The development of forensic genetics and the creation of DNA databases for human identification are highly useful tools in criminal investigations; however, the protection of fundamental rights must establish inalienable limits in the application of these advances.
Law 78/2015 in Kuwait, passed recently, is the first in the world which includes the requirement that all citizens, residents and visitors must provide DNA samples to the authorities to be included in the police database in order to cooperate with the Ministry of Interior.
This paper studies the characteristics of the DNA regions that are included in the databases and the fundamental rights that may be affected in the process, using Spanish Law as a reference framework. Finally, it analyses Kuwait's DNA law and its implications.
El desarrollo de la genética forense y la creación de bases de datos de ADN para la identificación humana constituyen herramientas de gran utilidad en la investigación criminal. Sin embargo, la protección de los derechos fundamentales debe establecer límites intraspasables en el ámbito de aplicación de estos avances.
La Ley 78/2015 de Kuwait, recientemente aprobada, es la primera en el mundo que recoge la obligación de que todos los ciudadanos, residentes y visitantes del país proporcionen muestras de ADN a las autoridades para que sean incluidos en la base de datos policial con el fin de colaborar con el Ministerio de Interior.
En el presente trabajo se analizan las características de las regiones del ADN que se incluyen en las bases de datos y los derechos fundamentales que se pueden ver afectados en el proceso, empleando como marco la legislación española al respecto, para finalizar estudiando la ley de Kuwait y sus implicaciones.
Scientific and technological advances entail the need for ethical reflection and legal regulation. Advances in forensic genetics, a branch of forensic medicine whose mission is to manage genetic knowledge to assist in solving civil and criminal cases, require a deep reflection of the need to protect the fundamental rights of individuals, as not all available means can be used when studying crimes, even when investigating particularly serious ones.
The motivation for writing this paper came from the recently adopted Kuwaiti Act No 78/2015, the first piece of legislation in the world to incorporate the obligation for all citizens, residents and visitors to the country to provide the authorities with DNA samples to be entered in the police database for the purposes of control and collaboration with the Ministry of Interior.
This article introduces basic concepts of forensic genetics and analyses the fundamental rights violated when a genetic profile is entered into a DNA database. The analysis is set within the context of Spanish legislation and examines Kuwait's new law, providing a deep reflection by comparing it to certain measures, relating to forensic DNA databases, being taken in other European countries.
Forensic genetics: DNA regions that are of interest to human identificationThe DNA of humans is 99.5% identical. Genetic differences, i.e., variable regions (“polymorphic”) that distinguish some individuals from others,1 and whose analysis is a tool for solving civil and criminal cases, are found in the remaining 0.5%. Forensic genetics is based on these regions.
To identify individuals, genetic markers that are found in noncoding DNA regions (areas that do not encode amino acids do not intervene in the formation of proteins) are studied, the genetic inheritance of which can be traced across generations. As noncoding DNA is not subject to intense selective pressure, it allows for high levels of variation. In order for a locus (specific position of the chromosome) to be considered useful in human identification, the most common allele for that locus (called allele for each variant of a given locus) must have a frequency below 99%.
The different alleles of a locus, i.e., polymorphisms, can comprise various types: from the mutation of a single base to the change in the number of tandem repeats of a group of nucleotides in certain regions of the DNA.
