Genomic Data Checklist: Consent Scope and Withdrawal, Sample and Data Retention, Research and Commercial Use Terms, Third-Party Access Requests, and Reidentification Response

By Casey Scott McKay · 2024-08-08

A ten-phase working checklist for consumer genomics companies, clinical laboratories, biobanks, and the partners who license genomic databases. Phases one through three build the inventory, the consent version register, and the layered consent architecture. Phases four and five settle retention and regulatory classification. Phases six through eight cover research and commercial licensing, third-party access requests, and disclosure obligations. Phases nine and ten cover security and reidentification response, and protecting the assets that are genuinely ownable. Each phase closes with a gate.

IP and Technology > Privacy Data Security | Checklist | Published 8 August 2024 - Updated 5 January 2025 | Casey Scott McKay - marksy.us

How to use this checklist

Begin from three facts that shape everything below.

The consent is the load-bearing document. Property law gives the participant very little — Moore v. Regents of the University of California and Washington University v. Catalona both locate control in the institution — which means what the company may do is defined by what it promised.

There is never only one consent. A company with any history has several versions and several participant populations, and every new use must clear all of them.

The people most affected are not parties. Relatives are disclosed by a participant's test, were never asked, and have no remedy. No drafting fixes this; conservative practice manages it.

The doctrinal background is The Most Personal Data There Is; the operational treatment with worked engagements is Advising a Genetic Testing or Genomics Business; the cluster is assembled in the Consumer Genomics and Genetic Data Toolkit.

Phase 1. Inventory what is held

[ ] Separate the four objects: the physical sample, the raw genotype or sequence data, the derived interpretations, and the relational matching information. They have different risks and different governing terms.
[ ] Record where each lives, including laboratory storage, production systems, analytics warehouses, backups, and any vendor environment.
[ ] Identify what the product claims — ancestry, traits, wellness, health risk, or pharmacogenomics — since this drives the regulatory classification in Phase 5.
[ ] List every recipient of data: commercial partners, academic collaborators, service providers, and any party that received a research dataset. Academic recipients are typically the least documented.
[ ] Record the jurisdictional footprint of the participant population, since genetic data regulation diverges sharply and participants arrive from markets nobody decided to enter.
[ ] Collect every public statement about anonymity, security, deletion, and law enforcement, from the website, the marketing materials, and support scripts.
[ ] Establish what happens on acquisition or insolvency under the current documents, and note it if the answer is nothing.
[ ] [Gate] Somebody can state, in one page, what the company holds, where it is, and who else has a copy.

Phase 2. Build the consent version register

[ ] List every consent version with its live dates, its participant population, and what it permits.
[ ] Reconstruct the historic versions from archives, source control, or web archives if they were not retained, because the reconstruction will be needed and is harder later.
[ ] Map each current use to each version, producing a grid rather than a conclusion. The cells that fail are the work.
[ ] Flag uses that clear the current consent and fail an earlier one, which is the most common finding and the one most often missed.
[ ] Record the reasoning for every determination that a use falls within a consent, since the reasoning is what a regulator or a journalist will ask for.
[ ] Establish a change process requiring the grid to be re-run before any new use launches.
[ ] [Gate] No use is live that has not been tested against every consent version under which affected participants enrolled.

Phase 3. Layer the consent architecture

[ ] Separate testing consent from research consent, so a participant may take the product without the research and so a challenge to one does not unravel the other.
[ ] Separate research consent from commercial partnership consent, because participants distinguish sharply between science and a named company's programme.
[ ] Separate sample retention from data retention, since they are different objects and a participant may reasonably choose differently.
[ ] Make relative-matching opt-in and separate, as the feature with the largest external effect and the least participant understanding.
[ ] Name who may use the data in categories a participant could recognise, rather than "our partners".
[ ] State the purposes specifically enough that a participant could tell whether an announced project is inside or outside them.
[ ] State the form — identified, coded, or aggregate — and what each means in practice.
[ ] State the commercial position honestly, including that the participant will not share in proceeds.
[ ] State the withdrawal right accurately: prospective, with defined effect on work already done.
[ ] State the re-contact position, including whether clinically significant findings will be returned and whether the participant may decline.
[ ] Consider voluntary review board oversight, since the Common Rule at 45 C.F.R. Part 46 does not automatically reach a private company's internal research and adopting it answers the question of who reviewed this.
[ ] [Gate] Each layer could stand alone, and a participant could decline any one of them and still receive the product they paid for.

Phase 4. Retention and deletion

[ ] Decide the sample's fate and state it: destroyed after analysis, retained for a stated period, or retained indefinitely with a destruction right. Silence is the only indefensible option.
[ ] Set retention periods with stated reasons, since indefinite retention without justification is the hardest position to defend.
[ ] Distinguish sample destruction from data deletion in the document and in the process, because customers assume one implies the other.
[ ] Map deletion end to end before promising it: account, reports, raw data, sample, analytics warehouse, backups, trained models, delivered research datasets, and partner copies.
[ ] Test the map with an actual request rather than assuming, since most companies clear production and believe they are finished.
[ ] State what deletion cannot reach — research already performed, published results, models already trained — in the consent rather than in a later apology.
[ ] Address acquisition and insolvency expressly, or the disposition of the biobank will be decided by a court and a purchaser. See When Your Licensor Goes Bankrupt.
[ ] Record request outcomes and timestamps, since the request log is the evidence that the programme functions.
[ ] [Gate] A deletion request removes the participant from every system the notice says it will, provably, within the stated window.

Phase 5. Regulatory classification

[ ] Determine whether the product is a device requiring clearance under the framework at 21 U.S.C. § 360, noting that drift from traits into health risk is the common route across the line. See The Device and the Approval and the Medical Device and Diagnostics IP Toolkit.
[ ] Determine whether health privacy applies under 45 C.F.R. Part 164, remembering that most direct-to-consumer testing sits outside it as a gap rather than an exemption. See The App That Knows Your Diagnosis, Building a Digital Health Product, and the Digital Health Data Checklist.
[ ] Determine whether the activity is human subjects research under 45 C.F.R. Part 46.
[ ] Confirm genetic data is sensitive under the applicable state statutes, requiring affirmative consent and providing deletion rights, and check for state genetic-privacy statutes specific to direct-to-consumer testing. See The State Privacy Wave, Standing Up a Multi-State Privacy Compliance Program, and the State Privacy Compliance Toolkit.
[ ] Record that 15 U.S.C. § 45 applies regardless, reaching deceptive statements about privacy, security, and accuracy.
[ ] Write a classification memorandum stating which framework applies, why, and what change of facts would alter the answer.
[ ] Set a trigger review for product changes that could cross a classification line.
[ ] [Gate] The compliance posture follows from a written classification, not from an assumption.

Phase 6. Research and commercial licensing

[ ] Understand what is being licensed. Not property: facts about sequences are unprotectable under Feist Publications, Inc. v. Rural Telephone Service Co., with thin compilation protection at 17 U.S.C. § 103. What is controlled is access, curation, and the participant relationship. See Selling Something You Cannot Own and Who Owns the Data.
[ ] Structure access rather than transfer wherever possible: query rights, aggregate returns, cohort identification with re-contact through the company, or analysis inside a controlled enclave.
[ ] Define permitted research scope, retention after term, combination with other sources, and publication rights.
[ ] Settle invention ownership before signature, since a target identified using the database produces patents and the default favours the partner. See Whose Invention Is It and the Data Licensing Checklist.
[ ] Prohibit reidentification with reporting obligations, audit rights, and a termination right.
[ ] Define what happens on participant withdrawal mid-programme, before the programme starts.
[ ] Test the deal against every consent version and decide re-consent or notice accordingly.
[ ] Prepare the participant explanation before the announcement, since the questions arrive within hours.
[ ] [Gate] No dataset leaves under terms the consent does not support, and no partner holds rights the participants were not told about.

