key: cord-0853185-70x9s4l6 authors: Tuazon, Oliver M title: Universal forensic DNA databases: acceptable or illegal under the European Court of Human Rights regime? date: 2021-06-25 journal: J Law Biosci DOI: 10.1093/jlb/lsab022 sha: 7355735df8d7437c101384c62813b6d505945656 doc_id: 853185 cord_uid: 70x9s4l6 Universal forensic DNA databases are controversial privacy-wise given their omnibus scope of incorporating DNA profile data of the entire population into the system. Following the landmark decision of the European Court of Human Rights on the retention of DNA profiles in S. and Marper v. the United Kingdom, two differing opinions emerged on its application to universal databases: their acceptability and illegality. This paper makes use of the elements of the right to respect for private life (Article 8 ECHR), distilled from the Court’s jurisprudence involving collection and retention of DNA profile data, in the form of tests—preliminary interference, legality, legitimate purpose, and proportionality—in assessing the feasibility of establishing population-wide DNA databases in Europe. Forensic DNA databases have become an integral component of criminal justice systems in many jurisdictions around the world since the successful application of DNA evidence in solving a double-murder case in England in the mid-1980s. 1 Existing forensic databases only contain DNA profiles of convicted felons, and to some extent, arrestees. 2 DNA databases that are used in criminal investigations and court proceedings are called 'forensic' DNA databases, as distinguished from 'medical' databases or biobanks. 3 When they include the entire population of a given country, they are called 'universal' forensic DNA databases. The word 'universal' can be substituted with any of the followings words to refer to the same database: 'population-wide', 'comprehensive', or 'compulsory' . For the sake of brevity, the phrase 'universal database' is used in this article to refer to the same concept. In 2003, the feasibility of a universal database was proposed for the first time. 4 These universal databases promise to yield greater investigative and deterrent capacity, reduce racial/ethnic polarization, 5 and in the presence of strict legal safeguards, even better privacy protection than the present DNA collection and retention regimes. 6 A renewed call for the creation of universal databases was made in 2018 with the challenge, 'Is it time for a universal genetic forensic database?' 7 The topic has become a subject of debate, especially in the United States, 8 and its theoretical application has been evaluated in Australia. 9 But there is a dearth of research about the topic in Europe, where it is treated almost as a taboo. When the European Court of Human Rights (ECtHR) 10 issued its landmark decision involving DNA profiles in S. and Marper v. the United Kingdom, 11 two opinions emerged as to its application to universal databases. One author claimed that 'a database of all citizens would be acceptable' 12 whereas another downrightly rejected universal databases as 'illegal' at least for Europe. 13 What is the real score? At the outset, two things are clear: first, the Court has not been asked to directly adjudicate on a case involving universal databases; 14 and second, a future case involving the retention of DNA profiles in universal databases will be evaluated under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), 15 also known as the right to respect private life. In Marper, the Court found a violation of the applicants' right to respect for private life based on the respondent state's practice of retaining DNA profiles of suspected but un-convicted individuals. More recently, the Court found a similar violation in retaining DNA profiles-in Gaughran v. the United Kingdom 16 and Trajkovski and Chipovski v. North Macedonia 17 -this time of convicted applicants. These cases demonstrate that the Court does not base its finding of a violation of the right to respect for private life on the conviction of the applicant. The common ratio decidendi for the violation refers to the lack of sufficient legal safeguards in the relevant national DNA database law. Can the same judicial reasoning be applied to a universal database, which includes the DNA profiles of all the citizens of a member state? The ECtHR has been consistent in affirming that the right to respect for private life is not an absolute right and that it is the Court's role to balance it with other legitimate rights of individuals (private interests) and society (public interests). 18 This article aims to determine on which scale the creation of universal databases would tilt using the elements employed by the ECtHR itself in adjudicating the presence or absence of a violation of the right to respect for private life, namely, the preliminary interference test, and the three main tests of legality, legitimate purpose, and proportionality. In the course of the analytical process, due consideration was given on whether legal safeguards could be formulated to allow the creation of universal forensic DNA databases following the ECtHR regime. 13 20 to which DNA profiles as protected personal data 21 have been included. 22 The main reason behind this classification is that DNA profiles contain 'substantial amounts of unique personal data', which can be used to detect possible 'genetic relationship[s]' among individuals-such as when familial or ethnic searching is employed-which the Court considers to be 'highly sensitive' . 23 The same reasoning can be easily transposed to universal databases because they are a collection of DNA profiles from the entire population. Hence, a future case on this subject will be clearly classified by the Court as protected personal data under the right to respect for private life (Article 8 ECHR). DNA profiles. 35 Would the same apply to universal databases? If the Court found an interference when samples from arrestees and convicts were collected, a fortiori, it is expected that the Court would find a stronger and more serious interference when samples are collected from the entire population. 36 Whether such serious infringement will pass judicial muster is determined through the three tests of legality, legitimate purpose, and proportionality in the succeeding sections. Before applying these tests to universal databases, this section educes a necessary legal safeguard on the collection of DNA profiles. The Court rulings imply that collection of DNA profiles of arrestees and their retention upon conviction may constitute a lawful interference to the right to privacy when sufficient safeguards are available. But why limit the coverage to convicts? The Court appears to be following the predictivist or recidivism theory, 37 that is, a person who has been convicted is more likely to commit other crimes in the future. 38 There are many predictors of crime engagement other than prior arrest and conviction. 43 A universal database does not preclude the detection of first-time offenders 44 who are obviously excluded from the current system. 45 If everyone's DNA profile is in the database, does it then make everyone a suspect? 46 Objectively, DNA profiles will only match the equivalent number of perpetrators in the crime scene. Non-involvement in a crime will not activate one's file in the database. 47 As the Court noted, inclusion in the database produces the benefit of 'rapid elimination' as a suspect in a crime under investigation. 48 . Solving this racial imbalance will create an environment of mutual respect knowing that crime scene samples will be screened over the entire population, regardless of color. In the United Kingdom, a concern was also had on the disproportionate number of black males in its DNA database; see author noted that a universal database 'could be used to identify otherwise missed first-time offenders and to render unnecessary discriminatory dragnets' . Note that she ultimately argued against universal databases as an infringement of the Fourth Amendment of the U.S. Constitution, id. at 1238. 46 On the argument that universal databases are indicative of an 'Orwellian society' , Kaye and Smith replied: ' As rhetoric, this is powerful stuff, but its substance is fluffier. Privacy is an important value, but the privacy threat from digital records of DNA types that reveal nothing about a person's nature or status is not selfevident . . . Indeed, a population-wide database should quickly limit the number of suspects-typically to a single person-in many crimes. By promptly eliminating everyone else as a viable suspect, it would reduce the burden on many individuals who would have been primary suspects.' See Kaye & Smith, supra note 4, at 446. 47 In effect, it provides a sense of security for the innocent who will automatically be eliminated from suspicion and be spared of tedious police investigations. Overall, a higher sense of equality and trust in society is established when-like in many other government data systems like passports, tax returns and driver's licenses-everyone is covered. There will be no discrimination based on one's color, race or creed. Smith argued that 'where the requirement to be included in the database applies equally to all citizens, no individual would be disadvantaged in relation to any other' , Smith, supra note 9, at 133. 48 W., ECtHR. See also Van screening tests 50 and passport and driver's license applications where fingerprints and other personal data are collected and stored. 51 Sample collection is even less invasive and intrusive compared to COVID-19 testing, which requires samples from both nose and throat, 52 whereas a cheek swab is enough for DNA profiling. These data gathering mechanisms are possible venues for universal database sample collection. 53 Compared to COVID-19 testing, which employs similar molecular diagnostic procedures, DNA profiling is less costly since only one sample is required. 54 Country-wide collection of samples for specific tests is not new. 55 Using economies of scale, the overall cost is expected to decline over time with mass sample collection. This would depend on the state's economic standing and its willingness to cover the cost or to charge it to its citizens. 56 DNA profiles in their simplest form are numerical figures that represent the variations of alleles found in each locus making them analogous to bar codes. 57 They only provide limited information necessary to identify an individual compared to cellular samples, which can be fresh sources of DNA for the generation of a lot more information, which may have deeper privacy repercussions, such as ethnic and familial tracing and predisposition to genetic diseases. Although the Court acknowledged the wealth of health and genetic information that can be generated from cellular samples-without acknowledging the same on DNA profiles-it afforded the same protection to both. 58 However, limiting sample collection to DNA profiles provides a sufficient safeguard for the protection of privacy given their narrower use for identification purposes. An appropriate legal safeguard would be to require the destruction of cellular samples and DNA extracts right after the production of DNA profiles. This safeguard will limit the seriousness of the interference to a set of numerical figures representing a person's DNA profile. 59 where DNA profiles may be classified: either as 'genetic data' or 'biometric data uniquely identifying a person' . 63 The processing of both data is not prohibited as long as 'appropriate safeguards' are provided in the enabling law. The Court in Marper referred 64 to the Data Protection Convention of 1981 (Convention 108). 65 Although the newer Convention 108+ was already effective during the promulgation of the Gaughran decision, 66 the Court continued to refer to the older Convention. 67 The ECtHR judges may need some updating on the prevailing law at the time of their decision and not merely make a blind reference to related but outdated paragraphs in its previous rulings. They would have enriched jurisprudence by making a classification of DNA profiles according to the terminologies of the updated law. 68 In any case, there is nothing in the updated legislation that directly prohibits the creation of universal databases. The specific provisions under Recommendation No. R (87) 15 69 on the use of personal data in the police sector that were made applicable in both Marper 70 and Gaughran 71 were Principles 2, 3 and 7 specifying the following safeguards: (1) collection is limited to what is necessary for 'the prevention of a real danger or the suppression of a specific criminal offence' (Principle 2); (2) storage is 'limited to accurate data and to such data as are necessary to allow police bodies to perform their lawful tasks' (Principle 3); and (3) personal data that are 'kept for police purposes are deleted if they are no longer necessary for the purposes for which they were stored' (Principle 7). Recommendation No. R (87) 15 does not prohibit universal databases as long as their use is limited to the purposes of their creation and the enumerated safeguards are in place. The more specific legal instrument concerning DNA analysis in the criminal justice system is Recommendation No. R (92) 1. 72 Marper highlighted provisions 3, 4 and 8 of the Recommendation, 73 while Gaughran only underscored provision 8. 74 In both cases, the said provisions do not prohibit the creation of universal databases as long as the following safeguards are in place: (1) their use is limited to the 'investigation and prosecution of criminal offence' or if they are used for research and statistical purposes, the identity of their sources cannot be ascertained (provision 3); (2) taking of samples is limited to what the domestic law provides (provision 4); and (3) data are deleted after their purpose has been achieved (provision 8). Overall, none of the existing legal instruments of the Council of Europe directly prohibit the creation and maintenance of universal databases. In measuring the quality of the law, its accessibility, clarity, foreseeability with respect to persons concerned are evaluated. 75 Accessibility of the law. There has been no case questioning the accessibility of the law before the ECtHR. Each member state has developed a system by which new laws are made accessible to all its citizens. This usually comes in the form of publication of the law in a manner specified by national practice. The same system of dissemination can be applied to universal databases. Clarity of the law. Clarity refers to the 'scope of discretion exercised by public authorities' when it comes to the implementation of the law. 76 There should be 'reasonable clarity' as to the 'scope and manner' of this discretion to provide people with 'minimum degree of protection' . 77 This can be measured through legal safeguards in the enabling universal database law to prevent arbitrariness on the part of law enforcers, thereby making the implementation of the law predictable to everyone concerned. 78 Sufficient foreseeability. In Petrović, the Court declared that the collection of DNA samples was not 'in accordance with the law' because the 'domestic legal provisions in question should, inter alia, have been "foreseeable as to [their] effects" for the applicant' . 79 The respondent state relied upon the law's 'other medical procedures' clause to justify DNA sample collection but the Court ruled that a 'specific reference . . . to the taking of a DNA sample' is necessary. 80 present in the law against arbitrary interferences by public authorities. 81 It must be sufficiently foreseeable such that the people concerned know the circumstances and conditions where authorities are entitled to take action on matters that affect their rights. 82 It must allow people to determine to a reasonable degree if they are covered by the law 83 and its provisions should be 'foreseeable as to their effects' 84 to the applicant. In universal databases with sufficient legal safeguards, it is clear that the entire population is covered. III.C. Legality, Identification and Police Investigative Practices 1. Identification Conundrum The Court understood correctly that DNA profiles are generated from DNA that is extracted from cellular samples. 85 While it acknowledged that the personal information they contain is 'more limited' and its information is in 'coded form', it claims that the automated processing of these data permit authorities to 'go well beyond neutral identification' . 86 The Court appears to be confusing the three meanings of identification as previously clarified by Kaye: 87 1. authentication-identification, where a person's identity is determined through a mark or token, like a DNA profile; 2. association-identification, where a known individual's DNA profile is associated with their profile in a database; and 3. trait-identification, where an individual's health, character, ethnicity, etc. are described. 88 It is the third meaning of identification that has 'much more serious implications for personal privacy', 89 and its confusion with the first two meanings is a cause of great fear as to the alleged privacy overreach of these databases. 90 The objections enumerated by the Court-such as the use of DNA profiles in familial searching 91 or in identifying a person's ethnic origins-belong to the meaning of trait-identification. Since DNA profiles are susceptible to automatic processing, and such data are used for criminal investigations by the police, 92 one legal safeguard is to limit their use to 81 authentication-and association-identification. 93 This safeguard removes the possibility of function creep, 94 prevents comparison with other datasets, 95 and it appears to provide even greater protection to informational privacy 96 compared to current practices in criminal investigations. When crime scene samples do not show a match in existing forensic databases, police officers tend to request for judicial warrants to compare their samples to other databases like those used for medical and health research. 97 A subpoena of medical records may also be requested-a practice that raises more privacy concerns 98 given the presence of other personal data in those medical files. 99 In the US, a cold case was resolved by the police using a private direct-to-consumer (DTC) genetic database. It has sparked privacy concerns over the use of non-governmental facilities for criminal investigations. 100 Universal databases entirely make these practices obsolete since everyone's DNA profile is already in the system. 93 The authors of the following article argue that there is no federal limit on the use of information from 3. Shed DNA and DNA Dragnets Universal databases would also deter the police practice of gathering 'shed DNA' 101 -DNA extracted from cellular material that a 'suspect' leaves behind 102 -which raises some privacy concerns. 103 This practice does not provide safeguards for suspects as it is mainly based on the prerogative of the investigator. Universal databases would also halt expensive, inefficient, and often racially biased 104 DNA dragnets-where members of a given population with defined characteristics in the area of a crime or its environs are sampled-as everyone is already in the database. Besides, police officers tend to obtain warrants to sample those who refuse to participate in these dragnet procedures 105a superfluity in the presence of universal databases. Hence, these current investigative practices that raise privacy concerns will be avoided. 106 The question on whether the impugned measure at issue serves a legitimate purpose has been the easiest to answer in the affirmative as can be deduced from the cases involving DNA profiles that have reached the Court. This test is rather straightforward: the impugned measure should fall within any of the aims enumerated in Article 8 § 2 of the Convention. These include the interests of national security, public safety or the economic well-being of the country, the prevention of disorder or crime, the protection of health or morals, and the protection of the rights and freedoms of others. 107 The standard Court practice is to be 'quite succinct when it verifies the existence of a legitimate aim' 108 within the meaning of Article 8 § 2 of the Convention. The burden falls upon the government to demonstrate that the interference is in pursuit of such legitimate aim. 109 All the cases involving DNA profiles have been classified under the legitimate aims of prevention of crime and protection of the rights and freedoms of others. 110 The Court noted that these legitimate aims stand even if the DNA ends up not playing a role in the criminal investigation. 111 The Court in Marper also acknowledged the importance of retaining DNA information for the identification of future offenders. 112 This reasoning was adapted recently in Gaughran in this wise: 113 'While the original taking of this information pursues the aim of linking a particular person to the particular crime of which he or she is suspected, its retention pursues the broader purpose of assisting in the identification of persons who may offend in the future.' 114 That statement is easily transposable to universal databases whose main objective is to assist in the identification of future offenders. A legal safeguard is to use them strictly for such purpose. As Lord Justice Sedley put it, they are 'for the absolutely rigorously restricted purpose of crime detection and prevention' . 115 The subsequent subsections illustrate this point. IV.B. Legitimate Purpose and Forensic Reporting 1. Accuracy of Forensic Reporting using DNA Profiles The current system of reporting DNA profile matches is in the form of random match probabilities and likelihood ratios. These are computed based on the statistical frequency of a given STR allele within the populations represented in the database. 116 While the statistical method employed is based on sound science, 117 it is primarily based on probabilities generated from a select portion of a given population. On the other hand, universal databases create a one-to-one correspondence with the sample being matched. Scientific reporting will no longer be based on match probability, 118 but on person-specific matches. A match to more than one person is extremely rare 119 but its eventuality would help further elucidate the accuracy of DNA profiling. 120 In any case, a double match would lead investigators to a more informed evaluation of the other pieces of evidence available to them. 121 Should there be no direct match, investigation may lead to persons outside the database population, such as foreigners. It effectively directs investigators and prosecutors to use their limited time, energy, and resources to investigative leads, which they would not have immediately discovered otherwise. Forensic reporting makes use of probability statements and statistical figures, which may confound the trier of fact. It has been shown that jurists do not have a proper understanding of likelihood ratios when presented with forensic reports 122 and that even forensic experts themselves make mistakes in their conclusions about DNA profile matches. 123 Forensic reports vary from one forensic laboratory to another and their impact may affect an acquittal or conviction. 124 An 'allegiance effect' has been shown where experts tend to assign more favorable reports to the side that retained them, either the prosecution or the defense. 125 These problems will be inexistent in a universal database system since its comprehensive coverage will generate person-specific matches, and not matches based on statistical probability. 126 The 'sole reason' 127 why the United Kingdom wanted to keep the DNA profiles in Marper was to increase the size and use of their database, that is, the bigger the population, the higher the chances of producing a match. 128 That argument no longer applies in a universal database because there is no need to increase the sample population to produce a more statistically sound result. 129 Moreover, there is no need to keep the profiles after death. 130 There is also no need to anonymize 131 DNA profiles so that they could be kept in the databases after acquittal or death 132 in order to increase the statistical valuation of the DNA match reports. A comprehensive database will make that exercise superfluous. It has been shown that some people tend to confess to a crime they did not commit, especially when police officers claim that their DNA profile matched with that of a crime scene sample. 133 The current system produces such matches based on the available profiles in the system, which are mainly from previously convicted individuals. The tendency of police officers to induce convicts to confess to a crime they did not commit-due to a supposed DNA profile match-will be reduced if not completely eliminated because matches in universal databases are actual matches, not probable matches. Universal databases will make everyone aware of how DNA profile matching works and can demand actual match reports from police investigators. The heightened awareness of how universal databases work increases the level of scientific culture of the population and lends more objectivity to criminal investigations-at least as far as DNA evidence is concerned-making them less prone to abuse. The final and most important test is the Court's way of measuring whether the impugned law is necessary in a democratic society. For an interference to be considered 'necessary in a democratic society', it has to answer a 'pressing social need', and in particular, it has to be 'proportionate' to the legitimate aim that is being pursued and the reasons for its justification are 'relevant and sufficient' . 134 The initial assessment as to the existence of a 'pressing social need' is a function of the member states given their margin of appreciation subject to the final review of the Court. 