Tandem repeat DNA is that most frequently used in forensics, in particular microsatellites, which can be identified as they have a large number of easily distinguishable variants determined by the number of repeats. By analysing microsatellites, it is possible to obtain results from a tiny amount of sample and from very old biological remains. In addition, they are neutral; i.e., they do not present a natural selection that either enhances or hinders their inheritance. DNA microsatellite repeats are small in size (2–6 base pairs) and are called “short tandem repeats” (STR). The total size of the regions containing an STR is usually 50–500 base pairs.2
STRs are located on both autosomal and sex chromosomes. However, those located on autosomal chromosomes are mostly used to solve both civil and criminal cases (those located on sex chromosomes are complementary markers in routine cases and fundamental in specific studies. For instance, the study of markers of the Y chromosome is highly useful in sexual assault cases, while X chromosome polymorphisms allow for performing kinship analysis when the father is unavailable and the offspring are female). Autosomal DNA is also the preferred tool in forensic databases.3
Forensic databasesCouncil of Europe Resolution of 9 June 1997 on the exchange of DNA analysis results (97/C 193/02)4 invites Member States “to consider establishing national DNA databases … [built up] in accordance with the same standards and in a compatible manner”. It specifies that “the possibility of exchange shall be limited to exchanging data from the non-coding part of the DNA molecule, which can be assumed not to contain information about specific hereditary qualities”. It also urges Member States “to build up DNA analysis results preferably using the same DNA markers”, “with a view to exchanging DNA analysis results at European level”. The Resolution allows each Member State “to decide on the conditions under which, and the offences regarding which, the DNA analysis results may be stored in a national database”.
The first forensic database was created in 1995 in the United Kingdom, and the enormous interest aroused by its usefulness in solving criminal cases led to the development of specific legislation in several countries in order to provide legal support to the creation of human identification databases. In Spain, Organic Law 10/20075 of 8 October, regulating the police database on identifiers obtained from DNA, set out the procedure for creating a forensic database and specified that its purpose was to investigate crimes, identify body remains and obtain information on missing persons. It also set out the cases in which individuals could be included in the database, requiring crimes to be serious in nature and “in general, those that affect life, liberty, sexual integrity or freedom, integrity of the person or property as long as force is used against the property in question, or violence against or intimidation of people, including cases of organised crime, which should be understood to include, in any case, the term organised crime as provided for in Article 282 bis(4) of the Law on Criminal Procedure in relation to the enumerated crimes” (Article 3.1).
Numerous interoperable systems have now been developed to meet Spain's international commitments6 concerning data exchange with European countries for cross-border cooperation in the fight against terrorism, serious crimes and illegal immigration (Prüm Convention).7
Fundamental rights and human genetic identification databasesAlthough Organic Law 10/2007 of 8 October, regulating the police database on identifiers obtained from DNA,5 notes that technical advances allow for collecting only identifiable data from a DNA sample in a manner that is swift, economical and “barely limiting citizens’ rights”, and the forensic use of DNA has undoubtedly been a major step forward in solving criminal cases, it is necessary to reflect on the potential interference with an individual's fundamental rights by obtaining, reading and storing the information acquired from his/her DNA sample.
Professor Soleto describes how many fundamental rights can be affected, starting from the collection of the DNA sample to its entry in police databases.8 In an initial phase, when the sample is taken, the right to bodily privacy and physical integrity could be violated. In the second phase, when the genetic profile is entered in the database, the rights to genetic privacy and personal data protection or informational self-determination could be at risk.9 The right to privacy could also be separated into the right to personal and family privacy and the right against the incrimination of relatives.
Right to physical integrityThe right to physical integrity is one of the fundamental rights recognised by the Spanish Constitution. This right is found in article one of section one in chapter II of title I (articles 15–29), a section that is the core of the constitutional declaration of rights; i.e., where the most relevant rights—those with the highest level of legal protection (Articles 53, 81 and 168)—can be found.10 The Universal Declaration of Human Rights of 10 December 1948 does not expressly mention the right to the integrity of the person, but it does so in its guarantees. On 16 December 1966, the United Nations General Assembly adopted the International Covenant on Civil and Political Rights (ICCPR), thus strengthening the Universal Declaration of Human Rights, which recognises the right to protect physical integrity.
Article 3 of the Charter of Fundamental Rights of the European Union also expressly refers to the right to the integrity of the person.
At present, the most common procedure for taking a sample for the subsequent analysis of genetic markers of forensic interest is a buccal swab. As such, the right to physical privacy would be affected the most by such a procedure rather than the right to physical integrity. Previously, when DNA extraction and sequencing technology was not as developed and, thus, a blood sample was required for these purposes, the right to physical integrity was affected.
