Commercial genetic information and criminal investigations: The case for social privacy

Abstract

Taking a DNA test with a commercial company is an increasingly popular enterprise, with tens of millions of consumers worldwide. In recent years, these genetic databases have also been used for so-called investigative genetic genealogy (IGG): uploading a crime scene DNA sample in these databases to find a distant relative of the unknown suspect. This forensic use of genetic consumer information has already helped solve many crimes. The debate on IGG tends to focus on individual rights and values, such as individual consent, individual control over information, and – perhaps most prominently – individual privacy. In this paper, I propose to approach IGG through the lens of privacy's social value, in contrast to merely its individual value. First, I discuss the conceptualization of privacy as a social value. Next, I explore several issues of IGG that privacy's social value allows consideration for: the informational and decisional interconnectedness, the risk of a tyranny of the minority, the involvement of multiple contexts, and the relationship between citizens and state. I conclude that this approach offers a fruitful perspective to evaluate the ethical and social desirability of IGG, evading the simplified dichotomy between individual privacy versus the security of society, in which the former will almost automatically lose. A focus on privacy's social value recognizes the effects for society on both sides of the balance. It brings into the light fundamental ethical, social, and political concerns of IGG, that extend beyond individual data control or consent.

Investigative genetic genealogy

In 2004, an 8-year-old Swedish boy and a schoolteacher were stabbed to death in Linköping, a town in the south of Sweden. For years, law enforcement failed to find the perpetrator. The eventual breakthrough came in June 2020 as a result of comparing the suspect's crime-scene DNA profile with DNA profiles from the US-based commercial genetic testing company FamilyTreeDNA. A genealogical expert built an extensive family tree of a distant relative-match of the suspect, using historical genealogical data going back as far as the eighteenth century (Tillmar et al., 2021). The expert was able to narrow the group of suspects down to two brothers. They were arrested simultaneously and DNA was taken from both. The younger brother confessed to the double murder after his DNA profile yielded a complete DNA match. Sweden is the first European country in which an arrest took place based on the outcomes of this so-called investigative genetic genealogy (IGG).

Other European countries are also exploring the possibilities of using the technique. In the Netherlands, the public prosecution announced in March 2023 that they will start a pilot to use IGG in two cold cases of murder or manslaughter (Netherlands Public Prosecution Service, 2023). In the UK, the advisory Biometrics and Forensics Ethics Group stated in a September 2020 report that the initial use of IGG in the context of the identification of unidentifiable human bodies would allow to test the potential of IGG for the UK (UK Biometrics and Forensics Ethics Group, 2020).

IGG takes place by uploading a DNA profile from material found at a crime scene into a genetic database that is normally only used for an entirely different purpose: as a primarily recreational and/or health-related enterprise to find out about one's ancestry, long-lost relatives, or genetic risk for diseases. Genetic databases that, thus far, have been searched for law enforcement purposes are the genealogical website GEDmatch and the commercial genetic testing company FamilyTreeDNA. When a crime-scene DNA profile is uploaded to one of these databases, the aim is to find a match with a (very) distant relative of the suspect. An expert genealogist will examine the intersections of the family trees of the unknown suspect and this distant relative, eventually narrowing down the group of suspects by using archival records, birth certificates, age of the suspect, or whether a person was living in the area where the crime was committed. In that way, it is possible to zero in on one suspect or several siblings. In the USA, IGG has been used in far over three hundred criminal investigations (Dowdeswell, 2022).

Interestingly, it has been estimated that only two percent of a population needs to be included in a DNA database open for law enforcement to be able to track down almost anyone in that population through IGG (Erlich et al., 2018). Commercial DNA tests are especially popular in the USA, but also attract a rising number of customers in Europe. Therefore, IGG might also become increasingly effective to identify criminal suspects within Europe. This is supported by empirical research. One study tried to identify ten UK volunteers by uploading their profile into the genealogical website GEDmatch, the platform most often used in IGG cases, and succeeded in four cases, of which one took just three hours of investigative work (Thomson et al., 2020). Another study searched GEDmatch for relatives of the unknown ‘Ekeby man’ who had been found murdered in Sweden in 2003; the authors were able to compile a list of dozens of candidate relatives of the unidentified victim and to point to ancestry from the North-Western part of Croatia (Tillmar et al., 2020). IGG has, thus, also a significant potential for crime-solving in the European context.

IGG is often discussed from an individual perspective, focusing on issues regarding individual privacy and consent (De Groot et al., 2021; Granja, 2021). The debate tends to be reduced to the balancing of individual rights and interests (individual privacy, individual control over private information, and individual consent to participate in law enforcement access) versus the societal interests (the benefits of crime-solving). ¹ But, as Solove (2015) points out, to consider privacy exclusively on the individual level leads to an undervaluing of privacy in utilitarian balancing – the prevailing way that policy-makers make decisions when conflicting interests are at stake. Privacy, then, loses out almost automatically against security – a value indisputably understood as being valuable to the whole of society (Solove, 2015). Therefore, it is essential that societal interests are weighed on both sides of the balance (Solove, 2015).

