On Purging DNA Databases of Innocents

On February 14, the San Francisco Chronicle published an important story that may have far-reaching consequences. According to the city’s District Attorney Chesa Boudin:

The San Francisco police crime lab has been entering sexual assault victims’ DNA profiles in a database used to identify suspects in crimes.

Victims of rape gave the police samples of their DNA as part of an investigation of the assault against themselves, precisely because that data helped identify the rapist through a process of elimination. Once the rapist’s DNA data was confirmed, for later identification, there was no valid reason to retain the victim’s data. But the police routinely did, adding it to their growing DNA database. So the database of criminals’ DNA includes the data of innocent people.

This came to light because one particular woman who had been raped was linked by DNA taken as part of a rape exam to a recent property crime. Boudin was informed, and shocked. He dismissed the latest charge on the grounds that the evidence leading to the arrest was gathered in a way that violated the defendant’s rights: “fruit of the poisoned tree.”

It was already public knowledge, perhaps not widely shared, that California’s police databases include DNA from hundreds of thousands of people who have never been convicted of a crime; in many cases, not even formally charged. The collection of that DNA is generally legal, but people who are eliminated from suspicion or found innocent in court have the right to have their data removed. Many of them may not know this, and the process is cumbersome. But that data really does not belong in a database of criminals’ DNA. The Center for Genetics and Society, Equal Justice Society, and myself as a token taxpayer, represented by former ACLU senior staff attorney Michael Risher, are still in the process of suing the state of California to have this data removed. The case is CGS vs. Bonta (formerly CGS v. Becerra, who was state attorney general when the case was filed).

The discovery that victims of rape have also had their genetic data included in police DNA databases raises the profile of this issue to a new level.

News about retention of the victims’ DNA spread rapidly, with reports filed by the Associated Press (1, 2, 3), The New York Times, NPR (1, 2), CNN, USA Today, US News and The Guardian, among others. KGO-TV interviewed Camille Cooper of the Rape, Abuse & Incest National Network (RAINN), who was “absolutely horrified that this is happening, absolutely horrified” and stressed that

From our perspective, this is a violation of a victim’s right to privacy. This would have a very chilling effect on the ability and the desire of victims to come forward and report to the police.

I also think that it’s very important for survivors, at this point, that when they do seek medical care, to make it very clear that they are not consenting to the use of their DNA in this way.

Even San Francisco Police Department Chief Bill Scott rather grudgingly (“if it’s true”) committed to ending the practice of using a victim’s DNA “to identify and apprehend that person as a suspect in another crime.”

The Washington Post published a commentary on the revelation by Jennifer King, a privacy and data policy fellow at the Stanford Institute for Human-Centered Artificial Intelligence. At least in California, she noted, oversight of police databases (if any) is generally conducted at the county level. Moreover, the voluntary public use of genealogical DNA testing, although conducted only by a minority of the population, has already produced “staggeringly extensive” familial networks, such that soon a huge proportion of the public (especially those with European ancestry) could be identifiable through these relationships. She concluded:

Nobody wants suspected rapists and murderers to evade justice. But widespread DNA collection without cause and without constraint is not the answer.

It is possible that these new revelations may lead to changes in California law. State Senator Scott Wiener, whose constituency includes San Francisco, immediately tweeted:

Getting a rape kit can be re-traumatizing. Having that DNA placed in a database for future use creates yet another incentive not to do it. It’s unacceptable.

We’re determining whether a change in state law is needed to prevent this from happening again.

Wiener had already demonstrated interest in the reform of criminal law, and is reported as working with the District Attorney and San Francisco Supervisor Hillary Ronen “to introduce legislation to prevent DNA evidence from a victim’s rape kit to be used for anything other than investigating that crime.”

Why not expand that, first to deleting DNA samples from rape victims as soon as they are no longer needed, certainly once the rapist has been identified; and then to deleting all DNA samples that do not belong either to convicted criminals or to people currently under specific investigation?

And then go national. There is an unsatisfactory patchwork of state legislation, for example about the extent to which police can access private genealogical DNA databases. In 2021, Maryland and Montana were the first U.S. states to pass any laws that make it harder for law enforcement to access DNA databases. Maryland limits their use to serious crimes (such as murder, kidnapping and human trafficking), while Montana requires “a search warrant issued by a court on a finding of probable cause” unless the person whose information is wanted has waived the right to privacy.

In California, there are an estimated 750,000 people eligible to have their DNA removed from police databases. Fewer than 1,500 people have successfully received a DNA expungement. As the San Francisco Chronicle wrote in an editorial about the lawsuit on December 15, 2018:

The burden for fixing a problem the state created should rest with the state.