Data generated by its citizens as a national asset...

The following statement in a Harvard Business Review (HBR) article, which was published on December 18, 2019, caught my eye,
"India is a nation state, it would treat the data generated by its citizens as a national asset, store and guard it within national boundaries, and reserve the right to use that data to safeguard its defense and strategic interests."[1]  The HBR article is about India's proposed legislation to protect its consumer data. The bill is called the Personal Data Protection Bill (DBP).

On December 24, 2019, The New York Times published an article called Pentagon Warns Military Personnel Against At-Home DNA Tests.[2] The article discusses a Department of Defense internal memo which discourages military personnel from taking mail-in DNA tests.  According to DoD leadership, they:

• Are unreliable;
• Negatively impact service members' careers; and 
• Create security risks.

I am not sure if there is any relationship between the two articles, but it highlights the dangers of international privacy laws, which are still evolving.  I believe our DNA information is our most private and personal information.  If countries like India push laws like the DBP,  which can use its citizens' personal information, including DNA for national and strategic interests, then folks to be careful about their personal data.  Nations cannot use their citizens' data if the data isn't generated.

The next question to ask if these laws will get less complicated.   The answer lies in the history of privacy laws.

According to the HBR article's authors, the proposed DBP is based on the European Union's (EU) General Data Protection Regulation (GDPR).  According to an EU website, the GDPR was released on May 24, 2016, and the EU enforced the GDPR on May 25, 2018.[3] The EU used the US Department of Commerce's National Institution of Standards and Technology (NIST) recommendation called Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) (Special Publication 800-122)[4], which was released in April 2010.  The state of California issued the California Consumer Privacy Act (CCPA) in June 2018.  The CCPA is based on GDPR with modifications.[5]

With each data regulation, bill, and recommendation released over time, nations and states are trying to protect its citizens and their data, but countries (like India, China, and others) may use the data to further political and national security reasons.

As members of the digital age, we cannot cut off ourselves from the internet, but we need to be aware of the risks, policies, and rights since they are constantly evolving like the technologies around us.  Military and other governments may ask their citizens to share their DNA for the good of their countries. Still, I am not a fan of businesses monetizing, or criminal syndicates stealing my data. I believe privacy laws, in general, are good, but we in the US need a cohesive single data protection legislation and a watchdog organization that focuses on digital privacy.  I am not a policy wonk, but I believe national and international privacy laws need to mature as data grows exponentially, and technologies like artificial intelligence proliferate our lives in the next ten years.

Until then, please be careful what you share on the web, including your DNA results.  Currently, our DNA information in the US is protected via the Genetic Information Nondiscrimination Act of 2008 (GINA) [6]. That being said, presidents change, legislators change, supreme government justices change, governments may change, but your DNA information doesn't change.

---

[1] Govindarajan, V., Srivastava, A., & Enache, L. (2019, Dec., 18). How India Plans to Protect Consumer Data. Retrieved from https://hbr.org/2019/12/how-india-plans-to-protect-consumer-data.
[2] Murphy, H., & Zavehri, M. (2019, Dec. 24). Pentagon Warns Military Personnel Against At-Home DNA Tests. The New York Times. Retrieved from https://www.nytimes.com/2019/12/24/us/military-dna-tests.html.
[3] Data protection in the EU | European Commission.  Retrieved from https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en.
[4] McCallister, E., Grance, T., & Scarfone, K. (2010, Apr.). Guide to Protecting the Confidentiality of Personally Identifiable Information (PII). NIST Special Publication 800-122. Retrieved from https://csrc.nist.gov/publications/detail/sp/800-122/final.
[5] Korolov, M. (2019, Oct. 4). California Consumer Privacy Act (CCPA): What you need to know to be compliant. Retrieved from https://www.csoonline.com/article/3292578/california-consumer-privacy-act-what-you-need-to-know-to-be-compliant.html.
[6] The Genetic Information Nondiscrimination Act of 2008 (2008, May 21). U.S. Equal Employment Opportunity Commission (EEOC). Retrieved from https://www.eeoc.gov/laws/statutes/gina.cfm.
[7] Picture for this blog post retrieved from https://pixabay.com/illustrations/dna-matrix-genetics-control-3888228/.