Source: Stanford Law School

Genomic data used to train artificial intelligence (AI) becomes embedded within the model’s parameters, enabling re-identification of individuals and inference of health risks beyond original consent or after the subject’s lifetime. Because genomic information is inherently familial, AI models can infer traits about relatives who have not given consent or been informed, reframing privacy from unauthorized access to ongoing predictive inference. Traditional data protection laws focus on identifiable records that can be located and erased, but these approaches do not align with AI’s internal model structure that encodes learned genomic patterns.

The European Union’s right to be forgotten originated in the 2014 Google Spain case and is codified in Article 17 of the GDPR, allowing data subjects to request deletion of personal data under certain conditions. The United States lacks a federal equivalent and relies on a patchwork of state statutes like the California Consumer Privacy Act (CCPA). Both GDPR and CCPA cover genetic data as personal information but mainly address stored data or outputs, not AI’s internal parameters. The 2025 CJEU decision in EDPS v SRB held that data stripped of direct identifiers remains personal if re-identification is reasonably likely, though this reasoning applies to static datasets rather than probabilistic AI models. Machine unlearning to remove genomic data from trained models remains technically challenging, with solutions lacking scalability and efficiency. Removing one data point may affect fairness constraints across groups, and familial genomic patterns can persist in the model’s parameters even after attempted data removal.