Recent privacy debates have highlighted the importance of focusing on privacy as a social value (Nissenbaum, 2009; Roessler and Mokrosinska, 2015; Solove, 2015). Because the crime-solving capacity of IGG is fundamentally built upon the interconnectedness between many individuals, approaching IGG from a social understanding of privacy could be a helpful perspective to explore the social and ethical desirability of this novel crime-solving technique. Within the IGG debate, it also allows for consideration of issues on the social-political level (Samuel, 2021). This approach can contribute to move the IGG debate beyond the simplified dichotomy between individual privacy interests versus the security for society.

In this paper, I aim to offer an ethical analysis of IGG in which IGG is approached through the lens of privacy as a social value. I argue that this societal perspective is very helpful for analysing the impact and desirability of IGG. First, I discuss the concept of privacy as a social value, which is a perspective that comes from the context of information technology and Big Data. Second, I argue for the relevance of this approach to IGG: it permits consideration for broader social and political issues, including the interconnectedness, a risk for a tyranny of the minority, the involvement of multiple sectors, and the relationship between citizens and state. I conclude that the debate on IGG should approach privacy also as a societal value, instead of merely as an individual one. This can lay bare more fundamental ethical, political, and social concerns of IGG that extend beyond the individual.

Privacy as a social value

The importance of protecting privacy is commonly articulated within (a mixture of) utilitarian, deontological, or virtue ethics frameworks (Allen, 2012; Van der Sloot, 2017). Privacy is traditionally regarded as an individual right, both in the ethical and the legal context, echoing the 1890 definition of privacy as ‘the right to be let alone’ (Warren and Brandeis, 1890). As mentioned, also in the debate on IGG, privacy is primarily approached in the individual sense. The IGG debate frequently revolves around questions such as whether the individual consumer gives consent that their genetic data can be accessed for forensic purposes (i.e., the individual control over private information; informational privacy), what kind of personal information is shared with law enforcement (Guerrini et al., 2021), whether an individual's data is sufficiently technically protected, etc. Yet, privacy does not only have an importance and value in the individual sense; privacy also has a societal value. This paper takes a pluralistic approach to privacy's value, which will be explored in more detail later in this section.

The social value of privacy is an approach that has its foundation in studies on privacy in the context of information technology systems and Big Data. Privacy's social value is already visible in day-to-day situations. For example, a doctor speaking in a packed metro about the patients she treated that morning, does not only violate the privacy of those individual patients, but might also impact trust in doctors, health institutions, and health care in general. Patient-doctor confidentiality is based on both societal and individual interests. The ethical justification can be approached from a deontological viewpoint (doctors have a professional ethical obligation towards their patients to respect their patient's privacy, which echoes deontological constructions of privacy based on individual autonomy) or from a utilitarian viewpoint (e.g., breaching confidentiality could have harmful effects for trust in healthcare and accessibility to healthcare). Similarly, the fact that it is prohibited for police officers to randomly search a house without pretext, is not only because that would violate the inhabitant's individual privacy. An individual privacy approach may focus for example on the person's right to privacy balanced against e.g., if a bomb is found, all the people's lives who have been saved by preventing the bomb to go off. Yet, it is in this case not about one individual case, but about a policy implemented in society of random house searches that invade privacy and which could affect other issues on a societal level, such as power imbalance, trust in law enforcement institutions, or the relationship between citizens and the state. As Solove has pointed out “The value of protecting against such searches emerges from society's interest in avoiding such searches, not from any one particular individual's interest.” (Solove, 2008: 99). Nevertheless, law and policy still largely focus on justifying protecting privacy in terms of the value of privacy to the individual (Regan, 2022).

Meanwhile, the legal and philosophical academic debate has elaborately discussed the social values of privacy – one that does not merely approach privacy as important to the individual alone (Allen, 2022; Becker, 2019; Marx, 2015; Nissenbaum, 2009; Raab, 2012; Regan, 1995; Solove, 2008). Solove argues that privacy should be regarded as a pluralistic concept and that therefore the value of privacy needs to be understood in a pluralistic sense as well, based on its contribution to society (Solove, 2008). Free speech and security are generally regarded as interests being of value on a social level – they benefit society at large (e.g., freedom of speech facilitates open debate, a democratic society, and societal change), while privacy is often narrowly seen as valuable to the individual alone (Solove, 2015). This echoes the common belief that public interests can only increase at the expense of privacy interests and vice versa: a zero–sum relationship (Raab, 2012). Solove argues that privacy has a social value too and should not be balanced merely as an individual right against the common good. Rather, societal interests should be weighed on both sides of the balance (Solove, 2015). In the case of IGG, this means privacy versus justice/security – but both as social values.

In her book Privacy in Context, Nissenbaum (2009) argues for recognition of the social dimensions of privacy from a different perspective. She sees privacy as a social norm and argues for an account of privacy that “justifies its place among shared, collective values of a community” (Nissenbaum, 2009: 66). According to Nissenbaum, the problem is often not so much the fact that information is extensively shared (because information flows are often necessary in our modern-day world), but rather the inappropriate sharing (e.g., doctor sharing patient information in a packed metro). She argues that the determination of the appropriateness of information-sharing should not depend on the individual control over data (which, according to her, is no longer feasible in these times), but rather on the basis of contextual integrity. Society consists of all kinds of different social contexts, such as the healthcare context, the commercial context, and the law enforcement context. Information should be protected according to the values and norms that are governing these particular contexts; so-called ‘context-relative informational norms’ ² (Nissenbaum, 2009). Privacy is protected when information flows appropriately between and among these different contexts. A certain practice is regarded a violation of contextual integrity if it infringes these context-relative informational norms. Within the health-care setting, different norms and values exist about the sharing of personal information, compared to the commercial setting.

