Credits: the author
By: Taner Kuru
This blogpost draws upon a conference presentation entitled ‘The Good, The Bad, and The Ugly: Choosing the (Correct) Legal Basis for Investigative Genetic Genealogy in Europe’ presented at EAFS 2025. This conference aimed to bring together practitioners, scientists, experts, and other stakeholders actively involved in forensic science to showcase the latest developments in the field. The author’s conference attendance was facilitated by a conference attendance grant from the Netherlands Network of Human Rights Research (NNHRR).
Investigative Genetic Genealogy: Reigniting Hope for Unsolved Cases
On October 19th, 2004, Linköping, a city in southern Sweden, was shaken to its core by the news of the murder of an eight-year-old boy and a 56-year-old woman. Despite the existence of DNA evidence, the perpetrator managed to evade identification for years, even after extensive efforts by investigators. Still, investigations continued relentlessly for several years, eventually turning the case into the second-largest investigation in the nation’s history. Nevertheless, this search ultimately came to an end after a suspect was arrested and found guilty in 2020. The identification of the suspect was made possible through DNA evidence. However, he was not identified through conventional methods, such as comparing DNA extracted from the crime scene against profiles stored in the national forensic DNA database, or through searches in the Prüm framework. Instead, the identification occurred through a pilot project conducted by the Swedish Police. This project aimed to utilise personal data stored in privately owned genetic genealogy databases, specifically GEDmatch and FamilyTreeDNA, for criminal investigations.
The inspiration for this pilot project, as noted by the Swedish Police, came from across the Atlantic. Specifically, it was the arrest of the Golden State Killer, who was responsible for dozens of serious crimes committed in California during the 1970s and 1980s, that inspired the pilot. As in the Linköping double murder investigation, the investigators in the Golden State Killer case had the DNA profile of the suspect, but found no matches in CODIS. This changed when investigators uploaded the profile of the suspect to GEDmatch (and allegedly to other databases), resulting in distant familial matches. Genealogists then constructed family trees of these individuals using traditional genealogy methods, which eventually led them to Joseph James DeAngelo, a former police officer, as the primary suspect. He was ultimately sentenced to life imprisonment without the possibility of parole in August 2020.
The successful identification of the Golden State Killer after nearly four decades made its way to international news headlines. Investigators from and beyond the United States began to experiment with this novel and promising investigation technique called ‘investigative genetic genealogy’. In fact, it is reported that the technique has already been used in more than a thousand cases so far, and this number continues to grow. While the majority of these cases are reported from the United States, other countries, including Canada, Australia, and New Zealand, also appear to be using this new method in an effort to solve their cases.
While Sweden was the first European country to utilise investigative genetic genealogy to solve a case, this trend was soon adopted by other jurisdictions in Europe. For example, it was reported that Norway and France have also successfully identified perpetrators thanks to investigative genetic genealogy, and the Netherlands is currently running a pilot project with this technique in two investigations. Furthermore, Denmark has recently introduced a law to authorise the utilisation of genetic genealogy databases in criminal investigations as of July 1st, 2025, and the feasibility of this technique has been under consideration in the United Kingdom.
Promising yet Controversial: The Risks Posed by Investigative Genetic Genealogy
Despite the already proven potential of this novel investigative technique, it is also worth noting that investigative genetic genealogy has not come without controversy, as it poses significant risks to several fundamental rights and freedoms. These risks mainly relate to the right to privacy and the right to data protection. For example, it is claimed that the use of genetic genealogy databases by law enforcement authorities for investigative purposes constitutes a form of function creep, the gradual expansion of a system’s purpose beyond its original intent. This, however, may lead to undermining the reasonable expectations of privacy of individuals who use these databases for recreational purposes. Such individuals may not expect their data to be used for investigative purposes, thereby risking violations of their right to privacy. To that end, law enforcement authorities often contend that they rely exclusively on databases in which users can opt in or out of allowing their data to be used for investigative purposes, presenting this as a moral justification for their activities. Nevertheless, questions persist regarding the awareness of users of this access and the validity of their consent, raising significant concerns about potential infringements of their data protection rights. Furthermore, there is always a risk that unrelated individuals may be wrongly targeted as suspects, which poses a significant threat to the principle of the presumption of innocence. Accordingly, it holds crucial importance to address such risks while utilizing the potential of this novel and promising investigation tool to ensure its fair and responsible use.