Right to privacyPrivacy is an inherent human right which derives directly from human dignity and has been shaped by a progressive transformation that has affected its legal structure and its material scope of protection.11
The right to personal and family privacy is a fundamental constitutional right (Article 18.1). Indeed, it is emphasised in the Spanish Constitution to such an extent that Article 20(4) expressly provides that respect for such right constitutes a limit to the exercise of the freedom of expression, which the Constitution itself recognises and protects as a fundamental right.
Organic Law 1/1982 of 5 May was drafted in accordance with Article 81.1 of the Spanish Constitution, which establishes that organic laws must guarantee human rights.12 Article 1 of Organic Law 1/1982 provides for the civil protection of fundamental rights to reputation, personal and family privacy and one's own image against all sorts of illegal interference or intrusion.
Right to genetic privacyThe right to genetic privacy is recognised in the context of biotechnological advances made since the end of the twentieth century, and it is understood as the right to set the conditions of access to genetic information,13 the individual's power over their genetic data and over information obtained from the processing thereof.
Some authors argue that the right to genetic privacy would be at a greater risk of potential violations when analysing an individual's genetic profile.14
However, it is important to consider the difference between the information contained in genetic-health databases and in forensic databases: in the former, there is no doubt that the right to genetic privacy may be affected, whereas this is not the case in the latter.
Clinical banks mostly study coding DNA regions for mutations or specific characteristics in genes. The objectives of banks of this type include: perfecting genetic diagnosis so as to make it feasible even before the patient manifests any symptoms; identifying carriers of hereditary genetic disorders; identifying people at risk of contracting or transmitting a disease; finding potential organ donors; and, in the current context of development of precision medicine, predicting the behaviour of drugs in specific individuals to customise treatments.15,16
Genetic data containing information about an individual's health and, in certain cases, biologically related persons are categorised as “sensitive data” owing to their potential intrusion into the individual's privacy and the risk of discriminatory practices arising from the use thereof.17
Organic Law 5/1992 of 29 October, regulating the automatic processing of personal data,18 identifies as sensitive data: ideology, religious beliefs, race, health and sexual life. The enhanced protection of these data is determined by the fact that they are only to be available with the express written consent of the person concerned. An express legal authorisation is also contemplated in the case of race, health and sexual life, but this must be based on reasons of public interest.
The ruling of the Spanish Constitutional Court No 232/1993 of 12 July 199319 noted the particular impact of medical information, especially those relating to poor health, on the “irreducible scope of privacy”.
In turn, the regions entered in forensic databases are non-coding and there is a debate on whether the right to genetic privacy is violated, given that it has been stated that in certain contexts their study does not affect fundamental rights as they do not contain private information. It is worth noting that the differentiation between coding and noncoding DNA is controversial in relation to human rights, particularly genetic privacy. Certain loci are located in coding regions that are physically close to loci that encode a particular phenotype and may reveal the same information as a coding locus due to linkage disequilibrium (the trait of some genes not to segregate independently), and are therefore sensitive data.20,21 Qualifying the data collected as “noncoding DNA” should therefore not be a sufficient argument to defend the non-infringement of the right to genetic privacy.20,21
An analysis of different rulings made by Prosecutor Rodríguez Caro22 highlights the interpretation of the violation of this right by the Supreme Court of Spain in ruling No° 734/2014, of 11 November, which states that “there may be a certain trivialisation of the legal scope of the corresponding interventions, from the point of view of the rights of the person concerned”. The ruling indicates that despite the simplicity and relative innocuousness of the way the material necessary to determine DNA is accessed, DNA itself “contains genetic information of extraordinary breadth and a wealth of personal data, which is what makes it an area worthy of maximum protection”, and compares DNA to one's home; i.e., “a sacred space for the exercise of privacy”. The judges also state that, despite the innocuousness of the means currently used for sampling, the mouth is a cavity of the body that is kept hidden from third parties, and in which outside interference is only consented to for therapeutic purposes, thus rendering it an intimate bastion of the subject.
