Application of Genomic Data for Consumer Procedures in Banking

Introduction

As noted in a report published by the Bank of Russia, the emergence of new trend referred to as regulatory technology (RegTech) (Central Bank of the Russian Federation, 2018) is due to an increase in the complexity of operations, the volume of processed data, the development of new financial services, as well as the tightening of regulatory requirements. By means of such innovative technologies, credit institutions are able no only to modernise and improve the quality of services provided, but also to maintain their positions as intermediaries in the financial market.

Various RegTech tools are already widely used in banking. However, one of the currently most innovative areas for banks consists in the application of biometric customer data. For example, customer identification is already carried out using voice-recognition and retina-recognition technologies. The future use by banks of genetic (genomic) information about their clients is also under consideration. Since this trend is new for the banking sector, the related legal issues are of particular interest. Here, a key issue consists in the distinct definition between the concepts of “genomic information” and “genetic information” and the nature of their interrelation.

The Federal Law of December 3, 2008 N 242-FZ ‘On State Genomic Registration in the Russian Federation’¹ provides a legal definition of genomic information to refer to personal data, including encoded information about certain fragments of deoxyribonucleic acid, obtained from a living individual or an unidentified corpse, that do not however characterise their physiological characteristics.

According to M.N. Maleina, (2020, p. 55) genomic information, which varies depending on the volume of content, includes: “any DNA information extracted from biological material; information allowing identification of a biological object; information describing the physiological characteristics of a person (hereditary diseases, genetic predispositions, weight, height, skin colour, shape of the ears, etc.”

The concept of “genetic information” is not currently distinguished in the current Russian legislation. According to M.V. Voronin, (2020, p. 17) “genetic information appears, including as an object of personal data.” L.A. Novoselova and M.A. Kolzdorf (2020, p. 294) emphasise that “genetic information is genetic data containing information about human health (personalised to one degree or another), access to which may be limited.” Thus, the authors define the concept of genetic information on the basis of genetic data. Therefore, the concept of “genetic information” requires a definition of the concept of “genetic data”. In the International Declaration on Human Genetic Data, adopted by the General Conference of UNESCO on October 16, 2003, human genetic data refers to information about the heritable characteristics of individuals obtained through nucleic acid analysis or other scientific analysis (Article 2)². Genetic data is proposed to refer to “information about a person’s health and the properties of his body (personalised to one degree or another), which can be obtained during the study of his genetic material.” (Novoselova, Kolzdorf, 2020, p. 317) Thus, genetic data are sources of genetic information.

According to M.V. Voronin, (2020, p. 167) when using different definitions of this concept, “it is hardly correct to talk about different approaches to genetic information. It is more appropriate to recognise its systemic complexity and versatility”. According to M.N. Maleina (2020, p. 55), “genomic and genetic information is mostly coincident information. The final relationship between these terms will be established with an unambiguous understanding of the genome.” It seems possible to agree with the opinion of these authors, since different definitions of genomic and genetic information are due to different aspects revealed in their content. Therefore, in the present research, these concepts will be considered as identical.

The importance of genomic information has now increased due to the possibility of practical application of such information. (Maleina, 2020) Genomic information finds application in banking, in particular, when issuing consumer loans and providing customer identification.

The Use of Genomic Information When Issuing Consumer Loans

When considering the issue of granting a loan to a private borrower, banks request documents necessary to make the appropriate decision. However, current Russian legislation does not provide for requirements for such documents. The list of documents provided for consideration of a loan application is regulated by credit institutions independently in the relevant internal bank documents. (Alekseeva, Ivanov, Efimova, 2018)

The documents required from a private borrower traditionally include: passport, other identification document, insurance number of an individual personal account; certificate of wages and other income, documents on the borrower’s property – for cases in which the issue of providing it as collateral is resolved.

At the same time, modern advances in technology enable banks to revise their requirements for information and documents provided by clients. The use of information obtained from the client’s genetic data in banking practice may allow them in the near future to change the rules for lending to borrowers, adding to the list of documents traditionally required from clients.

The formation of requirements for such documents is carried out taking into account one of the basic principles of lending, i.e., ensuring repayment of loans. Accordingly, already at the stage of issuing a loan, banks must assess and minimise the risks associated with the possibility of loan non-repayment. Genomic information can enable banks to obtain additional information about the client – in particular, about his or her health – and, accordingly, make a more informed decision regarding the issuance of a loan.

It is important to determine the content of genetic information that banks will be able to obtain regarding a client.

This issue is widely discussed in the literature. Modern biotechnologies, as M.V. Nekoteneva (2021) emphasises, make it possible to test various genomic disorders not only long before the onset of a clinically expressed disease, even in the absence of any signs of the disease (possibly decades before their manifestation), but even prior to a future person’s conception. Genetic data, according to I.M. Rassolov and S.G. Chubukova, (2020, p. 65) may indicate, among other things, the manifestation of a genetic predisposition of the person concerned, thus having a significant impact on a family over multiple generations, including their future descendants. These authors highlight “several types of genetic analysis that provide insight into the original biological sample:

• detection of a specific gene using a genetic marker, i.e., by a gene or DNA sequence that has been selected because it is systematically located near the gene of interest and is easier to detect because of its known location on the chromosome;
• identification of several genetic markers in the genome (genotyping);
• establishment of the complete human genetic code (sequencing);
• periodic examination of a person to identify specific genetic mutations that may occur as a result of certain events (for example, exposure to toxic substances);
• research aimed at identifying a person by authenticating possible similarities between two genetic materials from different sources, one of which is associated with a clearly identified person (genetic fingerprints).” (Rassolov, Chubukova, 2020, p. 65)

As V.P. Puzyrev (1996, p. 20) clarifies, monogenic (Mendelian) diseases are based on mutations of individual genes (dominant and recessive). Changes in the structure and number of chromosomes lead to chromosomal diseases. However, in many cases, human birth defects are due to the simultaneous manifestation of a complex of gene mutations. These are so-called multifactorial diseases (MFDs) or polygenic diseases.

At the moment, many genes responsible for various human genetic diseases have already been identified. (Novoselova, Kolzdorf, 2020, p. 294) Accordingly, existing knowledge about genetic data makes it possible for banks, already at the stage of considering a client’s application, to obtain more information about the client – in particular, about the state and prospects of his or her health.

In addition, genomic data also makes it feasible to identify a person’s character traits, including his or likely behaviour, etc. Thus, the epigenome is “information about the unique traits of a particular person, refined during life”. (Voronin, 2020, p. 18) The research of genetic markers of appearance traits is being developed within the framework of “DNA phenotyping”. This method refers to the identification by DNA analysis of various human characteristics – morphological, physiological, behavioural, including predisposition to various diseases. (Vladimirov, Gorbulinskaya, Kubitovich, 2018, p. 43)

Thus, on the one hand, genomic information can be a source for reducing the bank’s risks when resolving the issue of approving or refusing a loan, determining the size and duration of such a loan depending on the health, character, and possible behaviour of the potential borrower. However, on the other hand, resolving the issue of concluding (or not concluding) a loan agreement with a client depending on information obtained from genetic data should not violate the client’s rights. Therefore, such approaches may be regarded as potentially discriminating against citizens.

International acts and Russian legislation contain a number of requirements for non-discrimination. Thus, in accordance with Art. 14 of the Convention for the Protection of Human Rights and Fundamental Freedoms, the enjoyment of the rights and freedoms recognised in this Convention must be ensured without discrimination of any kind on the basis of sex, race, colour, language, religion, political or other opinion, national or social origin, membership of national minorities, property status, birth or any other characteristics. Since this Convention is a guideline for Russian legislators, Art. 126 of the Criminal Code of the Russian Federation stipulates that any discrimination committed by a person using his official position – that is, violation of the rights, freedoms and legitimate interests of a person and citizen depending on his gender, race, nationality, language, origin, property and official status, place of residence, attitude to religion, beliefs, affiliation public associations or any social groups, can be liable to criminal prosecution.

Despite the existence of legal regulation on the prohibition of discrimination, in practice, it manifests itself in different areas. With the development of science and technology, new opportunities arise not only for the advancement of new methods for treating diseases and improving the quality of life of terminally ill patients, but also for using information obtained, for example, as a result of genetic testing for discrimination in various areas and other violations of individuals’ rights. (Nekoteneva, 2021, p. 141) The sphere of the human genome has a potentially increased risk of violation of human rights and freedoms. (Orlov, Pozdeev, 2021, pp. 154–160)

The US Human Genome Project Working Group lists some of the most important areas of focus today in the “ethical component” of genomic research: the use of genetic information in relation to insurance and employment (preventing discrimination against carriers of certain “special” genes); in matters of criminal justice, adoption, fitness for military service; obtaining a desired education (speciality); achieving confidentiality of genetic information; improving health care programs for prenatal and presymptomatic diagnosis of hereditary diseases, screening to identify carriers of “sick” genes in the absence of methods for treating diseases caused by these genes; genetic education of medical personnel, patients and the general population; history of the development of genetics – the eugenics movement, behavioural genetics. (Puzyrev, 1996, p. 21)

Genomic discrimination is most widespread in the field of life and health insurance. In 2010, it was discovered that people more likely to develop Alzheimer’s disease were also more likely to purchase long-term health insurance, leading health insurance companies in the US to change the cost of long-term health insurance and make it dependent on genetic factors. Such practices are permitted in the 2008 Genetic Information Nondiscrimination Act (GINA), which exempts cases related to medical insurance of life, disability or long-term care. (Nekoteneva, 2021, p. 140)

Various measures are being discussed to combat genetic discrimination. Governments around the world are passing laws that are aimed at preventing genomic discrimination. Thus, “genetic anti-discrimination laws have been passed in some American states and at the federal level by GINA. GINA legislation prevents discrimination by health insurance and employers, but does not address life insurance or long-term care insurance.” (Nekoteneva, 2021, p. 141) The United States has also created a working group for the Human Genome Project, listing some of the most important areas of special attention today in the “ethical component” of genomic research including the use of genetic information in relation to insurance and employment (preventing discrimination against carriers of certain “special” genes). (Puzyrev, 1996, p. 21)

The Use of Genetic Information When Identifying Clients (KYC – Know Your Customer Procedures)

Bank client identification procedures are constantly being improved; the development of modern technologies provides banks with increasing opportunities to simplify client identification. In Russia, as has already been emphasised, identification using the retina and voice of clients has recently become feasible, making it possible to remotely ascertain their identity. The use of new technologies when carrying out banking operations makes it necessary to more effectively carry out the public responsibilities assigned to banks, in particular, measures to combat the legalisation (laundering) of criminal proceeds. (Efimova, Kazachenok, Kamalyan, 2022, pp. 308–309)

At the same time, some authors note risks that arise in relation to remote identification of bank clients. As M. Levashov clarifies, “one of the main risks is errors in the system for comparing a person’s biometric data obtained via the Internet with his reference data stored in the unified biometric system. The source of such errors can include various factors. Among the main ones are errors in the identification system, errors that arise when receiving insufficiently complete data from an identified person (poor quality photograph, the incorrect angle (of the face), malicious actions of violators, etc.” (Levashov, 2018, p. 53)

It appears that such problems can be minimised if banks apply their genetic data when identifying clients. Issues of identifying individuals using genetic data are already being discussed by the banking community. Changes in current legislation regarding the use of genomic information could contribute to the spread of its implementation in banking.

If genomic data about clients is provided to the bank, the question arises of ensuring their safety.

All issues related to the handling and storage of genetic material can be considered in three planes: confidentiality, patient autonomy and ownership. Moskovkina notes that “one of the most problematic issues of law in the context of storage and processing of genetic material is the issue of maintaining confidentiality”. (2021, p. 136)

The problem of ensuring the confidentiality of customer information is not new to the banking industry. There are known cases where data about bank clients was illegally made public on the Internet. At the same time, banks are among those entities that have collected the largest amount of information about clients, due to banking rules on identification when accepting services in connection with operations and transactions, as well as the emergence of banking ecosystems. Violations by banks (their employees) of the rules for storing, using and transferring client data to third parties, coupled with a lack of special knowledge on the part of clients, often leads to the misuse of such information by fraudsters – and, as a consequence, the loss of funds deposited in accounts by clients and in deposits with a credit institution.

The Reporting Document – Results of Work with Citizens’ Appeals to Roskomnadzor in 2019 notes a significant increase in citizens’ appeals on issues of personal data protection, such complaints being filed in the amount of 52,375. In 2019, the proportion of received appeals from citizens containing complaints in the field of protection personal data ranks first in the total volume of requests; in the first quarter of 2020, their volume amounted to 32.05%. (Koshkina, 2019) These statistics indicate that existing measures do not permit provision of the specified information.

The prospects for banks to have access to client genetic data and the possibility of losing such information makes the issue of its safety of particular importance.