Regan has also called for recognition of the social values of privacy (Regan, 1995, 2022). She argues that there are three bases on which privacy can be said to have social importance: the common value, the public value, and the collective value of privacy (Regan, 2015). First, privacy is a common value in the sense that all individuals value privacy in some degree; although they may have very different ideas about what should be private and public, all people think of privacy as valuable (Regan, 2015). This is, for example, illustrated by the public outcry that followed revelations of mass state surveillance operations. Second, privacy is a public value, because privacy is vital to the democratic political system. Over the last years, this has increasingly been acknowledged in both the legal and ethical (academic) debate (Regan, 2015). A clear example of the public value of privacy is the privacy of the secret ballot; it is vital to the democratic process. The third base of the societal importance of privacy is its collective value, which is perhaps the most relevant for the IGG context. The collective value of privacy is based on the idea that technology and market forces are “making it harder for any one person to have privacy without all persons having a similar minimum level of privacy” (Regan, 2015: 62). According to Regan (2015), privacy can be seen as a collective good, because, among other aspects, it is in these modern times almost impossible for one individual to set their privacy level without also affecting the privacy level of others. This is due to the complexity and interconnectedness of modern communication systems (Regan, 2015). On the internet, people often share information that affects the privacy of others, such as persons uploading photographs on Facebook with others on it. One particular example of this collective conceptualization of privacy is the Cambridge Analytica controversy. Initially, 270.000 Facebook users gave their consent to fill in a survey and download an app (Véliz, 2020). The app downloaded all their Facebook data, but also the data from Facebook friends of the respondents without their knowledge and without their consent. Eventually, Cambridge Analytica obtained the data of approximately 87 million Facebook users (Hu, 2020). Probably, few people would argue that the fact that 270.000 persons consented justifies Cambridge Analytica's collection of personal data from millions of others. This could be regarded as a case of what Barocas and Nissenbaum have called ‘the tyranny of the minority’ in which “the volunteered information of the few can unlock the same information about the many.” (Barocas and Nissenbaum, 2014: 61).

The accounts of privacy offered by Solove, Nissenbaum, and Regan all point to the importance of approaching privacy as a social value. In this paper, I approach privacy as a pluralistic concept, focusing on the social value of informational privacy in the context of IGG. ³ This is in line with Solove's understanding of privacy as a plurality of multiple related things (Solove, 2015). ⁴ According to Solove, “Privacy is a set of protections against a related set of problems. These problems are not all related in the same way, but they resemble each other. There is a social value in protecting against each problem, and that value differs depending upon the nature of each problem.” (Solove, 2015: 80). More specifically, in this paper, I focus my analysis of IGG in terms of social privacy on (1) the emphasis on context instead of individual control, as argued for by Solove and Nissenbaum, and (2) the recognition of privacy's collective value as explored by Regan's conceptualization of privacy's collective value and by Nissenbaum's notion of the ‘tyranny of the minority’.

This social privacy approach is different from the individual control-based approach to privacy. I understand an individual control-based approach to privacy as an informational privacy approach that defines a right to privacy as “a right to control information about oneself” (Nissenbaum, 2011). With respect to IGG, this means focusing on an individual's consent to make their commercial genetic profile accessible for law enforcement searches. ⁵ As Nissenbaum (2011) argues, informed consent is (problematically so, according to Nissenbaum) a dominant approach to achieve privacy and address privacy concerns. In the context of IGG, to focus on consent and individual control-based privacy (such as whether people gave valid consent or have been rightly informed) has significant limitations (De Groot et al., 2021; Granja, 2021; Murphy, 2022). Within IGG, decisions by individuals to share their genetic data with law enforcement, can affect many others (sometimes thousands of individuals) to whom the consenting individual is genetically related. The nature of genetic information is that it is inevitably shared between individuals: we share e.g., around 50% of our genetic information with our siblings and parents and also some percentage with very distant relatives. Irrespective of the ethical questions regarding consent's relevance, it is therefore simply practically impossible to obtain consent from all of these individuals, especially since there is no way of knowing beforehand which individuals will surface in the IGG process.

In other words, if one individual gives consent for IGG, this is not just a decision about oneself. A social value of privacy can be understood in this more narrow sense (implications for others) and in a more broader sense: it has a value to society at large. Importantly, this paper does not claim that we should completely abandon individual privacy, but rather that privacy's social value is highly pertinent to the IGG debate and deserves much-needed attention as it allows for a broad understanding of the challenges that IGG raises.

In the next sections, I will apply these social dimensions of privacy to the case of IGG.

