Genetic data

Genetic data means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question (Art. 4(13) GDPR). Recital 34 specifies that this includes chromosomal, DNA and RNA analysis and any other analysis enabling equivalent information to be obtained.

Genetic data is a special category of personal data under Art. 9. Processing requires an exception such as explicit consent or scientific research with appropriate safeguards (Art. 9(2)(j) and Art. 89), and Art. 9(4) expressly allows Member States to maintain further conditions, which many have done: France requires specific consent for genetic testing and restricts germline data use, Germany has the Gendiagnostikgesetz, and several countries regulate biobanks separately.

Genetic data has three features that make it particularly sensitive: it is intrinsically identifying and essentially impossible to anonymise once whole-genome sequences are involved; it reveals information about biological relatives who have not consented; and it may predict future health, with implications for insurance and employment. Genomic sub-studies in clinical trials, biobanking for future research, pharmacogenomics and direct-to-consumer testing therefore demand a dedicated DPIA, tiered consent, strict access governance and careful framing of incidental findings and re-contact.