This question arose after a recent revelation from the San Francisco DA, who said that DNA of rape victims that were gathered when performing a rape kit test1 was used to identify a criminal suspect through a match in the database.

Does this practice

  • contravene any state statute(s) or rule(s) of evidence?
  • contravene any federal statute(s) or rule(s) of evidence?
  • violate any state constitutions or the US constituiton?

When I say ‘state’ in this question, I'm not just referring to California: it could be any state in the US or DC.

I'm also curious as to whether it is a legal practice in England and Wales.


Articles on this story appeared in the guardian, the independent and daily mail

1 - A rape kit usually takes several samples of possible perpetrator DNA and a sample of the victim's DNA to separate their DNA from the perpetrator.

  • 2
    could you link the statement? "DNA from a rape kit" would usually mean the perpetrator's DNA, not the victim's.
    – Trish
    Commented Feb 17, 2022 at 9:58
  • @Trish Interesting. This is the article: theguardian.com/us-news/2022/feb/14/… Commented Feb 17, 2022 at 12:07
  • 3
    Ah yes, it makes sense now! So, the summary is: They took at least two samples, one of them being of her to rule her out of the other sample(s) that might contain the perpetrator DNA. Then they fed all into databases.
    – Trish
    Commented Feb 17, 2022 at 14:54

3 Answers 3


Does this practice contravene any state statute(s) or rule(s) of evidence?

Generally not. States could adopt a statute that says otherwise, but I'm not aware of states that do. States often have regulations limiting police use of biometric data for general, non-probable cause based searches for criminal suspects.

For example, many states don't make fingerprints obtained for professional licensing background checks available for searched by law enforcement without a warrant and probable cause.

I suspect that states may start to do so with rape kit DNA, but it hasn't previously been identified as an issue, so there aren't statutes that prohibit this in most cases (e.g. victim's rights bills have not thought to address the issue).

The reason for concern that could lead to future statutes is two fold.

First, including rape kit DNA in searches discourages people from reporting crimes because it might put them at a disadvantage in an unrelated criminal proceeding.

Second, the risk of false positives is vastly higher in a random search of biometric data from people with no articulated connection to the crime than it is when isolated individual suspects who there is probable cause to believe committed a crime are investigated. The chance of a false positive for someone in a database with millions of people is non-negligible even if the risk of a false positive in any one isolated comparison is tiny. Even a 1 in 10,000,000 chance of a false positive in a database of 40 million people will routinely produce false positives in random searches. And, while DNA evidence is very accurate, partial forensic DNA samples aren't absolutely incapable of producing false matches to nearly the same extent as a comparison of two complete whole genome samples.

So, states may adopt such statutes in the future now that the issue is in the spotlight.

contravene any federal statute(s) or rule(s) of evidence?


violate any state constitutions or the US constitution?

No. At least under current jurisprudence. The relevant provisions are vague legal standards that are applied with great discretion by courts. Evolving understandings of the situation could change that view in the future.

Footnote: Does doctor-patient privilege or HIPPA control?

There is a doctor-patient privilege recognized in every U.S. state and in the federal courts.

Forensic DNA obtained from a rape kit from a potential suspect isn't protected by the privilege since the suspect isn't a patient of the medical provider in that medical procedure.

There is an arguable case that the rape victim is a patient of the medical provider who gathers the DNA, including the rape victim's DNA for the rape kit, and that the patient has not waived the doctor-patient privilege merely by permitting the medical professional to use the rape victim's DNA profile to distinguish between sample material in the rape kit that is her own from material from a suspect. Moreover, such a waiver of doctor-patient privilege would probably not be legally valid unless the rape victim provided informed consent to that release.

The rape victim might also have federal HIPPA protections for the privacy of her DNA profile collected as part of her medical records under a similar theory.

Mostly, this hinges on how the relationship of the rape victim to the person administering the rape kit is characterized, and in particular, if gathering evidence in a rape kit is "medical treatment" that is privileged.