Informational interconnectedness

Focusing merely on individual privacy and consent has important limitations in the IGG context (De Groot et al., 2021; Granja, 2021; Murphy, 2022). Particularly, using informed consent as the only appropriate legal and ethical basis to justify IGG is questionable and narrows the ethical debate (De Groot et al., 2021; Samuel and Kennett, 2020b; UK Biometrics and Forensics Ethics Group, 2020). The crime-solving potential of IGG is fundamentally built upon the interconnectedness – namely, the genetic relatedness – between many individuals. This interconnectedness is the main reason why a social privacy approach is so pertinent to the IGG debate.

Within IGG, this interconnectedness is two-fold: I call these an informational interconnectedness and a decisional interconnectedness. First, I discuss informational interconnectedness: our genetic information is inevitably connected with others. As I share 50% of my DNA with my siblings, my genetic information also tells something about them. The reason that the analysis by Solove, Nissenbaum, and Regan is so relevant for IGG is, fundamentally, the fact that people have parts of their DNA in common with others. Genetic information is, thus, clearly connected. Moreover, within the IGG investigation process, personal information of relatives must be processed in order to identify the degree of genetic relations (Facebook pages, birth records, marriage archives, genealogy records, etc.). I call these ‘chain-relatives’; that is, relatives between the suspect's DNA and the individual participating DNA test consumer – they are part of a chain that eventually leads to the perpetrator. These chain-relatives do not have their genetic or personal information stored in consumer databases, but, because of their connectedness to the suspect, their information is of interest to be able to zero in on the unknown suspect. Importantly, these chain-relatives are not just close relatives, but encompass many individuals. For example, in the IGG process to identify the so-called Golden State Killer, thousands of relatives were reportedly mapped (Murphy, 2018). In other words, DNA data makes the collective value of privacy specifically visible.

At this point, it may be interesting to briefly explore the legal and regulatory framework surrounding IGG and how these connect to a more individual or social conception of privacy. When it comes to genetic information, both conceptualizations can be recognized within different legal and regulatory frameworks. Upon first examination the focus seems to lie primarily on individual privacy and individual choice: the European Court of Human Rights (ECtHR) has predominantly approached privacy as an individual right (Hughes, 2015; Van der Sloot, 2016). The processing of genetic data is regarded by the EU General Data Protection Regulation (GDPR) as a special category of personal data and processing is therefore strictly regulated, but can be processed when the data subject gives explicit consent (Costello, 2022; Dumortier and Boura, 2020). Therefore, in 2019, FamilyTreeDNA automatically opted-out their EU customers from law enforcement access (but they can choose to opt-in), while US customers are automatically opted-in (Kling et al., 2021; Ram, 2019; Wienroth et al., 2021). The GDPR holds that consent should be “freely given, specific, informed and unambiguous” (GDPR article 4(11)). The UK Biometrics and Forensics Ethics Group has argued that it is not immediately clear whether an individual's consent to use their genealogical data for IGG purposes can be judged ‘freely given’ (UK BFEG, 2020). Moreover, they concluded that it is questionable that consent can be a legitimate legal basis to obtain data for IGG in line with the EU Law Enforcement Directive and the case-law on article 8 of the European Convention on Human Rights (ECHR) as well as domestic UK data protection regulations (UK BFEG, 2020). Of note, the ECtHR has considered familial and ethnic information (both of which the commercial genetic profiles encompass) to be highly sensitive (Tuazon, 2021). In sum, when focusing on individual informed consent, there are some relevant legal and regulatory obstacles when it comes to IGG. However, as this paper argues, not all relevant issues may come to the fore with this narrow focus.

Interestingly, the social conceptualization of privacy can also be recognized within legal and regulatory frameworks, especially when it comes to genetic information. Costello (2022) has argued from a legal perspective that – specifically within the context of genetic data – a nascent relational understanding of privacy can be recognized in ECtHR case law on article 8 ECHR concerning genetic data as well as in jurisprudence of the European Union's Court of Justice. In Gaughran v. the United Kingdom, the Court noted that “retaining genetic data after the death of the data subject continues to impact on individuals biologically related to the data subject [emphasis added]” (ECtHR, 2020,Gaughran v. UK, para 81) which reflects that the Court accepts the relational aspect of certain data at least in the context of genetic data (Van der Sloot, 2020). Furthermore, the explanatory memorandum of the Convention for the Protection of Individuals with regard to the Processing of Personal Data (Convention 108) of the Council of Europe states that genetic data can reveal not only information about one individual, but also about ‘third parties’ (Costello, 2022). Moreover, although many conventions remain committed to an individual approach to privacy, Convention 108 also acknowledges “that the nature of genetic data challenges purely individualistic understandings of privacy” (Costello, 2022: 11). ⁶ Also outside of the context of genetic data, the limitations of individual conceptualizations of privacy are increasingly discussed in the legal literature, for example in the context of mass surveillance and group privacy debates (Taylor et al., 2016; Van der Sloot, 2016) and relational approaches to law in general (Herring, 2019; Nedelsky, 2011).

In other words, an ethical focus on privacy's social value for IGG could potentially be increasingly reflected within legal and regulatory frameworks (although it is still unclear to what extent the GDPR could accommodate such a conception (Costello, 2022)).