Phase 7. Third-party access requests

[ ] Adopt a law enforcement policy before the first request, choosing among: prohibit entirely; permit with participant opt-in; permit by default with opt-out; or operate openly. All four are defensible; a stated position that differs from the practice is not.
[ ] Match the published terms to the practice, and update both together whenever either changes.
[ ] Analyse process rather than complying reflexively, considering scope, jurisdiction, and the application of 18 U.S.C. § 2701.
[ ] Consider notice to affected participants where the process permits, and record the decision either way.
[ ] Note that the constitutional question is unsettled, with Carpenter v. United States narrowing the third-party doctrine for comprehensive data and the extension to voluntarily uploaded genetic data untested — and the relatives most affected having uploaded nothing.
[ ] Handle foreign process separately, since a practice acceptable in one jurisdiction is a serious intrusion in another. See the Cross-Border IP Litigation Toolkit.
[ ] Publish transparency reporting, because disclosure of the practice damages less than discovery of it.
[ ] Log every request and its outcome, since consistency across requests is itself a defence.
[ ] [Gate] The policy exists in writing, matches the terms, and has been applied to at least one hypothetical before a real request arrives.

Phase 8. Disclosure and discrimination

[ ] Confirm the coverage of 42 U.S.C. § 2000ff: employment and health insurance, and not life, disability, or long-term care insurance.
[ ] Tell consumers the life insurance point, because most do not know it and a company that discloses it is doing something both correct and differentiating.
[ ] Note that manifested conditions fall outside the genetic framework and move to disability and health insurance law.
[ ] Note that relatives have no standing anywhere in the framework, and be able to say so plainly.
[ ] Publish a plain-language disclosure page covering the seven things a person should know before testing: permanence, relatives, partial deletion, bounded de-identification, the insurance gap, commercial licensing, and what happens on a sale of the business.
[ ] Align marketing to the disclosure page, since a claim inconsistent with it is a deception exposure under 15 U.S.C. § 45.
[ ] Train support staff on the answers, because the first person to be asked these questions works in customer service.
[ ] [Gate] A prospective customer could find, in plain language, everything they would need to decide.

Phase 9. Security and reidentification response

[ ] Recognise that a breach here is not remediable. Passwords reset; genomes do not.
[ ] Recognise the affected class exceeds the customer list, since relatives are exposed and cannot be notified.
[ ] Implement multi-factor authentication, since credential stuffing against reused passwords is the sector's characteristic incident and its absence is very hard to defend afterwards.
[ ] Constrain relative-matching exposure from a compromised account.
[ ] Do not promise anonymity. Use governance instead: controlled access, data use agreements prohibiting reidentification, secure enclaves without egress, and audit rights.
[ ] Set aggregation thresholds for released outputs and enforce them in the system rather than the policy.
[ ] Document the residual risk assessment, because reasoning recorded is worth far more than a conclusion asserted.
[ ] Treat security marketing as representation under 15 U.S.C. § 45.
[ ] Build the incident response plan for this sector's specifics — permanence, relatives, and media attention. See The First Seventy-Two Hours, Running a Data Breach Response, the Incident Response Checklist, and the Incident Response and Breach Notification Toolkit.
[ ] [Gate] Nothing in the public materials claims a level of protection the architecture does not deliver.

Phase 10. Protect what is ownable

[ ] Enumerate the interpretation methods — ancestry inference, trait prediction, polygenic risk scoring, relative matching — as trade secrets under 18 U.S.C. § 1836, with the reasonable measures required by 18 U.S.C. § 1839.
[ ] File selectively and expect the eligibility screen. Association for Molecular Pathology v. Myriad Genetics, Inc. removes isolated genomic DNA; Mayo Collaborative Services v. Prometheus Laboratories, Inc. removes diagnostic correlations plus conventional steps; Alice Corp. v. CLS Bank International applies to the computational layer; Diamond v. Chakrabarty preserves engineered organisms; Funk Brothers Seed Co. v. Kalo Inoculant Co. marks the natural-principle limit.
[ ] Test genus claims against 35 U.S.C. § 112 written description before filing, since that is where they usually fail, within the eligibility frame of 35 U.S.C. § 101. See Claiming Life, Protecting a Biotechnology Invention, and the Biotechnology IP Checklist.
[ ] Protect the phenotype layer, which is the company's own collection and the reason the genomic data is valuable.
[ ] Protect the participant relationship, since the re-contactable consented cohort is the asset a partner is really buying.
[ ] Register the brand under the ordinary programme, since in a business whose product is trust the mark is unusually load-bearing. See the Trademark Portfolio Management Toolkit.
[ ] Do not attempt to claim ownership of the sequence data itself.
[ ] [Gate] The protectable assets are enumerated and controlled, and nobody is relying on a property right that does not exist.

