Online DNA Databases: The Beginning of the End of Genetic Privacy?
This article was written by Alexa Klein, 3L.
Most people hold a high expectation of privacy in their genetic makeup. However, the advent of technology allowing for the commercialization of DNA and the ability to look up someone’s genetic profile on the internet is making it increasingly difficult to keep our genes private.
S. 8 of the Charter protects the “biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state”. Traditionally, this right comes up during the search and seizure of homes and physical possessions, but more and more, it is coming up with regards to the search of electronic devices and online databases.
In the last few years, technological advances have made it possible for law enforcement agencies to connect DNA left by a person at a crime scene to the DNA profiles of that person’s relatives using online genetic databases (the likes of Ancestry, 23andMe, GEDmatch, FamilyTreeDNA, MyHeritage, etc.) in order to identify a suspect through their genetic relationships. This new investigative technique called investigative genealogy has been lauded as the greatest breakthrough in the field of criminal investigation since the advent of DNA profiling; the technique’s potential for solving cold cases is unprecedented. However, investigative genealogy raises serious privacy concerns when it comes to the accused’s Charter protected right to privacy.
Genetic Anonymity: A Thing of the Past
DNA has become big data: as a result of the sheer scale of genetic information now available on online databases, in a few years’ time, police will be able to identify virtually anyone of European descent through their DNA, regardless of whether or not they’ve ever taken a genetic test themselves before. In the United States, it is already possible for the police to identify at least 60% of all Americans of European descent through their DNA, and if a person is of European ancestry, the probability that they have a third cousin in an online genetic database the size of GEDmatch - the database that was used by police to identify the Golden State Killer - is close to 90%.
Privacy is a highly contextual and value laden concept; the reasonableness of a person’s expectation of privacy towards any given personally identifying information almost entirely depends on how easy it is for others to gain access to that information. It makes sense then that one’s expectation of privacy in their personal biometrics, especially in the context of police searches, has historically been very strong given how it went hand in hand with the preservation of one’s bodily integrity. However, the growing popularity of online genetic databases is changing this when it comes to DNA. Genetic anonymity and the ability to control the dissemination of the personally identifying biometric that is DNA will soon be a thing of the past.
It is becoming increasingly difficult if not impossible for many people to keep some of their genetic information private due to decisions beyond their control made by family members close or distant to share this information with online genetic databases. These family members are making what privacy experts call a “networked privacy decision”; their decision to trade their privacy for information on their genealogy effectively reduces the privacy of their whole family group.
Investigative Genealogy’s Impact on the Charter Right to be Secure Against Unreasonable Search or Seizure
Since a successful s. 8 informational privacy claim on the part of an accused relies on factors indicating a degree of control over the object of the search as well as a certain level of privacy of the object being searched, the de-anonymization of DNA occurring through online genetic databases is greatly jeopardizing the ability of anyone, but especially of persons accused of crimes, to claim a reasonable expectation of privacy in their DNA under s. 8 of the Charter.
I believe the Charter right of the accused to be secure against unreasonable search or seizure is soon to become obsolete when it comes to DNA. How can an accused expect to maintain and control from dissemination to the state their genetic profile when they have no control over the dissemination of their family members’ profiles?
In Canada, it is not possible or reasonable for an accused to expect to maintain and control from dissemination to the general public or to private companies the DNA of family members. Yet is it not reasonable to expect that this information is not disseminated to the state or the public in a completely unregulated manner?
We must question what it means for an accused to have a “reasonable expectation of privacy” in personally identifying biometrics in the age of big data, an age in which it seems privacy is increasingly being traded away for convenience and access to information.
Advances in technology should not have to lead society to lower their privacy standards, but rather governments to step up and regulate new technologies and their associated industries. Governments should set best practices and standards to impose on companies who run online genetic databases and encourage initiatives such as the Forensic Genetics Policy Initiative, which aims to set human rights standards for DNA databases around the world.
In the tech age of information, the s. 8 right to privacy should depend on the reasonableness standard being defined in accordance with value-based policies on what it is reasonable to want to keep private, not on what new technologies make possible or not to keep private.
 See Canadian Charter of Rights and Freedoms, s 8, Part I of the Constitution Act, 1982, being Schedule B to the Canada Act 1982 (UK), 1982, c 11 [Charter].  R v Plant,  3 SCR 281 at 293, 1993 CanLII 70.  See Christopher Sherrin et al, Criminal Procedure: Cases and Materials, 1st ed (Toronto: Emond, 2019) at 98.  R v Edwards,  1 SCR 128 at para 45, 1996 CanLII 255 [Edwards].  Ibid.