The ‘Tyranny of the Minority’

Relatedly, but perhaps more importantly than informational interconnectedness, is the decisional interconnectedness. Obviously, there are differences between the above discussed Cambridge Analytica case and IGG. But there is an important analogy as well: in both cases, informed consent provided by a few is used to obtain private data from many who are in some way connected to the consenting individual in question. In other words, the decisions of only a small proportion of people profoundly affects the privacy of a much larger group.

This decisional interconnectedness is for a large part inevitable in the genetic context. If I decide – inspired by the novel We by Yevgeny Zamyatin – to replace the four walls in my apartment with four glass walls, that would be entirely my own decision. However, within the genetic context, if I would open up my four glass walls, I would metaphorically also open up two glass walls in my siblings’ apartments (because we share 50% of genetic material), two in my parents’ apartment, and one glass wall at my grandparents’. My own decisions about my genetic information are therefore not isolated, but may result in consequences for both close and distant relatives – people I have never met and will never meet. More precisely, I may have no way to get to know the other people about whom I, indirectly, make decisions when providing consent to FamilyTreeDNA, and consequently to IGG.

To illustrate the point: suppose someone would post a substantial part of their genetic information on Facebook (from which many personal properties, including illnesses, could be deduced). Would that be OK? One could argue: yes, it is an individual's own decision which personal data that individual wishes to share. Alternatively, one could argue that revealing one's genetic information implies exposing highly private information of siblings and other family members.

These examples point to what Nissenbaum has named the ‘tyranny of the minority’: the willingness of a few people to share private information can also disclose information about others (Barocas and Nissenbaum, 2014). The tyranny of the minority is an extreme example of decisional interconnectedness and highlights why privacy is of collective importance. The concept is very applicable to IGG. Namely, as has been mentioned, only around two percent of a certain population has to consent in order to identify almost anyone. Thus, if I have not consented to police use of my data but a fourth-cousin of mine has, it could be that my social media accounts and family tree archives are being investigated without my knowledge or consent. In that way, only a fraction of the population could make decisions for the rest of the population (De Groot et al., 2021). Importantly, the relevant question here is not just whether individuals made rational, informed decisions about their own privacy in the IGG context (a debate that is perhaps getting too much attention at the moment (De Groot et al., 2021)), but rather that these decisions may affect others.

The problems of the tyranny of the minority within the IGG context can be illustrated by a thought experiment:

The Great DNA Database of Volunteers

One day, Chief of Law enforcement of democratic state X makes an announcement on evening television saying: “We, the police, are setting up a volunteer DNA database so that we can – through family tree building of your distant relatives – identify crime scene DNA samples. Please help us! If you give your DNA voluntarily to us, we might be able to solve a murder! We have contracted a commercial DNA testing company who is willing to provide the DNA testing and hold the databases.” The following day, many enthusiastic people want to participate in this great initiative; eventually, around 300.000 people sign up. This number of participating people has the magnificent benefit that of the country's population of 17 million now almost anyone can be identified. Law enforcement immediately solves several cold cases with this novel database.

What would the public backlash be in this case, if any? The main objection would likely not revolve around whether these volunteers have rationally and freely given consent. I think that the most pressing debate will be around the objection that this policy has been implemented without consulting a democratic process (i.e., a majority decision), but instead based on the ‘consent’ of volunteers: the tyranny of the minority. Interestingly, in democratic countries where IGG has been used, the legislator or a democratic decision-making process was often not part of the implementation. Instead, consent is often claimed as a legal authority for IGG (Murphy, 2022). As this is a novel technology, the legislator did not foresee IGG at the time when laws on forensic practice were established, resulting in ambiguous legal boundaries (in the Netherlands, for example, public prosecution reasoned IGG could legally fall within the scope of familial searching (Netherlands Public Prosecution Service, 2023)). With IGG, a similar phenomenon occurs compared to the thought experiment: an over-emphasis on consent as the justification to use IGG, can result in the situation that a fraction of the population (i.e., around two percent) can make decisions which affects us all (namely, all citizens can in that case potentially be identified with IGG through their distant relatives), circumventing a democratic process. ⁷ An advantage of the social privacy approach is that it can, through the recognition of privacy's collective value, lay bare this specific risk of the tyranny of the minority, while an individual control-based approach to privacy, on the other hand, may risk to create it. On the background of the previously discussed different legal and regulatory approaches, an individual control-based account risks to remain fixated on specific data protection requirements of freely given and specific consent or discussions about the superiority of either an opt-in or opt-out system, rather than asking more fundamental questions: is consent – even if it is freely given, specific, and informed, and in line with GDPR requirements – a justified basis for using IGG? The analogy between this case and IGG underlines the importance of moving the IGG debate beyond individual decisions towards collective, democratic decision.

In sum, a focus on the collective value of privacy allows consideration within the IGG debate for issues around informational and decisional interconnectedness.

Crossing sectors and contexts

Another important aspect of IGG that can be addressed when the broad societal value of privacy is taken into consideration, is its multisectoral nature. It has been argued that ethical problems can arise when data produced in one context (such as the clinical context) enter another social sphere, such as the market or the criminal justice system (Bruynseels and van den Hoven, 2015).