Incidental findings

[ ] Decide the policy before it arises, because it will.
[ ] Address clinical findings: whether returned, whether the participant may decline, and what falls inside and outside the product's stated scope.
[ ] Address misattributed parentage through product design, since it is the most common consequential finding in consumer ancestry testing and no framework governs it. Opt-in relative matching, a warning before a match is displayed, and trained support staff do more than any paragraph.
[ ] Address findings about relatives honestly: no mechanism exists to inform them and no duty exists to try.
[ ] Record the reasoning, since these decisions are ethical as much as legal and the record is what demonstrates they were made rather than defaulted into.
[ ] [Gate] A support agent receiving a distressed call about an unexpected relative match knows exactly what to say.

The ninety-day sequence

[ ] Weeks one to two — Phase 2. The consent version register. It determines everything else, and companies routinely discover a use in flight that one cohort's consent does not cover.
[ ] Weeks two to four — Phase 4. The deletion map, tested with a real request. Cheap, diagnostic, and it surfaces the operational gaps that convert routine requests into enforcement matters.
[ ] Weeks four to six — Phase 5. The classification memorandum, which determines what the rest of the programme costs.
[ ] Weeks six to ten — Phase 3. The consent suite, drafted once the register has shown what must change.
[ ] Weeks ten to twelve — Phases 7, 8, and 9. The law enforcement policy, the disclosure page, and the incident plan.
[ ] Ongoing — Phases 6 and 10 as the business requires.
[ ] [Gate] At twelve weeks the company knows what it may lawfully do, what it has promised, and what it cannot deliver.

The annual review

[ ] Re-run the consent grid against current uses, since products release faster than consents are revised.
[ ] Re-test the deletion map against the current architecture, which will have added systems.
[ ] Refresh the recipient register, since academic collaborators multiply quietly.
[ ] Re-read the public statements against what is now true.
[ ] Re-test the law enforcement policy against the published terms.
[ ] Re-check the classification where the product has drifted.
[ ] Check the jurisdictional footprint for markets entered by accident.
[ ] Audit the incidental findings practice against the stated policy, including what support actually says.
[ ] Reconcile the sample inventory against the retention policy, since laboratories retain material for operational reasons that outlast stated periods.
[ ] [Gate] Nothing in the file is more than twelve months old and unverified.

Failures this checklist prevents

[ ] The partnership announced under a consent one cohort never gave. Phase 2.
[ ] The deletion that cleared production and left the warehouse. Phase 4.
[ ] The anonymity claim that a reidentification study disproves. Phase 9.
[ ] The law enforcement policy that differs from the published terms. Phase 7.
[ ] The product that drifted into health claims without anyone reconsidering classification. Phase 5.
[ ] The credential-stuffing incident that exposed a matching network. Phase 9.
[ ] The customer who discovered misattributed parentage from an interface with no warning. Incidental findings.
[ ] The acquisition that transferred a biobank the consent never contemplated transferring. Phases 1 and 4.
[ ] The genus claim that failed written description after two years of prosecution. Phase 10.

Party-specific short forms

The consumer genomics company

[ ] All ten phases, with Phase 2 first, because the consent grid determines whether anything else is lawful.
[ ] Treat Phases 4 and 9 as the operational priorities, since deletion and security are where the routine failures happen.
[ ] Treat Phase 3 as the durable investment, because a layered consent survives product changes that a monolithic one does not.

The clinical laboratory

[ ] Phases 1, 4, 5, 9, 10, with a much clearer framework at 45 C.F.R. Part 164 and less ambiguity throughout.
[ ] Focus on residual specimen use, which is the recurring question: material accumulates, is valuable, and was collected under terms that did not contemplate research.
[ ] Note that reporting runs to the ordering physician, which changes the incidental findings analysis substantially.
[ ] Watch the laboratory developed test question under 21 U.S.C. § 360, where the position has shifted repeatedly.

