Security of forensic material

Crimes Act provisions

41.112 Part 1D of the Crimes Act defines ‘forensic material’ as samples; hand, finger, foot or toe prints; photographs or video recordings; or casts or impressions taken from or of a person’s body by a forensic procedure.^[105] Part 1D regulates the collection and destruction of forensic material obtained through a forensic procedure—but there is some uncertainty as to the extent to which it regulates the use, storage and disclosure of forensic material.

41.113 The legislative provisions relating to the use, storage and disclosure of information on a DNA database system are discussed in Chapter 43. The provisions regarding the use, storage or disclosure of forensic material are less detailed, comprising:

• provisions for providing part of a sample obtained through a forensic procedure, and the copy of any analysis results, to the person from whom it was obtained;^[106]
• an offence in relation to the inappropriate supply of forensic material to a person for analysis in order to include a DNA profile on an index of a DNA database system;^[107]
• a provision stating that forensic material (or information obtained from it) that was taken in accordance with a State or Territory law may be retained or used for investigative, evidentiary or statistical purposes of the Commonwealth;^[108] and
• provisions specifying the destruction requirements for forensic material obtained from a suspect, serious offender or volunteer.^[109]

41.114 Further, s 23YO(1) prohibits a person from accessing information stored on a DNA database system ‘or any other information revealed by a forensic procedure’ carried out on a suspect, offender or volunteer, and intentionally or recklessly causing the disclosure of the information other than as permitted by that section. Section 23YO(3) specifies the circumstances in which information revealed by the carrying out of a forensic procedure may be disclosed, including ‘for the purpose of the investigation of any offence or offences generally’.^[110]

41.115 As genetic samples are not stored on a DNA database system, this section would apply to forensic material only if it constitutes ‘information revealed by the carrying out of a forensic procedure’. However, while a genetic sample is obtained through a forensic procedure, it appears that it may not be information for the purposes of s 23YO of the Crimes Act. As discussed in Chapter 8, the plain and ordinary meaning of the word ‘information’ is unlikely to extend to a genetic sample, as opposed to the information that is derived by sequencing the DNA that the sample contains.^[111]

41.116 However, while the legislative wording is ambiguous, it does not appear to have been the Commonwealth Parliament’s intention to exclude forensic material for the scope of this provision. The Revised Explanatory Memorandum to the Crimes Amendment (Forensic Procedures) Bill 2001 (Cth) provides that:

[t]he purpose of proposed section 23YO is to protect the privacy of persons whose DNA profiles are included on the DNA database system or who have undergone a forensic procedure under the Bill. Existing section 23YP, which is to be repealed by this Bill, lists the permitted purposes for which disclosure of forensic material derived from the carrying out of a forensic procedure can be made. These reasons are retained in proposed subsection 23YO.^[112]

41.117 Finally, s 23YUD(1) provides that the Minister may enter into arrangements with participating jurisdictions for the sharing of information ‘from the DNA database system’ for the purpose of a criminal investigation or proceedings. However, as forensic material is not stored on a DNA database system, the provision does not appear to extend to the sharing of such information.

Privacy Act

41.118 Australian forensic laboratories are generally attached to a police service or a state or territory health department. The AFP operates its own forensic laboratories, which are subject to the Information Privacy Principles (IPPs) in the Privacy Act 1988 (Cth) (Privacy Act). Forensic laboratories in other jurisdictions operate subject to privacy legislation applying in that State or Territory, where it exists. A private laboratory that offered forensic analysis services for law enforcement purposes would operate subject to the National Privacy Principles (NPPs) in the Privacy Act.

41.119 DP 66 noted that it is doubtful whether the Privacy Act regulates the collection, use, storage, disclosure or destruction of forensic bodily samples because genetic samples currently do not appear to fall within the definition of ‘personal information’ as defined in the Privacy Act.^[113] In Chapter 8 of this Report, the Inquiry recommends that the Commonwealth amend the Privacy Act to extend its coverage to identifiable genetic samples so that the IPPs and NPPs, or similar privacy principles, apply to genetic samples.^[114]

41.120 As a result, a DNA sample taken from a suspect, offender or volunteer—and, potentially, a crime scene sample—could fall within the definition of ‘personal information’ for the purpose of the Privacy Act if the person’s identity were apparent, or could reasonably be ascertained, from the sample. Where a sample constitutes personal information, the collection, use, storage and disclosure of the sample would be subject to the IPPs (or in some cases the NPPs), subject to specific law enforcement exceptions.^[115]

NATA accreditation requirements

41.121 The National Association of Testing Authorities, Australia (NATA) accredits laboratories in the field of forensic science in accordance with international standards.^[116] The accreditation program involves establishing and inspecting protocols and procedures for such areas as documentation, security, methodology, laboratory equipment calibration, evidence management, reporting, validation methods, and training.^[117] As part of its assessment, NATA also examines each laboratory’s documentation relating to internal audits, peer review checks and court testimony reviews.^[118] The laboratory accreditation program does not extend to the uploading of DNA profiles onto a DNA database system.^[119]

41.122 Accredited laboratories are reassessed every two years to ensure they have complied with NATA’s accreditation requirements. In addition, each laboratory’s analysts must participate in internal and external proficiency testing during the period between these assessments.

41.123 Most laboratories used by law enforcement agencies for DNA analysis have obtained NATA accreditation in forensic science. In any case, police services normally forward samples to an accredited laboratory for testing and analysis in order to ensure that any evidence obtained is not later challenged in court.^[120]

Issues and problems

41.124 The Model Bill and Part 1D of the Crimes Act focus more on the protection of DNA profiles held on the DNA database system than on the forensic material from which the profiles are obtained. This leads to potential concerns about the security of stored forensic material.

41.125 The primary concerns regarding the security of forensic material are to ensure the material is secure against improper use or access (especially in light of the vast amount of health and other information contained within each sample) and to protect against misuse of the material to implicate an innocent person in a criminal offence. DP 66 noted that—at least in theory—a person could seek to obtain stored forensic material to conduct an off-database comparison with another DNA sample or profile; or to plant the sample at a crime scene to falsely implicate an innocent person in an offence.^[121]

41.126 The relative ease of obtaining DNA samples directly from a person’s body or personal effects may render the latter concern less serious, given that someone motivated to act improperly probably would seek a DNA sample from a less secure source than an accredited laboratory. However, concerns may arise as to the security of genetic samples remaining on an exhibit after it has been released to the police investigators by the laboratory. For example, where a victim’s jumper is smeared with the offender’s blood, the laboratory might only need a fraction of that blood for the purpose of DNA analysis. The jumper, and the blood remaining on it, could be released to the police investigators as physical evidence.

Options for reform

41.127 Where forensic material is stored on a long-term basis, the sensitivity of the information stored within the samples inevitably leads to concerns for the security of that information. DP 66 outlined three options for improving the security of these samples.

Destruction of forensic material

41.128 One option is to require the destruction of forensic material after a DNA profile has been created.^[122] Possible reasons for the long-term retention of forensic material are: to enable a proportion to be used in quality assurance programs; to allow for retesting if allegations of errors in the analytical process are made; or for re-analysis if, in future, more sophisticated analysis techniques become available.^[123] For example, forensic scientists might wish to re-analyse stored samples to include additional loci in DNA profiles stored on DNA databases, or to conduct a wholly new form of analysis on the samples when better technology emerges.

41.129 The advantage of destruction is that it minimises public concerns regarding the potential misuse of forensic material. If forensic scientists wish to re-analyse samples using more sophisticated technology, they must request the person’s consent, or seek an order for a new forensic procedure. The disadvantage of destruction is the time and cost implications of obtaining new samples for analysis. However, it may be that this would not increase the overall cost significantly, given the costs involved in long term storage of these samples in appropriate atmospheric conditions.^[124]

41.130 New Zealand, Germany, Sweden, Denmark and the Netherlands currently require samples to be destroyed after the profile has been created. Canada, the United Kingdom, the United States and France retain samples after analysis.^[125]

Independent storage of forensic material

41.131 A second option is to permit the retention of forensic material after analysis but to provide for independent storage of that material to provide security against any allegations of future misuse.

41.132 The Inquiry understands that the NSW government is considering the establishment of a State Institute of Forensic Sciences to oversee the organisation and management of forensic sciences and the use of technology in criminal investigations and prosecutions. This is a joint proposal of the Police Service, the Attorney-General and the Department of Health.^[126] This proposal also includes an independent storage facility for exhibits.

41.133 The advantage of this approach is that it could minimise public concerns regarding potential misuse of stored forensic material; however, this would depend on the nature of the body holding the information—that is, its real and perceived integrity and independence—and its systems for maintaining confidentiality and information security.

Improve existing protections

41.134 A third option is to improve existing protections within Part 1D of the Crimes Act, the Privacy Act and the NATA accreditation framework in relation to stored genetic samples.

41.135 As noted above, the Model Bill and Part 1D of the Crimes Act focus primarily on the protection of DNA profiles on the DNA database system, rather than the forensic material from which the profiles are obtained. At a minimum, Part 1D of the Crimes Act could be amended to clarify that the provisions limiting the use and disclosure of information held on the DNA database system also extend to forensic material.

41.136 In addition, existing privacy protection would be improved by extending coverage of the Privacy Act to genetic samples.^[127] For example, if the IPPs applied to bodily samples, the storage and security of the samples would be regulated under IPP 4. The laboratory holding the sample would be required to ensure it is protected by such security safeguards as are reasonable to protect against loss, unauthorised access, use, modification or disclosure, and against other misuse. However, the Inquiry notes that law enforcement exceptions apply to these principles.

41.137 Finally, existing protections could be improved by extending the NATA accreditation framework to all forensic laboratories analysing and storing forensic material in the law enforcement context. In addition, NATA has a ‘drug and properties’ accreditation program that provides for the cataloguing and storage of evidence stored in a police environment, such as evidence in a narcotics investigation. This program is designed for evidence that is not in the custody of the testing laboratory and is therefore not covered by the laboratory exhibit management system. Although the program has been designed for drug related exhibits it does not preclude being applied to genetic samples.^[128]

Submissions and consultations

41.138 DP 66 proposed that forensic procedures legislation should provide that forensic analysis of genetic samples must be conducted only by laboratories accredited by NATA in the field of forensic science.^[129]

41.139 Most of the submissions supported this proposal.^[130] The Queensland Government objected to the proposal on the basis that if

Queensland legislation was to provide that the laboratories used for forensic analysis must be accredited by NATA, and the standards set by NATA changed, the laboratories may have to respond immediately to the changing circumstances, which may include the purchase of additional equipment … Queensland is of the view that the recommendation to make the accreditation mandatory through legislation may not be necessary, as this matter may be adequately dealt with as a matter of government policy.^[131]

41.140 The NSW Police Service opposed the proposal, commenting that:

Acknowledgement must be given to other methods of accreditation (e.g. American Society of Crime Lab Directors (ASCLD), American Association of Blood Banks, College of American Pathologists, National Pathology Accreditation Advisory Council), and acknowledgement must be given to the probability that work will be sometimes undertaken by overseas laboratories … there may be times when results of medical testing (by accredited medical labs) or paternity tests (by accredited parentage testing labs) are desirable to be presented as evidence. The admissibility of that evidence should not be denied by legislation. The important point is that their evidence be demonstrated to adhere to the standards appropriate to their field of testing.^[132]

41.141 The Office of the Victorian Privacy Commissioner disagreed with the Inquiry’s approach, arguing that it does not strike an appropriate balance between the public interest in solving crime and the public interest in protecting individual privacy.

Consideration should be given to investigating alternative methods for police collection of DNA profiles that do not require collection and retention of body samples. This might, for instance, be achieved by having the sample collected, analysed and held or destroyed by an intermediary that is independent of police.^[133]

Inquiry’s views

41.142 The Inquiry recommends that Part 1D of the Crimes Act, or regulations thereunder, be amended to provide that forensic analysis of genetic samples for use by law enforcement authorities should be conducted only by laboratories accredited by NATA in the field of forensic science.

41.143 This would ensure standardised forensic laboratory practice across Australia for the effective operation of the DNA database systems—including the National Criminal Investigation DNA Database (NCIDD system)—and would be consistent with the Inquiry’s recommendations in other areas of laboratory practice.^[134] As noted above, the submissions expressed widespread support for this approach.

41.144 The NATA accreditation program does not extend to the uploading of DNA profiles into a DNA database system. Therefore, NATA’s two yearly assessments would not cover this aspect of laboratory practice. In practice, laboratories could make mistakes when uploading profiles into a database system, for example by uploading incorrect or incomplete profiles, or by inserting them into the incorrect index of the database. In Chapter 43, the Inquiry recommends that the Commonwealth should amend the Crimes Act to provide for a periodic, independent audit of the operation of DNA database systems operating pursuant to the Act—including the forensic laboratories participating in these DNA database systems.^[135] This should provide an additional level of oversight of laboratory practices to ensure public confidence that the relevant legislative requirements are being satisfied.

41.145 DP 66 noted the importance of ensuring that suspects, offenders and volunteers are protected from perceived or real threats to their genetic privacy through future analysis of their samples for predictive health, behavioural or other information.^[136] A number of submissions suggested that the security of forensic material could be best protected by destroying the material after analysis, or by independent storage of the material. The Inquiry agrees that these measures would ensure greater public confidence in the security of their genetic information.

41.146 Therefore, the Inquiry recommends that the Commonwealth should amend the Crimes Act to provide that forensic material obtained pursuant to Part 1D must be destroyed as soon as practicable after a DNA profile has been obtained from the material. In the rare circumstances in which police might later seek access to a suspect, offender or volunteer’s genetic sample, they would need to do so pursuant Part 1D of the Crimes Act.

41.147 Implementation of this recommendation should increase public confidence in the use of DNA profiling in law enforcement, and in the operation of the DNA database system. In addition, the destruction of all forensic material other than crime scene samples would greatly reduce the resource burden on forensic laboratories who would otherwise be required to store the samples in appropriate conditions on a long term basis.

41.148 This recommendation would necessitate amendments to the Crimes Act so that the destruction requirements currently applying to forensic material would apply to any information obtained from analysis of that material.

41.149 Finally, the Inquiry recommends the improvement of legislative safeguards for the confidentiality and security of forensic material until it is destroyed. There is no apparent reason why genetic information in the form of a DNA profile should receive greater legislative protection than the forensic material from which it was obtained. At a minimum, the provisions limiting the use and disclosure of information should be extended to cover forensic material. This would ensure the prohibition of any unauthorised use or disclosure of stored samples that were obtained under Part 1D of the Crimes Act.