How Private Is Your Own Essence? Florida Court Issues First-Of-Its-Kind Warrant for Consumer DNA Database

A district court judge in Florida issued a warrant to law enforcement at the Orlando Police Department granting them full access to the entire database of consumer DNA samples of GEDmatch, a genealogy service with over a million users. GEDmatch complied with the warrant instantly, throwing uncertainty and turmoil into an already unregulated and murky area of consumer privacy.

DNA, or deoxyribonucleic acid, hardly needs an introduction in modern society. It is genetic material located within the nucleus of nearly every cell of every living organism, and its sequence of chemical bases provides the code or plan for every part and process of an organism. Companies like 23andME, Ancestry.com, and GEDmatch provide an immensely popular service to consumers interested in exploring familial origins, connecting with distant relations, and even gaining an insight into their own health in some circumstances. The kind of work that once took countless hours piecing information together from historic public records and family documents can now be done in an act no more difficult or even different from licking a stamp. One merely need to spit into a tube, mail it to one of these companies for analysis, and wait to be informed and connected. Ancestry.com boasts over 15 million records, 23andMe over 10 million, and GEDmatch, while one of the smaller genealogy services, sports around 1.2 million user records.

GEDmatch might be familiar to many as it was the DNA database that led law enforcement to track down one of the nation’s most prolific serial killers, the Golden State Killer, in 2018, closing a cold case of massive public interest. In that case, law enforcement used DNA samples collected from a crime scene, created an account on GEDmatch like any user would, ran the sample through a “familial search,” combed through matches, and pared down the likely suspects. Then, through corroboration with a second sample obtained from one of these suspects, made the arrest of the suspected Golden State Killer. Typically, this kind of investigation would be part of providing the grounds for establishing probable cause needed for the approval of a warrant that could then be acted on to perform a search.

Up until this warrant, much of the dialogue around law enforcement access to these databases was based on warrantless searches and the Fourth Amendment, asking whether combing these databases for potential matches was a search and whether it was reasonable. Would the courts see DNA records as extremely revealing and follow the reasoning from Carpenter v. United States, wherein the Supreme Court deemed location tracking records from the constant pinging of cell phones and cell phone towers to be of such a revealing nature that a warrant was needed to gather it? Indeed, Chief Justice Roberts, speaking for a unanimous court in Riley v. California, bluntly phrased the holding describing under what circumstances law enforcement could search an arrestee’s phone — “get a warrant.”

The news of this warrant granting full access to comb through a consumer DNA database changes the conversation. Instead of wading through reasonableness of warrantless searches of DNA records, the ability of law enforcement to hold up such a warrant is a dramatic development. Legal expert and law professor at University of Maryland Natalie Ram cited that the issue may hinge on the validity of the warrant. The Federal Rules of Criminal Procedure require, among other things, that a warrant, in relevant part, “must identify the person or property to be searched, [and] identify any person or property to seized.” A warrant for a general, thorough search of millions of consumers’ genetic information would likely not meet this standard, which is why “whether and how these warrants can be worded in order to be valid” is significant.

Ram proceeds to note a serious standing issue in challenging such a warrant: “It’s not clear whether the DNA company or a criminal defendant would have the right kind of interest in the DNA and privacy rights at issue to even be able to challenge the warrant effectively.” The challenger of the warrant would need to show a federal court that they suffered an injury that the law can redress. Perhaps a genealogy service could argue that the general searches of its DNA records harms the integrity of its business and its reputation of consumer privacy. Consumers may not know their DNA record has been process by law enforcement, and even if so, may have a hard time showing a sufficient injury. Additionally, “suspects themselves also might not have standing because it isn’t technically their DNA that law enforcement is trying to access in the database”—law enforcement would be looking for familial relationships that fit a genetic profile in order bridges more conventional or logistical gaps in their investigation. Therefore, legislators may be the only realistic route to resolution. However, to add to that challenge, the Supreme Court has not been amenable plaintiffs asserting standing in privacy harms that are not “concrete and particularized” even when a statutory right has been violated.

The warrant issued by the Florida judge signifies a court’s willingness to override the privacy policies of these consumer genealogy services. The warrant was approved in the summer, but the Orlando detective who received it announced its existence at a law enforcement conference just in the past couple of weeks. According to policy analysts at Upturn, the announcement resulted in a slew of other law enforcement officials inquiring as to how the warrant was written and approved, signaling the potential for more to come.

News of the warrant has prompted Ancestry.com and 23andMe to issue statements doubling down on their intent to vigilantly safeguard their customers’ privacy. It seems all but a given that more of these warrants will be requested and possibly approved, and that they will be directed toward bigger databases. A final complicating point is the fact that a consumer need not have been a customer of any genealogy service, because due to the similarity in DNA sequences between relatives, it is enough that even distant relations are customers. Tracking potential further warrants of this kind, directed towards DNA databases or elsewhere, and accompanying challenges through the court systems will be of profound interest not just to privacy enthusiasts but to every consumer with DNA.

Taylor Townes

November 10, 2019