National legal regulation of these issues should be grounded, accordingly, on the basic principles defined at the international level. (Orlov, Pozdeev, 2021, p. 155) Art. 4 of the International Declaration on Genetic Data provides for the confidential nature of human genetic data due to the possibility that such data can: indicate manifestations of the genetic predisposition of the person concerned; have a significant impact over several generations on the family, including descendants, and in some cases on the entire group to which the person belongs; contain information the significance of which may not be known at the time of collection of biological samples; have cultural significance for individuals or groups of individuals. (art. 4)

It should be agreed that the regulation of genomic research should be carried out in such a way that, without causing damage to human rights and freedoms, it brings maximum benefit to people at the same time as allowing the appropriate development of science. (Nekoteneva, 2021, p. 153) Additional aspects of genetic information collection, such as sensitivity, security, transferability and access to information, reinforce the need for fair information practices for standardised regulation of genetic databases and biobanks. (Moskovkina, 2021)

Thus, legal regulation of the use of genomic information should be based on the fundamental principles of international law to ensure the safety of information about bank clients.

The danger of unauthorised releases of genomic information is further aggravated by the fact that every year new DNA research methods make it possible to obtain more and more data about their owner – and, as a consequence, his or her close relatives (genetic) environment. All this justifies the need to ensure guarantees of the rights of citizens whose relatives have given consent to the processing of their DNA information in connection with the possibility of its leakage. Misuse of this information may, in some cases, lead to a violation of the rights of citizens; in others, it can create a threat to national security. (Vladimirov, Gorbulinskaya, Kubitovich, 2018, p. 45)

The solution to the issue of the safety of genetic information depends on the definition of its legal regime. In this regard, it is necessary to understand whether genetic information about a client is personal data or should be protected taking into account a different legal status. From the definition of the concept of “genomic information” given in the Federal Law ‘On State Genomic Registration in the Russian Federation’, it follows that this information is indicated by the legislator as personal data. However, in the current version of the Federal Law of July 27, 2006 N 152-FZ ‘On Personal Data’, genetic information is not classified as personal data.

In order to eliminate these contradictions, a bill was developed to amend paragraph 1 of Art. 11, which provides that information that characterises the physiological and biological characteristics of a person, on the basis of which his or her identity can be established (biometric personal data). Such data used by the operator to establish the identity of the subject of personal data, can only be processed with the written consent of the subject of the data, except for cases provided for in part 2 of this Article under the heading “genetic”.³ However, to date, no changes have been made to the Federal Law ‘On Personal Data,’ which makes the application of this law in relation to genomic information disputable.

There is also an opinion in the literature that more stringent requirements should be established than for personal data concerning the regime for using genomic information. Thus, a number of authors believe that it is incorrect to attribute a subject’s genetic information only to his or her personal data, as defined in the Law ‘On Personal Data’, since the information to a certain extent also applies to his or her relatives, whose circle, for objective reasons, not may be limited or determined in any known way. Obviously, the owner of this information is not only the person who provided the DNA, but also an indefinite circle of persons – his or her genetic relatives, both ancestors and descendants, and, therefore, permission to distribution should not be determined solely by the will of a particular person. (Vladimirov, Gorbulinskay, Kubitovich, 2018, p. 47)

Researchers propose additional options for protecting genetic information. As an alternative to protecting genetic information using the patent law mechanism, L.A. Novoselova and M.A. Kolzdorf M.A. (2020, p. 315) propose to “consider the regime for protecting know-how”.

Conclusion

Establishing a legal regime for genomic information is important due to the need to identify persons responsible for ensuring the safety of such information. At the same time, N.I. Petrykina (2011, p. 134) believes that “in ensuring the protection of personal data, it is important not only to punish the offender, but also to restore the violated right of the victim.”

To eliminate controversial situations, as well as ensure the protection of bank clients, it is proposed to introduce amendments to the Federal Law ‘On Personal Data’, by which genomic (genetic) information should be classified as personal data, while simultaneously increasing the responsibility of the person to whom such information was provided, together with rules on restoration of rights violated in this way. One possible mechanism for restoring a violated right based on the liability of the person to whom the genomic information was transferred may be proposed in the form of compensation for damages.

In conclusion, it should be noted that only a set of measures to influence banks will create an effective mechanism for protecting genomic information about clients if it is provided to a credit institution for the purpose of receiving banking or other services through a bank.