To the best of my knowledge, there is no case law interpreting either the doctor-patient privilege or HIPPA in a rape kit DNA fact pattern.

If it is considered to be a doctor-patient relationship for medical treatment within the meaning of the evidentiary privilege and HIPPA, and the DNA was shared on a database which law enforcement has access to without a warrant without the victim's informed consent, this evidence and all "fruit of the poisonous tree" derived from it, could probably be suppressed in a criminal proceeding against the rape victim, even if the evidence conclusively linked the rape victim to the crime.

Under the circumstances, and given the policy considerations and the lack of other controlling law, this would be an attractive interpretation of the existing law for a court to adopt.

If evidence completely independent of the blind database match provided probable cause that the rape victim committed a crime, and the crime was one in which there was forensic DNA evidence, law enforcement could probably get a search warrant to take a legally untainted DNA sample from the rape victim to compare to the forensically collected DNA evidence, however, just as it could with any other suspect.


Can a rape victim's DNA be used against them in criminal proceedings?


But... A victim's DNA is not routinely recorded on, or searched across, the DNA database.

The process, in simple terms, is:

  • A medical practitioner takes samples of biological material from the victim (using what some colloquially refer to as a rape kit).

  • As those samples potentially contain a mixed profile, control samples are also taken from the victim - usually by drawing blood and plucking hair to avoid the potential for cross contamination.

  • When both sets of samples are analysed, the control is used to isolate any unknown profile(s).

  • Any unknown profiles are then available for recording on, or searching across, the database if the investigation warrants it - which is not always the case.

  • The victim's control samples are not put on, or through, the database unless there is a specific and proportionate necessity to do so.  (And I cannot recall any cases that I have been involved in, or heard about, where this has actually happened.)

If, for whatever reason, the victim's samples are used in this way and they get linked to an unrelated crime scene, it would depend on the circumstances and proportionately as to whether the prosecution of a(n alleged) victim of a serious assault would follow.  If it did, then the DNA evidence is prima facie admissible in the interests of justice, unless the defence successfully argue for its exclusion under s.78 of the Police and Criminal Evidence Act 1984


I'm also curious as to whether it is a legal practice in England and Wales.

If the sample is legally retained then it can be used. The rules in the Protection of Freedoms Act 2012 Part 1 chapter 1, which modify the Police and Criminal Evidence Act 1984, provide that a DNA profile must be destroyed unless it is specifically authorized to be retained under one of the enumerated powers (see PACE 63D(3)). The relevant ones here are:

  • 63E: retain until the investigation or subsequent criminal proceedings have concluded
  • 63N: retain material given voluntarily until it has fulfilled the purpose for which it was taken
  • 63O: retain so long as the person consents in writing
  • 63P: if the person is charged with a different offence, retain under the applicable power

So long as the profile is in the National DNA Database, it's available for use for the investigation of crime. The original sample from which the profile was derived may be destroyed or retained, depending on circumstances; see 63R. Therefore, a victim of crime may find their DNA still in the database, if any of the conditions above apply. And 63P specifically means that 63E will apply in relation to the new investigation, even if the victim withdraws consent under 63O. If the original investigation were closed and the victim had asked for her profile to be removed from the database, then it would not be available in that way.

Note that law enforcement is an exception to the GDPR, which would otherwise entitle the victim to certain rights over her personal data held by the police.

  • 1
    Are you sure that a victim's profile goes on the database? Links to any reliable sources would be most welcome.
    – user35069
    Commented Feb 17, 2022 at 18:18
  • @Rick Another question that I would find interesting is, regardless of the retention rules, can the police legally run a check against the DNA profiles of unidentified suspects for a match? I haven't found anything that says they can't.
    – richardb
    Commented Feb 17, 2022 at 18:46
  • @richardb Yes, that's the whole point of these DNA databases - to link suspects to (or eliminate from )crime scenes.
    – user35069
    Commented Sep 5, 2022 at 9:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .