Opinion n.º 1/2014
May 2014
Francisco Corte Real of the National Institute of Legal Medicine and Forensic Sciences (INMLCF, IP) requested that this Oversight Board issued an opinion on the possible existence of legal or other obstacles that prevent the attachment of the name of a convicted person to the personal data file, when there is a relevant insertion order.
I. Request
"Following previous contact with the Oversight Board on this matter, I should like to ask you to advise as to whether there is any legal or other obstacle that stops the attachment of the name of a convicted person to the personal data file, when there is a relevant insertion order.
This question is raised because every time a court asks if a certain individual is already in the database (which may be to avoid the costs of duplicate expert procedures), we must ask the 4 laboratories that carry out expert procedures if they have sent the individual's profile to the Institute's registered office. This procedure, as well as being time-consuming, is more liable to errors, and oversight is out of the hands of the Institute's registered office, where the database is located.
It should be noted that the initial choice not to attach names to personal data files was made exclusively by the INMLCF, IP (which we now understand to have been excessive caution), while the previous Oversight Board was never questioned on the matter.
The INMLCF, IP believes it can attach the name of people to the personal data files, provided that we are certain that no legal or other rule is being broken, but it will not make that change to its procedures without the agreement of the Oversight Board".
II. Consideration
1. Regulatory framework of the issue.
1.1. Law no. 5/2008 of 12 February 2008, for the first time in Portugal, establishes the principles of creating and maintaining a DNA profile database, to be filled gradually and in stages. The Law limits the database to certain groups of citizens and expressly ties it to the goals of criminal identification and investigation. It is expressly prohibited to consider any other aims, as established in Article 1(3) of that Law, without prejudice to the information obtained being divulged for the purposes of scientific or statistical research after being made irreversibly anonymous - Article 23 of Law no. 5/2008 of 12 February 2008 (the Law that contains the other rules cited unless otherwise stated).
In the context of the Database, the DNA Profile Database itself coexists with the Biobank, where biological samples for DNA analysis are stored.
The DNA Profile Database consists of six DNA profile files created, created in accordance with the origin and system of data to be saved, and a personal data file, which holds personal data corresponding to the profiles of the people identified (Articles 14 and 15(2)).
The Database also includes an intermediate file that, although not expressly mentioned in Law no. 5/2008, intends to allow intercommunication between data saved in the personal data file and the corresponding profile file without compromising the security demands imposed by the same law, specifically in Article 15(2).
The files of convicted people, referred to in Article 15(1)(e), contain information on persons convicted of a wilful crime and sentenced to a term equal to or greater than 3 years in prison, even if the sentence has been replaced by a court decision that has transited in rem judicatam.
The personal data file includes data of this nature, which is defined in Article 2(g) as the set of information of any nature and regardless of the respective medium, including sound and images, regarding an identified or identifiable natural person, which includes the person’s full name, date of birth, place of birth, known current home address, personal identity number (identity card, residence permit, passport or other analogous), filiation, marital status, sex, ethnic group, height and any physical defects.
Article 6 of the DNA Profile Database - Operational Regulations, approved by Decision of the Legal Medical Council of the INML of 15.07.2008, published under number 3191/2008 in the Diário da República, 2nd series, of 3.12.2008, includes provisions on identifying the subject to whom the DNA profile to be obtained relates, especially with a view to ensuring the authenticity of that identification.
- The subject shall present an identity document, a copy of which shall be taken and included in the case file, a fingerprint shall be taken (in principle), and a photograph taken (with the subject's consent);
- The personal data mentioned in Article 2(1) and (2) of Executive Law no. 395/99 of 13 October 1999 shall also be collected. This Law approved the legal regime of the INMLCF, IP computerised files (profession, address, telephone number, ID card number, data relating to the place, etc.).
  - The laboratory that performs the analysis to obtain the profile shall send a copy of the identity document, a copy of the photograph and a copy of the fingerprint to the registered office of INMLCF, IP for attachment to the personal data file.
1.2. As we have seen, the issue raised relates only to placing the name of the convicted person on the personal data file, following a judicial order to insert the DNA profile into the profile file of the convicted person, mentioned in Article 8(2) and (3).