The focus on context instead of control as argued for by Nissenbaum could be a fruitful way to discuss the complex variety of different actors that play a role within IGG, such as the involvement of the consumer, law enforcement, (distant) relatives, the commercial company holding the DNA profiles, the commercial company carrying out the genetic analysis and genealogy searches, the expert genealogists, and the legal and criminal justice system itself. IGG is highly dependent on several non-public commercial institutions and persons. For example, in the US, no forensic lab currently exists that has the technology for generating these so-called SNP profiles – therefore, a private lab typically generates the needed profile (Guerrini et al., 2021). Next, law enforcement is dependent on a database that is owned and controlled by a commercial company, to match the acquired genetic profile with. The character of a DNA database can also change: for example, GEDmatch was founded by two hobby genealogists, but was sold in 2019 to the commercial forensic sequencing company Verogen (Thomson et al., 2020), which was acquired in 2023 by the firm Qiagen (Reuters, 2023).

This involvement of multiple actors across different contexts asks for an ethical approach that moves beyond the individual perspective. IGG crosses certain societal contexts (the commercial context and the criminal investigation context), that were traditionally considered lying very much apart. This brings us back to Nissenbaum's conceptualization of privacy as contextual integrity. IGG can be considered to breach the entrenched forensic norms when it comes to handling genetic data. First, traditional forensic genetic databases have to comply with strict legal rules regarding the collection, analysis, and storage of genetic profiles, while commercial DNA databases are not subject to these rules (Toom et al., 2022). Moreover, GEDmatch makes use of SNP profiles that look at hundreds of thousands different places in the DNA (encompassing information such as ancestry, disease risks, and phenotype), while forensic genetic databases make use of forensic STR profiles, that usually include no more than twenty different places and have been precisely selected for only very limitedly containing sensitive information (De Groot et al., 2021; Granja, 2021; Murphy, 2018; Wienroth et al., 2021). Thus, the type of information is fundamentally different. Also, IGG involves the mapping of many relatives, sometimes even thousands (Murphy, 2018). To investigate the genetic relatedness of those individuals, one needs to access information such as social media, birth certificates and other archives. Even when compared to familial searching within forensic genetic databases, IGG involves much more sensitive information and more genetic relatives (Kling et al., 2021; Murphy, 2018). In addition, many genealogists often started as hobbyists who now work independently or for commercial parties and often lack formal accreditation, qualification or ethics training common for forensic genetics experts (Granja, 2023; Kling et al., 2021; Murphy, 2022). In other words, IGG involves much more data subjects and data is shared with others beyond the forensic profession. The contextual integrity evaluation includes to consider ethical and political factors that are affected by this practice, and how this practice impinges on goals and values of the societal context (Nissenbaum, 2009). Although this will differ between jurisdictions, it is plausible that both in the EU and US context, the informational norms that are in place within the forensic genetic practice are violated by the practice of IGG. Yet, admittedly, one of the limitations of the contextual integrity approach that Nissenbaum has also pointed out is the risk that a novel practice can get entrenched as the new normal, although it should have not been accepted (Nissenbaum, 2009). That is why it is important to systematically evaluate these novel practices while they arise instead of afterwards.

In this context, it may be helpful to examine another instance in which the commercial setting crosses other sectors. Sharon (2021a) discusses an example of ‘illegitimate sphere transgression’, namely the Apple/Google digital COVID contact tracing software: in that case, a legitimate advantage in the digital sphere (Google's expertise in digital matters) is converted into advantages in the health care sphere and in the political sphere. Special caution must be taken with a risk of ‘industrial tyranny’, in which companies’ expertise in a certain field translates into an advantage to confer power into a non-industrial sphere (Sharon, 2018, 2021b). Sharon argues that Big Data companies can use their digital expertise as an “an entry ticket to previously autonomous spheres, bringing with it other values and interests and granting newfound power to reshape spheres according to those values and interests.” (Sharon, 2021a: 54). This analysis seems relevant for (the future of) IGG, as commercial companies enter the public sector of criminal investigation and forensics. A legitimately achieved expertise of DNA testing and family-tree building for commercial purposes is converted into an advantage in the sphere of forensics. Thus, it could be argued that IGG is an example of an illegitimate sphere transgression. It could even be argued that the ‘tyranny of the industry’ is a real risk in IGG, because commercial companies could become uniquely able to open up decades-long unsolved murder cases. This crime-solving monopoly could lead to a future dependency on commercial parties and a changing relationship between the state and its citizens.

Changing relations between citizen and state

The discussion in the previous sections about informational and decisional interconnectedness, the transgressions of contexts and the involvement of commercial actors shows that IGG may change the way in which society looks to forensic genetics, and law enforcement in general. It could have an impact on the relationship between citizens and state because of various factors.

