2,⁷⁵ such a statement could indicate that law enforcement authorities are unlikely to proceed to the use of health-related forensic genetic data in the UK either, even though the UK can be considered a country with rather permissive regulation of forensic DNA analysis, as we have seen in S and Marper or more recently in Gaughran⁷⁶. The absence of forensic practice of health-related FDP suggests some consensus among the contracting states.

The fact that most countries did not yet elaborate explicit legislation for FDP cannot be interpreted as a permissive attitude.⁷⁷ In most European countries, FDP seems not to be practiced by now. Presumably, in many of those countries the interest for its implementation is not yet significant and consequently, the regulation of FDP has not been discussed on the political level yet.⁷⁸ Therefore, the strong consensus among the countries holding explicit legislation on FDP, to exclude health-related information from the scope of the analysis, limiting it to externally visible characteristics, must not be seen as substantially weakened by the complete absence of explicit legislation in most contracting states. In Germany and Switzerland, the option of health-related FDP was excluded from the outset in the political discussion, probably because it appeared to be unethical or at least politically unfeasible, so that a detailed examination of its legal admissibility was not even deemed necessary.⁷⁹ If inadmissibility of health-related FDP is deemed self-evident in other countries as well, this could also explain why a political debate is absent and why explicit legislation, setting analytical boundaries, is not deemed necessary.

In addition to the criterion of consensus among the contracting states, it can be anticipated from S and Marper that the ECtHR would also assess the actual efficiency of the measure in question, to decide whether it is really necessary to pursue the legitimate aim of law enforcement.⁸⁰ The court would most probably ask the respective state to demonstrate that health-related FDP can indeed advance the investigation. Today, almost no information is publicly available concerning the success rate of the use of FDP for the prediction of appearance traits, what suggests already little success for those methods. If they would frequently advance investigations as a crucial piece of information, we would expect more media coverage for them. Therefore, the duty to demonstrate the forensic efficacy of health-related FDP could be an additional potential barrier. The two examples repeatedly given by law enforcement representatives during the revision of the Swiss DNA Profiles Act (Down syndrome, color-blindness) will most probably not advance any investigation and therefore fail the criterion of necessity.⁸¹ The anticipated uselessness to know whether a possible perpetrator is affected or not by the Down syndrome has been already mentioned in 2001 by the Dutch legislator in the explanatory note accompanying an amendment of the respective legislation.⁸²

In summary, one could conclude that the ECtHR would probably not accept health-related FDP because its forensic utility can be questioned and, more importantly, because there seems to be a broad consensus among the states contracting to the ECHR that this form of genetic testing for law enforcement purposes ought not to be permitted.

V. PROTECTION OF PRIVACY AND DATA PROTECTION IN THE EU

V.A. Detailed Framework for Data Protection

Explicit legislation on data protection in the European Community started with the Data Protection Directive (DPD) in 1995.⁸³ The DPD was mainly drafted based on the example of the Convention 108 of the Council of Europe from 1981.⁸⁴ In a time when a rising number of nations drafted domestic data protection laws, it was primarily conceived as a means of harmonization, to assure the free circulation of data across the member states. The Charter of Fundamental Rights of the EU, OJ C 326/391 (Charter) was proclaimed in 2000 and entered into force in 2009. In the preamble and in Article 53 it refers explicitly to the ECHR and it must be seen as holding up the same human rights tradition and principles. Contrary to the ECHR, the Charter differentiates clearly between the protection of privacy and the protection of personal data. It guarantees the protection of private and family life under Article 7 and it states an explicit right for data protection in Article 8. Both provisions have to be interpreted in light of Article 8 of the ECHR.⁸⁵

Furthermore, Article 16(2) of the Treaty on the Functioning of the European Union, OJ C 326/47 (TFEU) provides a legal basis for a more detailed regulation of data protection, by giving the EU the competence to legislate on the subject. In 2016, the GDPR, replacing the DPD, was adopted. Acknowledging special requirements for data protection in the course of criminal proceedings, the GDPR came accompanied by the LED, repealing the Framework Decision 2008/977/JHA, which had a much more limited scope.⁸⁶ In the following, we will see whether this much-elaborated legal framework on data protection provides any guidance as to the permissibility of health-related FDP in the Member States of the EU. It is noteworthy that the LED, as forming a part of the Schengen acquis, is also binding for other European states that are not Member States of the EU, but signed the Schengen Agreement, as e.g. Switzerland.⁸⁷ The LED though leaves a large room to manoeuver to the contracting states, as it is not a Regulation but a Directive.