Initially, the INMLCF, IP chose not to include the names of convicted persons whose profiles are part of the file that contains information relating to samples obtained from convicted persons (Article 15(1)(e)) in the personal data file, although those names are found on the copy of the identification document sent to the registered office of INMLCF, IP by the laboratory that performs the analysis to obtain the profile for attachment to the personal data file, as mentioned.
That initial choice, however, stops it being known if a certain person has his/her profile inserted into the convicted persons file by consulting his/her personal data file, which is information that is often requested from the INMLCF, IP by the courts. The courts intend to avoid duplicating the collection of samples and inserting the respective profiles into the database, specifically before the court ruling that orders collection of a DNA sample has been given, under the terms of Article 8(2) and (3).
It is this situation that the INMLCF, IP intends to change, in order to respond to the courts' request more simply, quickly and correctly, since until this time it has had to ask the four laboratories to inform it if it has a previous collection of a biological sample from the convicted person in its records in order to respond to the request.
2. Consideration of the issue - developments
In the absence of a better opinion, we understand that the intended change does not violate the rules of Law no. 5/2008 or the principles enshrined therein, for the following reasons.
Firstly, the legal definition of personal data includes the full name of the person to which it relates (Article 2(g)), so the 2008 legislation - which does not establish any exceptions or restrictions relating to the personal data of convicted persons or any other - presumes that the name is found in the legally established personal data file, regardless of the profile file (Article 15) to which the data corresponds. By regulating the content of the profile files, Article 15 expressly establishes in paragraph 3 that the inclusion in the DNA profile file of any identifying item pertaining to the data subject, and any type of name-based research, are prohibited, thereby stopping a certain DNA profile included in the respective profile file from being accessed via name or any other identification information.
Secondly, including the name of the owner in the personal data file only makes it possible to know if the person has his/her DNA profile in the convicted persons file and nothing more, since, as Article 15(2) establishes, the system ensures that the DNA profiles and the corresponding personal data are stored in files that are logically and physically separate, handled by different users, with accesses that are restricted and coded and identify the users. 
It is only possible to link a certain person to his/her profile using the intermediate file, due to the procedure followed, which can be summarised as follows:
1 -  After collection and after genetic analysis has been performed, the laboratory sends two encrypted electronic messages to the intermediate file, with the final destination of the profile file and the personal data file, with the following items:
a) The DNA profile;     
b) The respective personal data (copy of the court order, copy of the record of the collection of samples, copy of the identification document, copy of the fingerprint, copy of the photograph, other relevant items).
2 - The two messages are received by the so-called Intermediate File, which assigns a code to each of them, and it is the only component that is able to link them.
a) The encrypted message with the personal data is delivered by hand, in digital format, to the Personal Data File. Until now, the information relating to the case (except the name of the subject) is inserted into the computerised programme of the Personal Data File, and the copies mentioned above are attached.
b) The encrypted message with the DNA profile is delivered by hand, in digital format, to the Profile File. The DNA profile is inserted into the CODIS programme.
3 - The Personal Data File and the Profile File deliver a confirmation of insertion slip to the Intermediate File.
4 - The Intermediate File sends a message to the relevant laboratory confirming insertion.
5 - The laboratory then destroys the sample, under the terms of the law.
6 - Only if there is a profile match, via the intermediate file, is the code of the personal data file corresponding to the matching DNA profile code found, so that the identity of the person that the profile belongs to can be known.
Thirdly, the information that a certain person has in his/her profile on the convicted person file is provided to the court when a possible second collection of a sample and profile insertion is in question. It is certain that the information would always be obtained using a different method and would be provided in a slower and less precise manner, so the change intended does not represent any disadvantage to the person to whom the personal data in question relates. 
3. Conclusion
We do not see, therefore, any legal obstacle to the name of the convicted person being included in the personal data file following a relevant judicial order for insertion.
Coimbra, 21 May 2014
The DNA Profile Database Oversight Board
António João Latas – Rapporteur
Ricardo Baptista Leite
Helena Terra