First, the discussed involvement of commercial parties has implications for the public nature of criminal investigations. Criminal investigation is quite obviously an example of a practice that has been strictly regulated on a state-level, long before other matters were placed under state control, such as healthcare. Police officers and forensic experts are employed by public bodies, not by commercial ones. The state has a monopoly on violence; only she can legitimately use force. The power of the state in this respect is precisely the reason why suspects (and citizens in general) are equipped with numerous essential rights; to protect the ‘small’ individual from disproportionate interference by the ‘big’ state. IGG could pull law enforcement investigations partly out of the public sphere. By that, I do not merely mean that what is problematic is law enforcement's use of non-public sources of information (such as a commercial DNA database). Admittedly, police investigations routinely involve intrusion into non-public spaces. Yet, IGG is dependent on commercial parties in some significant ways, partly on the basis of the differences between IGG and general forensic genetic practice that were discussed in the previous section. There is a dependency on commercial parties, for example, in the sense that commercial parties hold the genetic databases, are frequently conducting part of the investigative work, or are needed to generate a genetic profile from a crime scene sample. All three databases that currently permit law enforcement use (the recent DNASolves being the third) are, after various acquisitions, private companies (Glynn, 2022; Kling et al., 2021; Scudder et al., 2020). As has been mentioned, no US police lab currently has the technology to generate a DNA profile needed for IGG. Moreover, companies have laid down in their terms of service for which crimes they grant permission to use their databases, which has resulted in the interesting situation that a commercial entity has a major say in the decision-making process regarding in which type of cases IGG can be used.

As such, IGG's dependency on commercial entities raises some significant issues, for example when it comes to public trust in the criminal justice system. ⁸ Also, it may raise questions such as where responsibility and accountability lie when, for example, major mistakes are made in a criminal investigation: is it the responsibility of companies, consumers, or the justice system? It should be noted that from an ethical-legal perspective the question arises whether the commercial DNA databases that are used in IGG searches by law enforcement, might serve as a way of circumventing the existing legal regulations for forensic databases (Machado and Granja, 2020).

Second, the already discussed interconnected nature of IGG entails possibly wide-reaching consequences on societal relations, both within countries and between states. For example, the transnational nature of IGG is apparent in the sense that different countries have different approaches to punishment, including the death penalty, as well as that relatives in another country could get involved in an investigation (Kennett, 2019; Kling et al., 2021). Genetic relations simply cross national borders and, thus, for example, banning IGG in only one country raises questions on the effectiveness of adequate governance (De Groot et al., 2021; Murphy, 2022). This results in ethical issues when chain-relatives in, for example, Europe are the key in finding an individual suspected of neonaticide in the US (where often no specific infanticide laws are in place). In the US, IGG has led to thirteen individuals charged with the murder of an infant or new-born (Dowdeswell, 2022). IGG is potentially rather effective in finding the suspect of neonaticide, because the suspect and the new-born will often have 50% of their DNA in common (neonaticide is committed by the mother in the vast majority of cases). In other criminal investigations, such as rape, the effectivity of IGG depends (among other things) on the availability of enough crime-scene DNA of the suspect to conduct a search in a consumer database. But, notably, with identification of the suspect of neonaticide, one would often only need DNA from the victim, not from the suspect. Legal systems and their ethical underpinnings vary across nations and lead to different normative evaluations, not in the least in the criminal justice system. Most notably is the current changing situation in the US on the legality of abortion: the hypothetical possibility that, through IGG, e.g., European DNA-test consumers (or even, US citizens from other US states) could serve as a chain-relative to imprison a woman who has aborted a foetus, leads to pressing social and ethical concerns. It shows once again how important it is to look beyond individual privacy to broader societal (and cross-national) implications of IGG.

Furthermore, through the lens of social privacy, risks of interstate and/or governmental surveillance can be laid bare. Interestingly, the US Department of Defense is apparently worried about the possibilities of direct-to-consumer genetic testing and surveillance. The Pentagon has advised military personnel against getting a commercial genetic test. The memo stated there was concern that “outside parties are exploiting the use of genetic data for questionable purposes, including mass surveillance (…)”(Stelloh, 2019). Furthermore, because the population that is included in police searches is now much larger (as it comprises more citizens who have not been involved with the police before), it has been argued that IGG follows a pattern of (genetic) surveillance expansion that comprises more and more citizens (Wienroth et al., 2021).

The above discussion is not to say that one criminal investigation that uses IGG would immediately affect the trust and power relations between state and citizens. Yet, the debate on IGG should be approached not from one particular IGG investigation, but from the desirability in general of such a policy. When we approach IGG from this broader perspective, it is not improbable that state-citizen relations will be affected by it. It could be that this impact will be regarded justified when all pros and cons have been weighted. My point here is simply that these broader perspectives should be taken into account.

Discussion

I have proposed to approach IGG through the lens of privacy's value to society. I have discussed several central issues for the IGG debate that a focus on social privacy enables to bring into the light; consideration for the interconnectedness, the tyranny of the minority, the crossing of different societal sectors and contexts, and the possible reshaping of societal relations including those between people and state. This approach of privacy's societal value allows to move beyond the focus on individual privacy, data protection, and individual consent. In other words, it allows to move beyond the flawed ‘individual privacy versus security’ dichotomy that the CEO Brett Williams of Verogen (the forensic sequencing company that purchased GEDmatch in 2019) has eloquently summarized: “You have a right to privacy. You also have the right not to be murdered or raped” (Arnold, 2020). In addition to the above discussed issues, I will now briefly explore other relevant aspects of the IGG debate that a social privacy approach allows consideration for.

