French investigators enlisted the FBI to search US commercial DNA databases and identify a serial rapist who assaulted five victims over a decade, testing the limits of Europe's strict data-privacy laws.
뒤로
French police used 2 US DNA databases to evade EU privacy rules
French investigators in 2021 sent a DNA sample from an unidentified serial rapist to the FBI, bypassing European privacy laws that bar law enforcement from accessing commercial genetic databases, according to case records and interviews with police officials.
"We were stepping into the unknown," said Charlotte Sawicki, deputy director of the OCRVP, the French national police unit that oversaw the investigation.
The suspect, Bruno Llambrich Gonzalvo, 62, was arrested in December 2022 after the FBI matched his DNA to two distant relatives in GEDmatch and Family Tree DNA — databases holding millions of genetic profiles from people tracing their ancestry. He confessed to raping five girls and young women from 1998 to 2008 in attacks that followed an identical pattern: abduction from city streets, transport to wooded areas, and sexual assault. Llambrich Gonzalvo died by suicide in March 2024 before facing trial.
The case has reignited debate across Europe over whether to legalize genetic genealogy for police use. France's government under President Emmanuel Macron is backing legislation to authorize the technique, while Germany's constitutional court has blocked its use, citing privacy rights. Sweden became the first European country to legalize the method in 2023, and the UK's Home Office is reviewing a pilot program by London's Metropolitan Police.
The OCRVP unit, based in Nanterre outside Paris, took over the cold case nearly two decades after the first known assault. Investigators had exhausted traditional methods — plugging DNA into French law-enforcement databases and Interpol's network of 194 member nations yielded no matches. They interviewed hundreds of people and tested DNA from men resembling a police sketch of the assailant, described by victims as tall with piercing light-colored eyes.
To avoid legal risk, French officers asked the FBI to conduct the database searches themselves. "Legally speaking, it would have been too risky" for French police to do the work directly, Sawicki said. Recreational DNA testing is illegal in France, and Europe's General Data Protection Regulation sharply restricts the buying, selling and sharing of personal genetic data.
The Two-Match Breakthrough
The FBI's first lead came from Matthieu Bouvet, a genealogy enthusiast in Brittany who had defied France's ban and uploaded his DNA to Family Tree DNA. Bouvet turned out to be a distant relative of the suspect — "a happy coincidence," he said. A second match with a French man born in 1960 narrowed the search further. French investigators mapped Bouvet's family tree of more than 6,000 people against national identity records, focusing on men aged 50 to 60 who stood 6 feet or taller with light-colored eyes.
The trail led to Llambrich Gonzalvo, one of six children who grew up in a housing project outside Paris. He had been convicted of sexual assault in the 1980s, though the conviction was later expunged. Police raided his home in Courtry, a northeastern Paris suburb, at 5:30 a.m. on Dec. 13, 2022. A DNA test confirmed the match later that day.
The Policy Divide
The case highlights a growing transatlantic divide over genetic privacy. In the US, commercial DNA databases have few legal limits on law-enforcement access. GEDmatch and Family Tree DNA allow users to opt into police searches. European regulators view the practice as a violation of data-privacy rights, with France's National Consultative Commission on Human Rights arguing that individuals who consented to recreational testing did not consent to law-enforcement use of their genetic data.
In Germany, Natascha Pfau has spent years lobbying authorities to reopen the 1990 murder of her mother, Cornelia Pfau, who was raped and strangled near Freiburg. German police recovered semen from the body but have refused to use US genetic databases, citing constitutional privacy protections. "It haunts me whether he might still be living nearby," Pfau said. Karsten Bettels, a retired German police officer who investigates cold cases, noted that Cornelia Pfau's body was found just miles from the French border — where authorities caught the Predator of the Woods using the very technique Germany rejects.
The French justice minister, Gerald Darmanin, told lawmakers this month that magistrates who cooperate with US authorities on genetic genealogy risk prosecution under current law. "We are simply asking for the criminalization of the judge to be lifted," he said.
This article is for informational purposes only and does not constitute investment advice.
[1] How French Police Skirted European Privacy Laws to Hunt a Serial Rapist - WSJ[2] How French police skirted European privacy laws to hunt a serial rapist[3] How French Police Skirted European Privacy Laws to Hunt a Serial Rapist[4] DOJ’s Bulk Sensitive Personal Data Rule: A Cross-Border Compliance Imperative for the Life Sciences Industry