135 Following previous case law, Gaughran affirmed that the 'breadth of this margin varies and depends on a number of factors, including the nature of the Convention right in issue, its importance for the individual, the nature of the interference and the object pursued by the interference' . 136 Further, this margin tends to be 'narrower where the right at stake is crucial to the individual's effective enjoyment of intimate or key rights' and where 'a particularly important facet of an individual's existence or identity is at stake, the margin allowed to the State will be restricted' . 137 The Court considers that 'personal data is of fundamental importance to a person's enjoyment of their right to respect for private and family life.' 138 It follows that for universal databases, the margin of appreciation afforded to member states is restricted. 139 There is one window where this margin could be wider: when 'there is no consensus within the member States of the Council of Europe, either as to the relative importance of the interest at stake or as to how best to protect it' . 140 At this point, it is difficult to predict the presence or absence of consensus for universal databases in Europe. 141 But if one extrapolates it from recent ECtHR case law on mere retention of DNA profiles of convicted persons, the margin of appreciation would still be narrow. 142 In the two major ECtHR cases concerning DNA profile retention where both convicted and un-convicted applicants are involved, 143 the Court found a violation of the applicants' right to respect for private life mainly because the applicable laws did not provide sufficient safeguards for the protection of such right. On the other hand, in Martens, the Court found a 'proportionate interference' to the said right due to the presence of sufficient safeguards in the domestic law. 144 In the enabling legislation for universal databases, the provision for sufficient safeguards is crucial to show the existence of a fair balance 145 between competing public and private interests. 146 DNA profile retention in databases is argued to be violative of a person's right to presumption of innocence. 147 Corollary to that right, the retention of DNA data of un-convicted suspects was thought to expose them to the risk of stigmatization. 148 In Gaughran, the Court underlined that the risk of stigmatization is 'not the same' for convicted persons although the margin of appreciation for the retention of their DNA profiles remains to be narrow. 149 The Court earlier ruled in Rushiti that no suspicion regarding the innocence of the accused may be voiced after their acquittal. 150 This includes the perception that they are not being treated as innocent due to the indefinite retention of their data. 151 In Gaughran, the prohibition against indefinite retention of DNA profile data was extended to convicts in the absence of specific retention criteria in the domestic law. 152 Universal databases uphold everyone's presumption of innocence because inclusion in the database would no longer amount to suspicion of commission of a crime. Consequently, any risk of stigmatization will be inapplicable when the law treats each one in the same way without any discrimination. 153 The nature of the offence at issue is one of the factors considered by the Court in determining the appropriateness of a retention measure. In Marper, a violation was found because DNA profiles were 'retained irrespective of the nature or gravity of the offence' . 154 The same line of reasoning was used in Gaughran where the applicant was convicted for a minor recordable offence. 155 In Martens, however, the state's power of retention was upheld given that the applicants were repeated offenders of serious crimes. 156 Applying these case laws to universal databases would mean their rejection by the Court due to their very essence: the collection and retention of DNA profiles from the entire population regardless of the commission of any offence. They can be considered only if the Court uses a different set of lens in adjudicating a violation where prior commission of a crime is not a factor. The Court can evaluate the power of universal databases rather on their ability to provide equal protection to the entire population where everyone is treated equally. 157 As long as the Court includes prior existence of an offence to it balancing exercise, there is no way for universal databases to find fruition in Europe. The practice of member states is varied when it comes to retention periods in their national databases. The Court found violations only when there was no retention limit even if such limit happens after death. The Court found a violation in Marper because DNA profiles may be 'retained indefinitely whatever the nature or seriousness of the offence' under suspicion. 158 It is such 'open-ended' retention regime that invited the Court to make a careful scrutiny of the case. 159 The Court argued that mere retention of DNA profiles has a 'direct impact on the private-life interests' of the person who owns the data irrespective of the subsequent use of such data. The Court in Gaughran enumerated the recent retention periods among member states and demanded that they have to be coupled with sufficient safeguards. 160 Luxembourg, Finland and Estonia retain profiles after death 161 while Netherlands has the highest retention period of twenty years after death for those convicted of serious offences. 162 Other states limit it to a few years after death or until the person reaches a certain age, like 80 for both Austria and Denmark, or 100 years after inclusion for Lithuania and 100 years after the person's date of birth in Slovakia. 163 In Chipovski, the Court ruled that '[i]n the absence of anything to suggest that such retention may be linked to any fixed point in time, the Court considers that the respondent State permits indefinite retention period of DNA profiles' . 164 In Martens, however, the Court found no violation even when there was no retention limit but the applicant had an option to review such retention. 165 Member states retain profiles even after death presumably to increase the statistical value of matching reports and to use them in familial searching 166 both of which are inapplicable in universal databases 167 where data will only be useful during a person's lifetime. The enabling universal database law shall then provide an option for family members to review whether the DNA profile data of their deceased relatives have been purged out of the system-a safeguard that is absent in current systems that retain data even after death. One key issue in Marper was the retention of DNA profile data of one of the accused who was a minor. 