V.B. EU Secondary Legislation: The Law Enforcement Directive

Even though the right to data protection in Article 8 and the right to private life in Article 7 of the Charter are closely related, they do not have the same scope. Data protection concerns all types of personal data. However, personal data does not need to be necessarily private.⁸⁸ If data can be considered as private is depending on the context.⁸⁹ Therefore, the scope of data protection is considered broader than the scope of the protection of privacy.⁹⁰ The secret generation of health-related forensic genetic data touches on both, privacy and data protection: An infringement with privacy is necessary to gather the genetic data without consent and every treatment of genetic data, starting from its generation, triggers the application of principles of data protection. Just like under Article 8 ECHR, the protection of privacy under Article 7 of the Charter is conceived in a very broad sense. The regulatory framework for data protection, with its two flagship secondary legislations GDPR and LED, is more clearly elaborated. I will therefore concentrate in the following on the EU legislation concerning data protection, to examine which regulations could apply and whether they hold any provisions preventing the Member States from the application of health-related FDP.

The GDPR and LED contain detailed rules for the lawful processing of personal data. In Article 2(2)d GDPR, the processing of personal data for law enforcement purposes was exempted from this regulation. To respond specifically to the special needs of data protection in this field of application, the LED was adopted in parallel with the GDPR. The former could be considered lex specialis in relation to the later.⁹¹ Since the GDPR is not applicable in the field of police and criminal justice, I will focus on the LED in the following.

The LED sets a minimum standard for data protection in the Member States.⁹² It focusses on prescribing rules on how data should be processed lawfully but sets almost no categorical limits on whether processing of certain types of data should be omitted or not.⁹³ As mentioned in the title of the LED, its goal is not a restriction of data processing, but rather providing a framework to enable the movement of data between the Member States.⁹⁴ Just as the GDPR, the LED specifies a number of rights that have to be respected when processing personal data, such as the rights to information, to access, to rectification or to erasure. It also sets out a number of practical obligations for the data controller for the lawful handling of personal data.

The LED holds a couple of rules for data processing that are also applicable for FDP, as for example the right to have access in Article 14. If the phenotyping results of a crime scene stain lead to the identification of an individual, this individual should be provided access to the genetic data, as stated in Article 14 LED. Such access could be restricted for one of the reasons listed in Article 15(1) LED. However, none of these conditions for restricting access applies to a person’s access to their own genetic data. Access to this data needs therefore to be granted.⁹⁵ To comply with bioethical principles, the data controller might even have the duty to actively inform the data subject of any information suggesting serious health problems of the person itself or her relatives, in case treatment or prevention are possible.⁹⁶ Connected to the right to access, a duty for genetic counselling could potentially arise as well, when health-relevant results from predictive genetic tests are communicated.⁹⁷ In addition, when adopting a new technology with a high risk for the rights of the concerned individuals, the respective data controller has to conduct a data protection impact assessment, before adopting such a technology into practice.⁹⁸

As already mentioned above,⁹⁹ the LED uses the same definition of ‘personal data’ as the GDPR. The definition of ‘genetic data’ in Article 3(12) LED explicitly includes data about health. As an additional protection, the genetic data resulting from health-related FDP has to be considered as ‘special category of personal data’ in the sense of Article 10 LED. However, processing of such data is not prohibited in principle under the LED, as it is the case in Article 9(1) of the GDPR. It is rather generally allowed when strictly necessary, accompanied by sufficient safeguards and if one of the following conditions applies:

(a) where authorized by Union or Member State law;

(b) to protect the vital interests of the data subject or of another natural person; or

(c) where such processing relates to data, which are manifestly made public by the data subject.¹⁰⁰

If health-related FDP would be permitted by one of the Member States and legislation carefully drafted as to respect sufficient safeguards and the rule of law, the question remains whether it would actually be ‘strictly necessary’.