Through the lens of the societal value of privacy, the desirability of IGG compared to population-wide DNA databases can now be assessed more systematically and effectively. This is relevant, as it is possible that IGG might in some ethical aspects be more problematic than population-wide universal DNA databases, as a universal DNA database would not disclose genetic relations and would not include the extensive genealogical DNA profiles that encompass much personal information (De Groot et al., 2021). Some authors have suggested that a universal DNA database might be less problematic in terms of privacy infringements than forensic familial searching (Dedrickson, 2017) or IGG (Hazel et al., 2018). Consideration of privacy's social value permits a comparison between IGG and population-wide DNA databases that also looks at the societal effects of both policies. Interestingly, in contrast to the debate on IGG, arguments for and arguments against population-wide genetic databases revolve around primarily societal interests on both sides of the balance. Namely, arguments in favor of universal DNA databases usually depart from the benefits for society (crime-solving) and arguments against it are primarily of the nature ‘we do not want to live in such a society’. There is in most countries a clear consensus that universal DNA databases are undesirable and there is currently no country with a population-wide genetic database. A failed attempt by Kuwait to establish such a database resulted in a strong public backlash (Katsanis, 2020; Moreau, 2019). In that sense, it is an interesting observation that the public outcry seems far less prominent in the case of IGG, although its societal implications are no less evident than they are for universal databases. Rather, it seems quite the opposite; participating in law enforcement access is often seen as an altruistic opportunity and FamilyTreeDNA has even promoted, following an abduction of a teenager, to convince their customers to participate in police access in order to help with getting the missing link (Granja, 2021).

One of the arguments in favor of a population-wide DNA database is that it is preferable if the alternative is a racially-biased forensic genetic database with extensive familial searching (Greely et al., 2006). Some have argued that IGG (with most of DNA consumers of European ancestry) may balance and complement traditional forensic DNA databases (disproportionally containing DNA profiles from people of ethnic minority groups) (Murphy, 2018), thus reducing racial skewness in police arrests (Hendricks-Sturrup et al., 2019). Indeed, as databases used for IGG contain mostly profiles from people of European descent, IGG targets suspects that are relatively less represented in forensic databases. At the same time, IGG “hardly eradicates concerns of racial inequity” (Murphy, 2022: 224). First, IGG is also used to identify crime victims, therefore making it less likely that a case concerning an African American victim will be solved compared to a victim of European descent (De Groot et al., 2021) and the composition of databases used for IGG could be an incentive for law enforcement to focus on white female victims, instead of the comparatively larger group of black male victims (Murphy, 2022). Yet, this does of course not diminish the fact that more suspects of European descent will be identified. Second, it has been pointed out that while privileged individuals of European descent have the choice to make their profiles accessible for law enforcement, racialized minorities continue to obligatory (and still disproportionally) have their DNA data stored in governmental databases (Granja, 2021). Furthermore, it could well be the case that in the future a ‘threshold’ amount of genetic information from minority groups will have been collected. For example, 23andMe actively tries to recruit African American customers to participate in research projects, such as Roots into the Future, which offered free genetic testing for ten thousand African Americans (Dickenson, 2013). Dickenson states that for commercial companies African American genotypes are a financial highly valuable ‘biocapital’ (Dickenson, 2013). If ‘enough’ genetic information of minority groups is collected, it could very well be that this group becomes even more, instead of less, at risk for being disproportionally targeted by the criminal justice system compared to majority groups. These issues point again to the importance of approaching the issue on a societal level instead of an individual one.

Although the approach of privacy's social value can be valuable for the debate on IGG, it might be that not all relevant issues are adequately addressed by it. One of these issues could be the commodification of genetic knowledge. Granja (2021) has observed that DNA test consumers, by volunteering to participate in law enforcement access, “are also creating the conditions for the establishment of a new market specialized in forensics” (Granja, 2021: 344). The analysis of privacy's social value may have to be complemented for IGG by other non-individual based approaches, such as a solidarity-based approach (Samuel, 2021; Samuel and Kennett, 2020b) or a social contract approach (Sexton et al., 2018). Still, this paper could be a valuable contribution to move the IGG debate beyond mere individual privacy interests versus the security for society. My aim has not been to argue that social privacy should always prevail in debates on the desirability of IGG (nor that it should come instead of individual privacy), but to argue that privacy's value should be considered also from this social and interconnected perspective. In that respect, its relevance is not limited to IGG. This approach might be relevant to genetic data in general. For example, forensic use of medical biobanks involves multiple ethical issues that also play on the societal level (De Groot et al., 2020). Many other debates in genetics could benefit from this societal approach to privacy as well; as the interconnectedness of this data is evident, it is becoming increasingly clear that a too individualistic approach has important limitations (De Groot, 2023; Widdows, 2007).

Conclusion

In this paper, I aimed to make a case for approaching IGG in terms of recognizing privacy as a social value (in contrast to merely an individual value). Approaching IGG from privacy's social value allows consideration of broader social issues, including informational and decisional interconnectedness, the risk of a ‘tyranny of the minority’, the involvement of multiple contexts, and the relationship between citizens and state.

This social conceptualization of privacy is an effective foundation to explore the social and ethical desirability of IGG, as the debate will not immediately fall into the simplified dichotomy of individual privacy versus security, in which the former will almost automatically lose. A social privacy approach can lay bare more fundamental ethical, political, and social concerns of this novel crime-solving technique, that extend beyond individual data control or consent.