The content of the right to genetic privacy must be understood as consisting of 2 parts: one objective and the other subjective.13 The objective element of this right is understood by viewing its origin as deriving from the right to bodily privacy, while the subjective element is the subject's will to determine who can access information about his/her genome and under what conditions, which results in a new right: informational self-determination.
Right to family privacy and against the incrimination of relativesAs explained above, polymorphic microsatellites (STRs) located in autosomal DNA are the most commonly used markers for determining a genetic profile and are those entered in forensic DNA databases (consensus on amplified loci exists at European level in order to exchange information among countries in specific situations where collaboration is required). These markers respond to simple Mendelian inheritance patterns, which implies that each of the marker alleles is transmitted by a parent. Therefore, from a genetic profile of interest, such as an unknown sample (unknown origin) located at a crime scene, we can create a filter of existing genetic profiles in the database on the basis of the number of alleles they share. If no complete agreement exists with any allele, in relation to similarity, we can study levels of kinship between the individual to which the sample belongs and other previously identified persons found in the database.
It should be noted that although Spanish legislation does not currently provide for kinship analysis in DNA databases,5 in other European countries such analysis is legal and is routinely carried out owing to its usefulness in police investigations. In Spain, there is an ongoing debate about the possibility of approving the use of this type of analysis in specific investigations. The 2012 report from the Spanish National Commission for the Forensic Use of DNA (CNUFADN) includes a technical report on familial searching in criminal investigations, concluding that “familial searching can be a valuable tool in investigating criminal evidence, provided all other avenues of investigation have been exhausted and familial searching is used with due guarantees so that rights violations are kept to a minimum”.23
However, caution should be exercised when using familial searching because, as García et al.3 explain, the privacy of an individual entered in the DNA database would be violated when disclosing to family members that a relative of theirs is in the database. In addition, individuals whose genetic profile is in a database would expose their family members to scrutiny without their knowledge and without their consent, and information on unknown family ties (adoption, adultery, illegitimate children, etc.) may be revealed.
Right to informational self-determinationArticle 18(4) of the Spanish Constitution expressly includes the right to personal data protection or the right to informational self-determination (“the law shall limit the use of information technology to ensure citizens’ personal and family reputation and privacy and the full exercise of their rights”) and refers to the control the individual must have over information that is personal, immutable and of great importance, such as their genetic information. In many cases, this right is a result of the recognition of other rights, such as physical self-determination or the right to personal identity.24
A few decades ago, a doctrinal and jurisprudential debate arose at European level around the need to delimit this right. It was understood as a positive manifestation of the right to privacy.25 Nowadays some authors are opposed to recognising it as an autonomous right based on the concept of fundamental rights as versatile entities that are open to societal advances and changes.26,27 Thus López Ortega considers the differentiation between the right to genetic privacy and informational self-determination as “sterile and artificial”. He believes that, starting from the process of taking the sample of a suspect to its entry into a police database for comparison, there are different phases, each of which affects a specific aspect of the same right; i.e., the right to privacy. Specifically, “bodily privacy when obtaining the sample, genetic privacy when extracting the DNA profile, and informational self-determination when entering identification data in a police database”.15
However, the ruling of 15 December 1983 of the German Constitutional Court conceptually and legally delimited the right to informational self-determination as an autonomous right that draws from the right to free development of personality the power of disposition that all individuals have on their own data, applying this to all aspects of their processing. The individual must be the owner of his/her personal data and dispose of them freely.25
In the same vein, the Spanish Constitutional Court expressed its view of informational self-determination as a new fundamental right in its rulings No 290/2000 and 292/2000, both of 30 November, when stating that even though privacy and the right to informational self-determination share the objective of providing an effective constitutional protection of personal and family private life, there are differences between the defensive and narrow scope of the private sphere of the right to privacy and the more active and global scope of the right to informational self-determination.28
Analysis of Kuwaiti Act 78/2015 on genetic analysis of human population identificationAfter analysing the human rights affected, starting from the taking of a DNA sample to including the genetic profile in a database, we proceed to examine Kuwait's new law on forensic databases, comparing some of its aspects with those of laws adopted in countries more similar to ours.