Let us consider a case of a serious violent crime, where the only piece of evidence pointing towards a possible suspect is a crime scene stain, such as e.g. a sperm trace in a sexual offence, or a bloodstain in a murder case. Searches on the DNA database were not successful. In such a case, extensive FDP including the generation of health-related genetic data might remain the last option to create investigative leads to find the perpetrator who could in the meantime potentially inflict harm on others. In other words, in such a situation, health-related FDP might appear as ‘strictly necessary’ last resort to the aim of law enforcement. We therefore must hold that Article 10 LED delivers no additional legal barrier for a purpose-limited application of health-related FDP, provided for in domestic law.

Reading the definition of ‘profiling’ in Article 3(4) of the LED, health-related FDP could be seen as some kind of genetic profiling. Whether health-related FDP could indeed constitute a form of profiling in the sense of that provision, has not to be clarified here though, since profiling as such, even if based on sensitive data such as the genetic data generated through health-related FDP, is not prohibited by the LED.

As an intermediate conclusion, we can summarize that the secondary legislation of the EU, more precisely the LED, holds no concrete provisions as to the potential permissibility of health-related FDP. To get a better idea of what might be considered permissive and what not in the EU, we need to have a closer look into the case law of the CJEU.

V.C. Health-Related FDP in the Light of the Case Law of the CJEU

Since the LED does not limit the analytical scope of FDP, it has to be clarified whether health-related FDP could actually be compliant with Article 7 and Article 8 of the Charter. Secondary legislation on data protection did not provide any guidance to assess the potential legal limits of FDP. We must hold though that the content of the right for data protection, as enshrined in Article 8, can anyway not depend on the LED or any other secondary legislation.¹⁰¹ This has been demonstrated by the CJEU in Digital Rights Ireland, when the court declared the Data Retention Directive 2006/24/EC invalid, because it was not compliant with Articles 7 and 8 of the Charter.¹⁰² Therefore, if no secondary rules exist, the Charter defines the legal boundaries of the analytical scope of FDP. However, according to article 51(1), the Charter only applies to the implementation of EU law. It is not permissible to refer directly to the Charter. With the LED, the EU demonstrated its will to set detailed regulations for data protection in the law enforcement domain. Moreover, the conformity of domestic criminal procedure law with EU regulations has already been subject to several CJEU decisions.¹⁰³ Therefore, it cannot be excluded that the CJEU would decide on the admissibility of health-related FDP under the LED at the occasion of a request for a preliminary ruling under Article 267 TFEU. One provision that could serve as an anchor for such a request could be e.g. article 4(1)c LED, repeating the principle of proportionality explicitly for data processing in the law enforcement domain.

There is ample case law on data protection by the CJEU, concerning different ways of processing such as storage, transfer or publication of personal data.¹⁰⁴ Until today though, the CJEU never had to express itself on the scope of genetic analysis or the processing of genetic data, neither in a medical context nor in the context of law enforcement. A landmark judgment on forensic DNA analysis and data retention such as S and Marper by the ECtHR does not exist in the case law of the CJEU. However, according to Article 52(3) of the Charter, its rights shall be interpreted in harmony with the ECHR and thus with the corresponding jurisprudence of the ECtHR, what the court consistently did in the past.¹⁰⁵ According to Article 52(3) the CJEU is nevertheless free to provide more extensive protection for fundamental rights than provided for under the ECHR.