168 Citing Article 40 of the United Nations Convention on the Rights of the Child, 169 the Court noted the 'special position' of minors in the criminal justice system 170 especially regarding the protection of their privacy during criminal trials. 171 In universal databases, collection of samples may vary from state to state. Should a state decide to collect samples at the time of birth-due to logistical considerations 172 or peculiarities of its legal system-the enabling law shall provide data anonymization or pseudonymization 173 as a legal safeguard until they reach the state's minimum age of criminal liability. This safeguard will ensure non-use of biometric data until the time that their owners can be made liable for a crime in accordance with the state's penal law. ECtHR case law places a high premium on the existence of a review provision in evaluating the acceptability of a national DNA database law. One key reason for the finding of a violation in Marper is the lack of provision for independent review in relation to the retention of DNA profiles and there was no 'defined criteria' to make the review possible and measurable like the evaluation of the seriousness of the offence, history of arrests, the strength of suspicion and other special circumstances. 174 In Gaughran, the Court qualified the review further: it should provide effective relief to the applicant and not something 'so narrow as to be almost hypothetical' . 175 And it is the availability of review in Martens that rendered the retention of the applicant's DNA profile acceptable although retention limit was not provided for in the domestic law. 176 The enabling law for universal databases shall then include an option for those enrolled 177 to review the faithful compliance by the state on the legal safeguards enshrined therein. Another review safeguard emphasized in Gaughran and Chipovski is the possibility of deleting one's DNA profile in the database. The Court held in Gaughran that the domestic law should allow those enrolled in the database to petition for the deletion of their file 'if conserving the data no longer appears necessary in view of the nature of the offence, the age of the person concerned, the length of time that has elapsed and the person's current personality' . 178 In Chipovski, the Court ruled that it is not enough for the police to be vested with power to delete personal data. 179 The law should also specify the 'conditions under which it can be done and procedure to be followed' . 180 Moreover, the law should provide for a 'specific review of the necessity of data retention' . 181 The applicability of these review conditions to universal databases is doubtful as they go against the very essence of a universal database. 182 If the Court would insist on their application to universal databases, it would be impossible for them to be established in Europe. What would be appropriate in a universal database system is the creation of a separate and independent review team composed of various stakeholders-representatives from government, scientists, NGOs and civic society groups-whose task is to conduct periodic reviews on the system's adherence to the legal safeguards enshrined in the law in concreto and in tempore, with a corresponding power to propose sanctions in case of breach. The selection procedure on the composition of the review team may vary from state to state. In any case, its members shall be of proven integrity and are capable of working independently. Each member state can decide on the procedure for these review mechanisms given the peculiarities of their legal system subject to the Court's final review when called for. ECtHR case law involving DNA profiles surprisingly did not indicate legal safeguards regarding data security in spite its classification of personal data protection under the right to respect for private life. Once translated into numerical data, DNA profiles can easily be copied from one computer to another or through cloud-based file sharing. The current practice of states covered by the Prüm Decision is to share their data electronically. 183 They appear to ignore a possible hacking of their automated electronic sharing system. In universal databases, legislators themselves will be completely solicitude of DNA file data security because their own data are stored in the system. 184 And the entire population will be keeping an eye over the way the system is administered. It is this egalitarian approach to universal databases that appears to provide more security to personal data and privacy. 179 . 184 This was referred to by Kaye as a 'simple precept' or the Golden Rule where legislators and those who administer these databases 'should do unto others as they would to themselves' . This can be viewed as a greater motivation for whoever will be responsible for creating a universal database law in their country to include sufficient safeguards for the protection of everyone's right to privacy given that their own privacy rights are at stake. Additionally, it will also provide a greater motivation for those who will be tasked to administer these databases to be strict in following those safeguards because they themselves are included in these databases; see Kaye, supra note 87, at 48. Manual storage of DNA profiles appears to be the most secure way of maintaining universal databases. Computers shall be specifically dedicated for their use within a specified facility and a back-up facility created for that purpose. These computers shall not be connected to the internet and they are to be used solely for limited identification purposes. 185 Manual storage of DNA data shall be supervised by an 'independent database officer' in order to protect it from political manipulation. 186 Such exclusive facility is ideally an independent department (first department) not connected with the police and prosecution and shall only contain DNA profiles with codes assigned for each person as an identifier. 187 A separate and independent department (second department) shall be keeping a copy of the names that correspond to those codes but without the DNA profile data. 188 Disclosure of data will be regulated: only when there is a DNA profile match in the first department would the second department be tapped to determine the name of the person behind the DNA profile. The personnel of the two departments shall be independent from each other. 