Content of Kuwaiti law analysed in the context of human rightsAct 78/2015,29 adopted in Kuwait and published on 2 August 2015, states that all citizens, residents and visitors to the country must provide DNA samples to the authorities. Article 8 establishes a penalty of one year imprisonment and a fine of 10,000 Kuwaiti dinars (KWD) (around 30,000 euros) for any person who deliberately and without justification refuses to cooperate. Article 4 sets out the obligatory nature of the measure, stating that people cannot refuse to give a biological sample, within the established time period, when asked to do so by the competent authorities.
This law forms part of the anti-terrorism legal framework and, in theory, is a response to the terrorist attack that took place on 26 June 2015 at the Shiite Imam al-Sadiq mosque in the Kuwaiti capital, killing 27 people and seriously injuring 227.
The objectives pursued by collecting DNA from the entire population are set out in Article 5, which expresses the collection's usefulness in solving cases to identify the perpetrators of crimes and connect crimes committed by the same individual, to identify potential suspects and their relatives, and to identify body remains. The final point of Article 5 states that the samples will also be used for any other situation required by “the country's supreme interest or that of the competent investigative authorities of a particular case”.
It should be noted that the law does not consider minors separately, so it is assumed that their profile will also be included (Article 4 states that no one may refrain from cooperating). Moreover, the law does not specify how long the genetic profiles of visitors and tourists are to remain in the database, nor does it describe any procedures for the destruction thereof.
Implications of this lawThe entry of the genetic profiles of all citizens and residents of Kuwait in the police database, as well as the penalty and fine established for those who do not cooperate, does not comply with the principle of proportionality, neither in the scope nor the scale of the penalty. This principle was initially set out in the area of Criminal Law—in the French Declaration of Rights of Man and Citizen of 1789—and, in summary, it explains that the law should not establish penalties other than those strictly and obviously necessary. In the nineteenth century, this principle was developed by recognising a series of rights that limit the State's exercise of police power so as to protect individual legal areas.30 Proportionality in terms of Spanish constitutional jurisprudence acts as a criterion for determining the content of fundamental rights, which is binding for public authorities.
By providing that samples can be used for any required situation, Article 5 of the Kuwaiti law also leaves the door open for the authorities to make use of this information for any arbitrary purpose, which would violate the principle of legality; in particular, the likely use of this database to “unmask” citizens claiming to belong to certain dynasties, or to resolve disputes over citizenship rights (in Kuwait citizenship is only recognised directly for individuals who descend from original citizens; i.e., those that were settled in the country prior to 1920). Thus, after curtailing the right to genetic privacy and informational self-determination, it would ultimately encourage the discrimination already existing in the country. Alkarama, an independent human rights organisation based in Geneva and created to act as a bridge between individual victims in the Arab world and international human rights mechanisms, points out that the Kuwaiti government uses, among other measures, the withdrawal of citizen status as punishment for political opponents and dissidents.31 It also alleges that this law constitutes a violation of the right to privacy enshrined in Article 17 of the International Covenant on Civil and Political Rights, to which Kuwait is a signatory, and shows the need for its prompt revocation.
While Kuwait has so far been the only state with such a law (although the limitations vary both globally and among the nations of the European Union, most developed countries have opted for moderation in their legislation, establishing rules to preserve the right to privacy),9 it seems that it could set a dangerous precedent in international law.