The research biobank

[ ] Phases 2, 3, 4, 6, under 45 C.F.R. Part 46 with review board oversight already in place.
[ ] Focus on the data use agreements, since academic norms and commercial terms conflict on retention, publication, and onward sharing more than anywhere else.
[ ] Address material transfer separately from data transfer. See the Technology Transfer Checklist, Negotiating University and Research Institution Agreements, and the University and Research Institution IP Toolkit.

The licensee or acquirer

[ ] Phase 2 first, from the outside. Ask for the consent version register; it tells you what you are actually buying.
[ ] Ask for the deletion map and the request log, which together show whether the rights machinery functions.
[ ] Ask what has been promised about transfer, since a consent silent on change of control is a problem you inherit and one that promised no transfer is a problem you cannot fix.
[ ] Price the re-consent exercise where the target's consents will not support your intended use. See the IP Due Diligence Toolkit.

The international overlay

[ ] Check for special-category treatment with explicit basis requirements, varying research exemptions, and transfer restrictions a cloud-hosted service engages immediately.
[ ] Check for prohibitions on direct-to-consumer health testing, or physician-order requirements, which change the product rather than the paperwork.
[ ] Check for comprehensive insurance restrictions covering life and disability cover.
[ ] Check for database-specific regulation — registration, oversight, or export restriction — applying to the database as an object.
[ ] Check sample export controls, sometimes under public health law and sometimes under genetic resource frameworks designed for non-human material. See the Biotechnology and Synthetic Biology IP Toolkit.
[ ] Segment early, since some of these require product changes and retrofitting costs materially more than designing for them.
[ ] [Gate] The company knows which jurisdictions it is actually operating in, rather than which it intended to.

The ten documents

[ ] The consent suite, layered, each layer standing alone.
[ ] The consent version register, with live dates, populations, and permitted uses.
[ ] The deletion map, tested, with the honest statement of what deletion cannot reach.
[ ] The recipient register, listing every party that received data and whether it still holds it.
[ ] The law enforcement policy, matched to the published terms.
[ ] The classification memorandum, with trigger conditions for review.
[ ] The reidentification risk assessment, documenting governance rather than asserting anonymity.
[ ] The incidental findings policy, covering clinical findings, parentage, and relatives.
[ ] The incident response plan, adapted for permanence and unreachable relatives.
[ ] The consumer disclosure page, stating the seven things a person should know before testing.
[ ] [Gate] All ten exist, are current, and would be defensible if published together.

What good looks like

[ ] The company can say how many consent versions exist and who sits under each.
[ ] A deletion request removes the participant from every system the notice names, provably.
[ ] Every recipient of data is listed, with terms and retention status.
[ ] The law enforcement policy and the published terms say the same thing.
[ ] Nothing public claims anonymity, and the residual risk assessment exists.
[ ] A support agent can answer the parentage question without improvising.
[ ] The classification is written down, with the conditions that would change it.

Seven statements. The companies that can make all seven survive their first public controversy with their participants intact.

A note on proportion and on tone

[ ] Scale the programme to the activity. A laboratory performing physician-ordered testing with no research programme needs Phases 1, 4, 5, 9, and 10.
[ ] Never scale down Phase 2. The consent grid is the document that makes everything else defensible, and it takes a fortnight.
[ ] Never scale down Phase 4's deletion test. Promising what the architecture cannot deliver is the sector's most avoidable exposure.
[ ] Advise conservatively as a default, not because the aggressive reading would fail in court but because in this sector the reputational failure arrives first, arrives faster, and arrives among people who were never asked to agree to anything.
[ ] [Gate] Client and adviser have agreed in writing which phases are in scope, and the reasons are recorded rather than assumed.

Three worked applications

The deletion request

A participant demands deletion of everything.