189 This system prevents leakage in the process of data sharing between computers in different facilities-including among member states under the Prüm Decision 190making it secure from external hackers. Whatever possible breaches in unwarranted data exposure can be traced back to the personnel within the system. Admittedly, manual storage is cumbersome but it will minimize the automatic processing of personal data thereby providing another layer of protection to the right to privacy. Member states shall be encouraged to incorporate severe and deterrent penalties in the universal database law for breach of this safeguard and less severe penalties for the breach of other safeguards. Legislators are expected to be more than willing to exact severe censures and penalties because their own personal data are included therein. Penalties may vary from member state to another depending on their Universal DNA databases: a way to improve privacy?, 4 Is it time for a universal genetic forensic database? Authors from both sides of the debate wrote separate chapters under Part II (Balancing Privacy and Security Other countries like Kuwait and Saudi Arabia have also considered setting up universal DNA databases The European Court of Human Rights is referred to in this article as 'ECtHR' , or simply 'the Court EU laws on privacy in genomic databases and biobanking This is understandable given that the Marper decision was promulgated during the effectivity of Convention 108 and before the effectivity of Convention Convention for the Protection of Individuals with Regard to the Automatic Processing of Individual Data, ETS No Gaughran was decided two years after the promulgation of Convention 108 + It merely gave reference to paragraph 41 of Marper, which refers to the older convention. See Gaughran, ECtHR at para. 50. It made reference to Marper Convention 108) does not distinguish genetic from biometric data. The Court missed the opportunity in Gaughran to provide guidance on this legal topic given the new classification of data in the updated version of the law R (87) 15: On regulating the use of personal data in the police sector ECtHR at para. 42 Dedrickson calls these 'abandoned DNA'; see Dedrickson, supra note 6, at 645. For various police techniques in gathering these samples, which raises questions of privacy, see id See Peterson, supra note 45 It has been argued that universal DNA databases 'may even increase privacy by decreasing more invasive investigative techniques, exonerating the innocent, and deterring crime'; see Dedrickson, supra note 6 Article 8 § 2 ECHR ECHR Article 8 Guide, supra note 75 Dedrickson also argued for the legitimate purpose of public safety which may be read into one of these purposes: ' A universal DNA database's benefits in efficiently and effectively solving crimes, exonerating the innocent, and decreasing racial disparities in law enforcement, however, make such a database immensely appealing from a public safety and criminal justice perspective'; see Dedrickson Lord Justice Sedley was one of the proponents of a universal DNA database in the United Kingdom. See C. Dyer, Anger over call to widen DNA database, The Guardian Discrepancies have been observed on individual alleles at several loci between reference and casework databases Modeling forensic DNA database performance, 55 See also D.H. Kaye, Identification, individualization and uniqueness: What's the difference? A subsequent study has shown that expanding the coverage of a DNA database does not necessarily yield a significantly higher output performance; see F. Santos, et al., Forensic DNA databases in European countries: Is size linked to performance? However, the article only covered DNA databases that included a subset of the entire population. The seeming disparity between size and performance is no longer a question in universal databases as explained in this sub-section. profiles in the databases increase; see Understanding of forensic expert reports by judges, defense lawyers and forensic professionals De Keijser & Elffers, supra note 122 Differential reporting of mixed DNA profiles and its impact on jurists' evaluation of evidence. An international analysis Are forensic experts biased by the side that retained them? For more studies on the level of understanding of these forensic reports, see Smith, supra note 9 ECtHR at para. 123 The value of a database is believed to be directly related to the number of profiles stored The authors of the following article discuss the sampling of populations using the current database system The degree of consensus existing amongst Contracting States has narrowed the margin of appreciation available to the respondent State in particular in respect of the retention of DNA profiles ECtHR at para. 10. Gaughran, ECtHR at para The applicants had been repeatedly convicted of serious offences and the retention of their DNA profiles were subject to the safeguard of periodic review; see Martens It is acknowledged that experts disagree on how to strike this fair balance. See V. Mayer-Schönberger, Strands of Privacy: DNA Databases, Informational Privacy, and the OECD Guidelines ECtHR at para. 118. The creation of legal safeguards could be the most crucial factor in the acceptance of universal databases. In one study, although more people were willing to donate their samples for inclusion in DNA databases, the overall concern generated is the possible lack of control and insufficient safeguards in the system The reasoning employed in Marper on the question of presumption of innocence has sparked interest even outside Europe; see M. Lwin, Privacy issues with DNA databases and retention of individuals' DNA information by law enforcement agencies: the holding of the European Court of Human Rights case S and Marper v. United Kingdom should be adapted to American Fourth Amendment jurisprudence ECtHR at para. 53 in relation to 94 at para. 15 in relation to 53 at para. 15 in relation to 53 ECtHR at para. 52 There were 'no statutorily prescribed time-limits' in Martens, but there was an option to review the retention of DNA profiles in the database Familial searching is used when the profile of a criminal perpetrator is not kept in the database but may be traced from the profiles of their relatives including those who are already dead The accuracy of DNA matching probability and the practice