Therefore, in the following I will focus on the question of whether the Charter can limit the scope of genetic analysis for the purpose of criminal prosecution beyond the limits arising from Article 8 ECHR. The conditions for a lawful restriction of fundamental rights as stated in Article 52(1) of the Charter reflect the conditions given in Article 8(2) of the ECHR:

Any limitation […] must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognized by the Union or the need to protect the rights and freedoms of others.

Being in lack of a concrete legislation permitting health-related FDP yet, we have to assume that such legislation would be in accordance with Article 52(1) of the Charter, in terms of accessibility and foreseeability.¹⁰⁶ Law enforcement as such must also be considered a legitimate aim under the Charter, mentioning ‘objectives of general interest’ and the protection of ‘the rights and freedom of others’ as justifications for the limitation of fundamental rights in Article 52(1).

Assuming an appropriate legal basis and a legitimate aim, two conditions for a lawful limitation remain: First, the question whether the respective measure is necessary, what amounts to an assessment of proportionality, and second, the question whether such a measure would respect the essence of the right.

Since the CJEU predominantly follows in its case law the absolute theory, it will first assess the question of the essence, before engaging in a balancing process.¹⁰⁷ Contrary to this sequence of examinations established by the court, before investigating into the ‘essence’, we will first have a brief look on the necessity criterion. Article 52(4) of the Charter explicitly refers to the ‘constitutional traditions common to the Member States’, which shall be respected when interpreting the Charter. In addition, as mentioned above, the CJEU tries to be in line with the ECtHR.

We can therefore conclude that a pronounced consensus among the Member States, not to allow for health-related FDP will also constitute a high barrier under Article 52(1) of the Charter for every state that wishes to introduce some kind of health-related genetic analysis for law enforcement. This mirrors the protection for genetic data in the context of forensics provided under the ECHR, but provides no additional protection.

V.D. Does Health-Related FDP Interfere with the Essence?

Even though the ECtHR mentions the essence of fundamental rights regularly in its case law, the notion does not figure explicitly in the ECHR.¹⁰⁸ There is ample literature on the concept of essence of rights and how it should be assessed.¹⁰⁹ Since in this article, it is admitted that the CJEU tends to stick to the absolute theory, I will not enter here into the discussion of the pros and cons of the relative and absolute theories. The absolute theory of the essence of fundamental rights assumes that every such right has an inviolable core that is not up for balancing. The barriers are high for the assumption of an interference with the essence; consequently, the CJEU does not often assume such an interference. It did so in the past mainly for procedural rights, such as the right to effective remedy in Article 47 or the right to be heard in Article 41(2)a of the Charter.¹¹⁰ It is relatively straightforward to determine the essence in those cases: if there is strictly no possibility to file an appeal, the right for effective remedy itself ceases to exist and the essence of the right is therefore compromised as well.¹¹¹ It appears much more difficult to define the essence of such a broad concept like privacy. In Schrems, the CJEU saw the essence of the respect for private life protected under Article 7 of the Charter compromised, because people were in an untargeted and very broad manner ‘completely stripped of their privacy’¹¹²:

legislation permitting the public authorities to have access on a generalized basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life, as guaranteed by Article 7 of the Charter ¹¹³

The famous case of Schrems is to date the only one in which the court assumed an interference with the essence of Article 7. Brkan noted that ‘the actual essence of each fundamental right can be determined only in its application’, highlighting the difficulty to predict judgments of the court in a merely abstract way.¹¹⁴ It is therefore difficult to make a prognosis, whether the court would consider health-related FDP also as interfering with the essence, as suggested by Zöller and Thörnich when stating that such a genetic analysis would infringe on the ‘core area of personality’.¹¹⁵

Nevertheless, I would like to make an attempt by defining which elements of health-related FDP could in theory violate the essence of Article 7 of the Charter. As Lenaerts states, the essence of a right cannot be compromised if only some aspects of a fundamental right are limited or if the limitations are only under certain conditions applying to a specific person.¹¹⁶ Some specific aspects of data protection defined in the LED, such as access to data or data controller obligations could be realized for health-related FDP by carefully drafted laws. However, what might be seriously at stake right from the beginning is the concept of ‘data control’ or also referred to as ‘informational self-determination’.