[ ] Run Phase 4's map, not the support script. Account, reports, raw data, sample, warehouse, backups, models, delivered datasets, partner copies.
[ ] Compare what can be done against what the consent promised. Where the promise exceeds the capability, that is a live deception exposure requiring prospective amendment rather than a one-off apology.
[ ] Answer honestly and specifically, listing what has been deleted and what has not, rather than confirming completion.
[ ] Notify partners with an obligation to delete, and record their confirmations.
[ ] Log the request with timestamps, since consistency across requests is what demonstrates a functioning programme.
[ ] Fix the pipeline gap the request revealed, because it will recur.

The commercial partnership

A pharmaceutical partnership is signed and an announcement is scheduled.

[ ] Run the Phase 2 grid against every consent version. Participants from year one may not have agreed to this.
[ ] Decide re-consent or notice with genuine choice, and record the reasoning rather than defaulting to the cheaper option.
[ ] Settle invention ownership and any participant-benefit position under Phase 6 before signature, since both will be asked about.
[ ] Prepare the participant explanation and the press response together, and confirm they say the same thing.
[ ] Brief support in advance, because the volume of enquiries arrives within hours.
[ ] Expect the consent architecture to be read in public during the following week.

The unexpected relative

A customer contacts support having discovered a previously unknown half-sibling.

[ ] Confirm the interface warned before the match was displayed. If it did not, that is a product finding rather than a legal one, and it is the fix that matters.
[ ] Confirm support has a script written with input from someone who understands the distress involved.
[ ] Confirm relative matching was opt-in, and if it was not, reconsider that under Phase 3.
[ ] Record the contact, since the volume of these is the evidence for whether the product design is adequate.
[ ] Resist the instinct to treat it as a complaint to be closed. It is a signal about the product, and it is the sector's most common source of genuine harm.
[ ] Note that the affected relative is not a customer and has no remedy, which is why the design decision carries the weight.

Diligence questions for a buyer or investor

[ ] Ask for the consent version register first. It tells you which participants may lawfully be included in which uses, which is what the database is actually worth.
[ ] Ask what has been promised about transfer on a change of control. A consent silent on the point is a problem you inherit; one that promised no transfer is a problem you cannot fix.
[ ] Ask for the deletion map and the request log, which together show whether the rights machinery functions or merely exists.
[ ] Ask for the recipient register and confirm which partners still hold copies and under what terms.
[ ] Ask for the classification memorandum, and if there is none, treat the regulatory position as unassessed rather than compliant.
[ ] Ask how many law enforcement requests have been received and what was done with them.
[ ] Ask what the company has said publicly about anonymity, security, and deletion, and test each statement against the architecture.
[ ] Ask about the reidentification risk assessment, since its absence indicates the anonymity claim was asserted rather than reasoned.
[ ] Price the re-consent exercise where the consents will not support the intended use, since that cost is knowable while historic exposure is not. See the IP Due Diligence Toolkit.
[ ] [Gate] The buyer knows which cohorts may lawfully be used for what, and has priced the rest.

Evidence habits worth building

[ ] Archive every consent version with its live dates and population. This single record answers more questions in an inquiry than any other.
[ ] Keep the deletion request log with channel, timestamp, and per-system completion.
[ ] Keep the recipient register current, including academic collaborators who rarely report back.
[ ] Version the public statements, since what the site said in a given year determines the analysis for that year.
[ ] Log law enforcement requests and outcomes, since consistency is a defence and inconsistency is a finding.
[ ] Record incidental findings contacts, which are the evidence for whether the product design is working.
[ ] Keep the sample inventory reconciled against the stated retention policy.
[ ] [Gate] Seven records exist, are owned by named people, and would survive a system migration.

Five questions to open every file with

[ ] How many consent versions do you have, and who sits under each? Phase 2.
[ ] What exactly happens when someone asks you to delete everything? Phase 4.
[ ] Who has received data from you, and do they still hold it? Phases 1 and 6.
[ ] What is your law enforcement policy, and does it match your terms? Phase 7.
[ ] What have you said publicly about anonymity? Phase 9.

Five questions, answerable in a week, and between them they identify almost every exposure this checklist addresses.

[ ] And a sixth, which no client has prepared for: if a participant's sibling contacted you tomorrow objecting to the disclosure of information about them, what would you say? There is no legal answer, which is why the question is worth rehearsing before somebody else asks it.
[ ] [Gate] All six have been asked of a person who could actually answer, and the answers are written down and dated.