of familial searching will no longer be an issue in the presence of a comprehensive DNA database since crime scene samples will be expected to have a direct one-to-one correspondence with a profile Universal forensic DNA databases repealing Council Decisions One author suggested that a master list of the identities of persons with their code numbers be maintained by a separate agency and that police officers have to apply for a court order to access such identities. See Monteleoni, supra note 94 Limited access with severe penalties for misuse has been regarded as a strong safeguard for to universal DNA databases. See N.A. Bennett, A privacy review of DNA databases, 4 I/S: J.L. & Pol'y for Info On the need for independence of the officers involved in data processing, see J. Kokott & C. Sobotta, The distinction between privacy and data protection in the jurisprudence of the CJEU and the ECtHR, 3 Int. Data Priv This suggestion is controversial as it may appear to go against the automatic processing of data under the Prüm Directives. It could be a propitious subject for a more extensive and separate research Cross-border exchange and comparison of forensic DNA data in the context of the Prüm decision, Policy Department for Citizens' Rights and Constitutional Affairs (European Parliament 149 Gaughran, ECtHR at para. 88. 150 'The Court, thus, considers that once an acquittal has become final-be it an acquittal giving the accused the benefit of the doubt in accordance with Article 6 § 2-the voicing of any suspicions of guilt, including those expressed in the reasons for the acquittal, is incompatible with the presumption of innocence. ' Under the preliminary interference test, the all-inclusive coverage of universal databases constitutes a serious interference into a person's private life as can be predicated from DNA-related case laws starting with Van der Velden. In order to limit the amount of data to be retained in these databases and thereby limit the sensitivity of the information retained, destruction of cellular samples after the generation of DNA profiles would be an appropriate safeguard.As to whether the interference would amount to a violation of the right to respect for private life, the three tests of legality, legitimate purpose and proportionality show discordant results. Universal databases pass the legality test in so far as the availability of legal instruments within the Council of Europe that do not negate the possibility of their existence. However, under the element of foreseeability of the law, universal databases will fail if the Court will continue to confound the three meanings of identification-authentication-, association-and trait-identification. The prohibition of trait-identification is a legal safeguard that appears to lend more privacy protection compared to current police investigation practices such as DNA dragnets, shed DNA sampling, and familial and ethnic searching, the latter being described as a 'highly sensitive' procedure in Marper.Universal databases pass the legitimate purpose test as long as they are used strictly for the purpose of crime prevention, and consequently, respecting the rights and freedoms of others, both under Article 8 § 2 of the Convention. Their use in criminal investigations appears to be more scientifically accurate given their person-specific matches-instead of current protocols using probability estimates-thereby making them less confounding for the trier of fact. The benefit of inclusion in a database has been indirectly recognized by the Court when it asserted that one may be 'rapidly eliminated' from the list of suspects in case of a non-match. It provides a sense of security for the innocent and a deterrent for the guilty to know that DNA matches may no longer be questioned for their statistical value. They may still be questioned for other matters like contamination of the crime scene sample but not for the DNA profile match itself. However, a DNA profile match is not the end-all and be-all of conviction. The speed and accuracy they lend to investigations should be balanced by a legal safeguard: DNA profile match data should not be used as a sole evidence for conviction. While a universal database will definitely assist the police and prosecutors in limiting the scope of their investigations, they should gather other supporting evidence if they want to 24 • Universal forensic DNA databases secure a conviction. A court of law should dismiss a case that presents DNA profile matching as its sole evidence in a crime.It is in the proportionality test where the biggest obstacle was encountered as case law revolves around measuring data retention safeguards with the presence of conviction, although the Court continues to provide protection to convicted individuals as shown in Gaughran and Chipovsky. Unless the Court uses a different set of lens in its assessment, it would be next to impossible for universal databases to pass judicial reckoning at the ECtHR. Be that as it may, legal safeguards were identified as necessary inclusions in a theoretical enabling legislation for universal databases to tilt the balance towards their acceptance: anonymization/pseudonymization of minors' data until they reach the minimum age of criminal liability, retention limit up to the time of death, manual and independent data storage, severe penalties in case of data breach, and a provision for independent review on the state's compliance to these legal safeguards.The current principles used by the Court in adjudicating a possible violation of the right to respect for private life involving retention of DNA profiles cannot be squarely applied to universal databases. Judicial reasoning may focus more on equality of treatment, where inclusion in the database no longer amounts to the stigma of having been convicted or at least suspected of a crime, knowing that only the guilty will be prosecuted and the great majority of the innocent exonerated in a more expeditious manner in a universal database system. At the same time, it should be made clear that failure to strictly comply with the identified legal standards will further tilt the balance towards a finding of violation of the right to respect for private life under Article 8 ECHR. The author has no financial, personal, academic, or other conflict of interest in the subject matter discussed in this manuscript. The author is deeply grateful to Dr. Mr. Christina Peristeridou for her constructive insights on some parts of the paper.