Putting Investigative Genetic Genealogy Under the Spotlight: EAFS 2025
Given the growing interest in and debate surrounding this technique, it was no surprise that investigative genetic genealogy was one of the recurring themes at the European Academy of Forensic Science (EAFS) 2025 Conference, which took place between May 26th and 30th in Dublin, Ireland. As the largest forensic science event in Europe, the EAFS Conference takes place every three years, bringing together more than 1,200 participants from diverse disciplines. It serves as a platform to showcase cutting-edge research and prominent case studies, as well as exchange ideas and provide feedback on recent developments in the field. This year, investigative genetic genealogy received considerable attention in the conference program, as evidenced by the keynote address of Mrs. Debbie Kennett on the topic and dedicated panels, presentations, and posters showcasing the latest advancements in this area across Europe and beyond. A common thread in these discussions was the emphasis on how to use this emerging technique responsibly. To that end, many speakers emphasised the importance of legal frameworks in guiding the application of this technique and referred to ongoing or anticipated legislative developments aimed at ensuring its lawful use in their respective jurisdictions.
Ensuring the lawful and legitimate use of investigative genetic genealogy is crucial to maintaining public trust, not just in this particular technique but also in law enforcement authorities more broadly. Yet, the extent to which this technique aligns with the existing legal framework remains unclear. Specifically in the EU data protection framework, there appears to be an ambiguity regarding the appropriate legal basis for investigative genetic genealogy, which may jeopardise its legality and legitimacy. For instance, it was reported that the Swedish pilot case relied on Article 10(c) of the Law Enforcement Directive, which, among other conditions, permits the processing of sensitive personal data when it is “manifestly made public by the data subject”. However, after the completion of this pilot case, the Swedish Data Protection Authority disagreed with this interpretation, resulting in the halting of the use of investigative genetic genealogy in Sweden despite its success. In response, Swedish law was recently amended, and the use of investigative genetic genealogy is permitted for cases relating to certain types of serious crimes under specific conditions as of July 1st, 2025.
Against this backdrop, I had the opportunity to present the current (legal) status of investigative genetic genealogy in Europe, highlighting the urgent need for robust legal frameworks in jurisdictions that are experimenting with this emerging technique. My analysis was specifically focused on the EU data protection framework and questioned which legal basis, enshrined in the Law Enforcement Directive, should be used for the utilization of this technique in Europe. In this regard, I examined whether data available on genetic genealogy databases, specifically GEDmatch and FamilyTreeDNA, can be considered “manifestly made public by the data subject”, thereby allowing them to be processed as per Article 10(c) of the Law Enforcement Directive. As I argued in previous work, which formed the basis for my presentation, these data do not meet the criteria to be considered as such, due to, for instance, the significant deficiencies in the disclosure policies of these databases and their failure to adequately inform users about the potential risks associated with investigative genetic genealogy. Therefore, I proposed that, instead, Article 10(a) of the Law Enforcement Directive should be relied upon, and accordingly, law enforcement authorities experimenting with this technique should identify adequate Union or Member State laws under which their investigative genetic genealogy activities are conducted.
To that end, I was particularly pleased to learn (more) about the (expected) legal developments in several European jurisdictions, including, but not limited to, Denmark, Sweden, and France, throughout the conference. This is because such frameworks are essential to ensure both the lawfulness and legitimacy of investigative genetic genealogy. In my presentation, I emphasised that the quality of these laws also matters, requiring them to, among other things, introduce adequate safeguards to mitigate the risks posed to the fundamental rights and freedoms of individuals affected, and highlighted the importance of broader public engagement and discussion in these legislative processes.
Empowering Future Voices: NNHRR Conference Attendance Grants for PhD Members
My participation in EAFS 2025 was generously supported by the Netherlands Network for Human Rights Research (NNHRR) through their Conference Attendance Grants for PhD Members. As an early-career data protection scholar, attending this conference was an unparalleled opportunity to share my research directly with practitioners in the field. Engaging with them during and after my presentation provided invaluable feedback and insights. Most importantly, it enhanced my belief in the need for improved communication between stakeholders and disciplines, such as policy makers, law enforcement authorities, lawyers, forensic experts, genealogists, and civil society. Such interdisciplinary communication currently seems to be missing, but could be of great help in identifying the risks associated with the use of this technique and to establish adequate mitigating measures to ensure its responsible use in Europe. Hence, I am grateful to NNHRR for their support in enabling my participation in the EAFS 2025 conference, and I encourage my peers to visit their website for more information about this funding scheme.
Bio:
Taner Kuru is a PhD researcher at Tilburg Institute for Law, Technology and Society (TILT). His research focuses on the implications of emerging technologies in the EU data protection framework. Before joining TILT, he completed the Advanced LL.M. in Law and Digital Technologies program at Leiden University with cum laude distinction as an awardee of the Jean Monnet Scholarship in 2020. He then received the European Data Protection Law Review’s “Young Scholar Award” for his article titled “Genetic Data: The Achilles’ Heel of the GDPR?” based on his master’s thesis. He also worked as an intern at the United Nations Interregional Crime and Justice Institute (UNICRI) Centre for Artificial Intelligence and Robotics during 2020. Taner is also a certified lawyer at the Ankara Bar Association and previously worked as an attorney-at-law in Turkey.