The International Declaration on Human Genetic Data, adopted at UNESCO'S 32nd General Conference on 16 October 2003, after taking into account that the “collection, processing, use and storage of human genetic data … shall be consistent with the international law of human rights”, sets out the principles which should guide States in the formulation of their legislation and their policies on these issues”. More specifically, Article 1 provides that the aims of the Declaration are to: “ensure the respect of human dignity and protection of human rights and fundamental freedoms in the collection, processing, use and storage of human genetic data … in keeping with the requirements of equality, justice and solidarity”.32
The United Nations has already rejected the entry into force of the Kuwaiti law. After independently reviewing the law, a panel of 18 experts stated that the measures taken were disproportionate and could violate the right to privacy, underlining the need to respect citizens’ civil and political rights. In 2016, the panel asked Kuwait to amend the law, stating that only mandatory genetic tests should be carried out with a court order on individuals suspected of having committed serious crimes. Among the main concerns raised by this law, the panel focused on the mandatory and widespread nature of DNA testing, the broad powers granted to authorities and the Ministry of Interior to obtain and use DNA samples (e.g., “in any other case required by the country's supreme interest on the matter”), the lack of clarity as to whether the law includes the safeguards necessary to ensure confidentiality and prevent the arbitrary use of the DNA samples obtained, the absence of independent monitoring, and the impossibility of challenging the law before an independent court.33
European perspectiveIn the European Union, the creation of such a database would be considered illegal. As early as 2008, the European Court of Human Rights issued a ruling in this regard, finding that the systematic and indiscriminate storage by public authorities of DNA profiles of non-convicted persons violated Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms.34
However, a paper by Etxeberria Guridi on regulatory developments in Europe in relation to DNA profiling banks explains that although the initial legal outlook on the use of DNA had a relatively small scope, precisely because of its impact on fundamental rights, the current trend in most of our legal systems lessens the role of the judiciary in favour of the Public Prosecutor's Office and, above all, the police.35
Today many countries (e.g., the Netherlands, UK, France, USA and Australia) allow under certain conditions (or simply because no specific legislation exists in this regard) kinship analysis using profiles included in their police databases. In Spain, as mentioned above, such analysis is not legal, but the likelihood of permitting it in specific cases is being debated. As such, it seems necessary to ask what distinguishes these practices, which are allowing numerous criminal cases to be solved, from typifying the entire population.3
The CNUFADN states that, from a legal and bioethical perspective, indirect familial searching poses problems indicating that “the results of searching for DNA compatibilities may lead to a set of innocent candidates whose privacy and confidentiality may be affected by being investigated simply because they are relatives of an accused.”23
If, at the moment when an anonymous profile is entered in the database, the system can alert that it belongs to a relative of someone whose profile is already entered, then that person's rights would be diminished simply by being related to another individual who has violated the law. The moment familial searching in forensic databases is permitted, genetic identification data of innocent persons are indirectly included and the principles of equality and non-discrimination are violated.
ConclusionsAdvances in forensic genetics and the creation of DNA police databases are highly useful tools in crime investigation. However, not all means available in criminal investigation can be used, while national and international laws should be responsible for setting out limits for respecting fundamental rights.
The new Kuwaiti law forces its citizens, residents and visitors to cooperate in the creation of a database containing the genetic profile of the entire population. This law violates the principle of proportionality, the right to privacy and informational self-determination and, in the context of Kuwait's immigration laws, it may also encourage discrimination.
Although the Kuwaiti case is an isolated situation, and is being denounced by many international organisations, it forces us to reflect on the regulations relating to the forensic databases of Spain and its neighbouring countries. It also encourages us to look at different legal measures taken by European countries, such as the identification of suspects via familial searching of a DNA database, as they could establish an initial step towards the new reality set out by the Kuwaiti law.
Conflicts of interestThe authors declare that there are no conflicts of interest.
Please cite this article as: Santurtún A, Lema C, Zarrabeitia MT. Derechos fundamentales en el contexto de las bases de datos forenses: Revisión y análisis de la Ley 78/2015 de Kuwait. Rev Esp Med Legal. 2017;43:79–86.