Generally in the field of processing personal data, including genetic data, the interests and welfare of the individual have priority over the rights and interests of society. The collection, use and storage of human genetic data must therefore be in conformity with the principles of informed consent, wherever possible, and confidentiality and anonymization of personal genetic information. Genetic data should in particular not be disclosed or made accessible to third parties (employers, insurance companies, educational institutions or family) except in cases of a compelling public interest provided for under law.

Participation of family members in processes to locate their loved ones, including DNA-led processes, is therefore voluntary and subject to appropriate consent. Informed consent means that families are informed in advance of the uses that will be made of their data. Accordingly, consent forms state that genetic and other personal information will be processed for identification purposes only.

In particular, providing personal data, including genetic data, as evidence in trials constitutes a different use. ICMP policies stipulate therefore that parties to criminal trials, i.e. the prosecution or the defense, that wish to have access to personal data including DNA evidence need to specify individual missing persons cases, and relatives concerned provide their express, informed, and free consent to the use of their data in court.

To date, ICMP has collected 6,058 such consent declarations. DNA testing consent forms permit family members to decide at the time of providing personal information, including genetic information, whether or not their data may be used for purposes of criminal prosecutions.

Genetic testing carries numerous risks, including accidental loss of data, theft, manipulation or other forms of unauthorized processing, unwanted disclosure on court orders, the possibility of disclosing discrepant familial relationships to laboratory personnel, or illegal seizures of data. Such risks can discourage participation in DNA-led processes and hence prevent individuals from exercising their rights, including information about the fate of missing family members.

While informing family members of such risks is mandatory, it is also important to provide information about protective measures. At ICMP, such protective measures are pervasive and have underpinned the broad participation in ICMP’s DNA-based identification program. 

ICMP’s policies provide that personal data must be adequate, relevant and not excessive in relation to the purposes for which it is collected and processed. In addition, it may not be retained longer than necessary. It is clear, however, that in missing persons’ processes generally, and in the context of war crimes, crimes against humanity and genocide in particular, forensic evidence may have to be kept for a greatly extended period of time.

Obtaining data subject consent thus requires implementing a commensurate measure of protection. Such protections have been provided through granting ICMP, its premises, data processing systems and communications privileges and immunities under domestic and international law.

At the ICMP Conference, The Missing: An Agenda for the Future, it was proposed that an internationally protected data depository should be made available to all persons as a protective measure and to locate persons who have gone missing.