The publication test

[ ] Apply it to every consent document and every internal note explaining what the document was designed to permit. Would the company be comfortable if both were published together tomorrow?
[ ] Treat a hesitation as the finding. The paragraph that causes it is the paragraph to rewrite, and identifying it is more useful than any opinion on whether it would survive a challenge.
[ ] Apply the same test to the law enforcement policy, the deletion promise, and the anonymity claim.
[ ] Note that in this sector the test approximates the operative standard, because disputes here are resolved in public before they are resolved anywhere else and because the people most affected never signed anything.
[ ] [Gate] Every participant-facing document would survive publication alongside the reasoning behind it.

That is the discipline this checklist encodes: draft for publication, record the reasoning, test every use against every consent generation, and treat the relatives who were never asked as though they were in the room.

Do all four consistently and the difficult questions in this field become manageable; skip any one and they do not.

The consent register, the tested deletion map, and the honest disclosure page are where the discipline becomes visible to somebody other than the lawyer who built it.

Key Authorities at a Glance

Control over biological material rests with the institution rather than the donor — Moore v. Regents of the University of California and Washington University v. Catalona — which leaves the consent document doing the work property law does elsewhere. There is no property in the sequence data itself under Feist Publications, Inc. v. Rural Telephone Service Co. and 17 U.S.C. § 103; trade secrecy under 18 U.S.C. § 1836 and § 1839 protects the interpretation layer instead.

Patentability is constrained by Association for Molecular Pathology v. Myriad Genetics, Inc., Mayo Collaborative Services v. Prometheus Laboratories, Inc., Alice Corp. v. CLS Bank International, Diamond v. Chakrabarty, and Funk Brothers Seed Co. v. Kalo Inoculant Co., within 35 U.S.C. § 101 and § 112.

The regulatory frame is partial: 45 C.F.R. Part 46, 45 C.F.R. Part 164, 21 U.S.C. § 360, 42 U.S.C. § 2000ff, and the residual authority at 15 U.S.C. § 45. Government access runs through 18 U.S.C. § 2701 with Carpenter v. United States, and private claims through Spokeo, Inc. v. Robins and TransUnion LLC v. Ramirez.

| Authority | Phase | | --- | --- | | Moore v. Regents of the University of California | 4 — no conversion claim in excised tissue | | Washington University v. Catalona | 4 — institutional control of samples | | 45 C.F.R. Part 46 | 3, 5 — Common Rule consent and oversight | | 45 C.F.R. Part 164 | 5 — health privacy where covered | | 21 U.S.C. § 360 | 5 — device classification | | 15 U.S.C. § 45 | 5, 8, 9 — deceptive representations | | Feist Publications, Inc. v. Rural Telephone Service Co. | 6, 10 — no property in the data | | 17 U.S.C. § 103 | 6 — thin compilation protection | | 18 U.S.C. § 2701 | 7 — compelled disclosure | | Carpenter v. United States | 7 — third-party doctrine narrowed | | 42 U.S.C. § 2000ff | 8 — non-discrimination and its gaps | | Spokeo, Inc. v. Robins | 9 — concrete harm | | TransUnion LLC v. Ramirez | 9 — standing limits | | 18 U.S.C. § 1836 | 10 — trade secret claim | | 18 U.S.C. § 1839 | 9, 10 — reasonable measures | | Association for Molecular Pathology v. Myriad Genetics, Inc. | 10 — isolated DNA | | Mayo Collaborative Services v. Prometheus Laboratories, Inc. | 10 — diagnostic correlations | | Alice Corp. v. CLS Bank International | 10 — the computational layer | | Diamond v. Chakrabarty | 10 — engineered organisms | | Funk Brothers Seed Co. v. Kalo Inoculant Co. | 10 — natural principles | | 35 U.S.C. § 101 | 10 — eligibility | | 35 U.S.C. § 112 | 10 — written description |

Further reading is collected at genetic data consent architecture, genomic database licensing, investigative genetic genealogy policy, genomic reidentification risk, and biobank retention policy.