Are genetic data of unborn children subject to data protection under the GDPR?
In the year where the General Data Protection Regulation (GDPR) has come into a force, and as genomic science and prenatal testing techniques quickly progress, the question on whether or not genetic data of unborn children can afford data protection rights has come (back) to consideration.
In many situations where women are participating in a clinical trial it is interesting and crucial to know what can be done with genetic and medical data referring to the fetus. Indeed, the way the unborn child is affected by the treatment is something of interest for the research, as it will bring new variables to the research.
The issue has actually been discussed long before the GDPR had been adopted, when the Council of Europe issued the Recommendation No R (97) 5 on the protection of medical data, where it expressly provided for guidelines on the use of medical data of unborn children. It was, in particular, recommended to consider medical data of unborn children as if they were enjoying the same protection as medical data of a minor (e.g. by considering such personal data being of the mother and proposing the latter as the person acting on behalf of the unborn child, as the data subject). While the Recommendation is not binding, it can be mentioned that some countries have introduced the practice of considering prenatally obtained child’s data as the mother’s personal data since they fall into the mother’s medical files.
The Art. 29 Working Party (WP29) in its Opinion 4/2007, when stating that only living persons fall within the scope of the definition of “natural person” of the Directive 95/46, also discussed data of unborn children as one of the grey areas, together with the data of deceased persons. In this respect, the WP29 stated that whether or not data protection rules apply before birth, depends on Member States’ legal provisions with regards as to when the capacity to be subject to legal relationships starts (passive legal capacity). Indeed, many Member States do have the concept of “nasciturus” in their legal systems, pursuant to which, children conceived but not yet born can have passive legal capacity (among others in respects of inheritance or donation rights), on the condition that they are later on born alive.
As for the GDPR, while Recital 27 clearly leaves the data of deceased persons out of the scope of “personal data”, it does not explicitly exclude unborn children data. This could on one hand be seen as if the definition of “natural persons” was covering only living persons. On the other hand, the explicit exclusion of deceased persons data and the lack of such an explicit exclusion for unborn children data, could as well lead us to think that personal data of unborn children are not excluded from the scope of GDPR. Moreover, the GDPR does not explicitly state that natural persons shall mean living persons and thus seems to only partially confirm what stated by the WP29 in the abovementioned Opinion.
To sum up, in spite of the issue being already discussed in the past, the GDPR does not explicitly provide for the protection of personal data of unborn children, nor it excludes it specifically, as it does for deceased persons data. Consequently, the topic seems to be left open for future interpretation, both at national level by Member States’ and at EU level by the European Court of Justice.
Meanwhile awaiting further guidance, better to be safe than sorry: medical and genetic data of unborn children, should be treated as being personal data relating to the mother, as they are also able to reveal her health conditions. Once the child is born alive, such data will be treated as personal data of a minor.
Sources:
- WP 136, Opinion 4/2007, adopted on June 20th 2007, https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2007/wp136_en.pdf
- Pormeister, K. , & Drożdżowski, Ł., Protecting the Genetic Data of Unborn Children, European Data Protection Law Review, Volume 4, Issue 1 (2018) 53-64, https://doi.org/10.21552/edpl/2018/1/8
- Council of Europe, Recommendation R (97) 5 of the Committee of Ministers to Member States on the Protection of Medical Data on the Protection of Medical Data, 13 February 1997 (Recommendation) https://rm.coe.int/16806af967
- Cooper D. Re-defining “personal data” – can the opinion live up to the hype?, Data Protection Ireland, Volume 3, Issue 6, pp. 7-10 https://www.cov.com/~/media/files/corporate/publications/2010/11/redefining-personal-data—can-the-opinion-live-up-to-the-hype.pdf