Just as ‘essence’ the concept of ‘informational self-determination’ originates from the principle of human dignity in the German constitutional law.¹¹⁷ The German Constitutional Court saw the principal reason to acknowledge this right to ‘informational self-determination’ in a right for an undisturbed development of the personality. Recital 7 of the GDPR says, ‘Natural persons should have control of their own personal data’, thereby incorporating this concept in the European data protection framework.¹¹⁸ In a judgement from the year 1989, the German Constitutional Court made an attempt to define the ‘core area of private life’. It mentions two conditions that have to be fulfilled, before data could be considered as located in this core area: First, the will of the data subject to keep this data private. Second, the data has to be intimately personal, as to not in connection with others or the society in general.¹¹⁹ Both conditions will most likely be fulfilled for health-related forensic genetic data.

By investigating into the genome, revealing sensitive information most likely not previously known to the data subject and with no chance for him or her to control on this process of data generation and subsequent usage, the will of that person and her right to informational self-determination is not only overwritten, but completely ignored. The concerned individual has absolutely no possibility to intervene, since the DNA sample for FDP is not taken from the data subject itself. Once knowledge about the genetic makeup of the individual has been gathered, it cannot just be completely erased afterwards. Therefore, the ignorance of consent can also not be healed in a later stage of the investigation. The concerned person can partially gain back control of their data only after all the testing has already been done. In this respect, it seems like the data subject is treated as a mere object to the goal of elucidating a crime.¹²⁰ It also has to be kept in mind that the analysis is conducted on a biological trace recovered at a crime scene. So the person who’s DNA is exploited in such a way might not even be the perpetrator.

Such an extensive deprivation of control might be considered acceptable for data with no larger relevance for the life of the concerned individual, such as a standard DNA profile, carrying no information relevant for someone’s personality, or for the revelation of the genetic grounds of obvious pigmentation traits or even for BGA.¹²¹ In contrast, it might not be acceptable for health-related data, because such data can have a huge impact on the personal development, if e.g. potentially life-threatening genetic variants are uncovered.

Therefore, health-related FDP has the potential to interfere with the essence of the right for privacy in Article 7 and the essence of the right for data protection in Article 8 of the Charter ‘as the individual is deprived of any meaningful control over the [data] processing, with a potentially detrimental impact.’¹²² However, predicting the jurisprudence of the CJEU on the matter in an abstract way might turn out to be not very reliable. We must therefore note that to date the legal framework of the European Union does not provide any clear guidance as to the permissibility of health-related FDP.

VI. CONCLUSION

Health-related FDP is a potential forensic tool particularly intrusive to the right to privacy as protected under the ECHR and the Charter of Fundamental Rights of the EU. As to now, there seems to be a consensus among the European governments that health-related FDP threatens the fundamental rights of natural persons too much, to be applied. Such a consensus could constitute a high hurdle for every EU member state or contracting state to the ECHR, willing to introduce legislation not in line with this prevailing view. However, we must keep in mind that most European countries do not have explicit legislation on the issue, what weakens the assumption of a strong consensus to some degree.

Proponents of health-related FDP may also have difficulties in demonstrating the required level of efficiency for the method. This must nevertheless be considered a relatively low hurdle. Even if a method proves useless in most of the cases in which it is applied, but helps to solve a single high-profile case, it might still be considered efficient enough.¹²³

It might therefore be advisable to regulate the scope of forensic genetic analysis at European level, e.g. within the LED. The LED has already been criticized in the literature, because its well-intentioned focus on data subject rights lacks efficacy in enabling individuals to exert the suggested control over their data.¹²⁴ Clearly delimiting the analytical scope of (genetic) data processing for law enforcement purposes would significantly strengthen the efficacy of the Directive at least in this point and augment transparency and predictability, not only for the European citizens, but also for the Member States drafting legislations for forensic genetics.