Privacy Law and Policy Reporter
|
|
Home
| Databases
| WorldLII
| Search
| Feedback
Privacy Law and Policy Reporter |
|
Dr Charles Lawson
Genetic privacy may be defined, at least in part, as the confidentiality that should attach to genetic information — the information contained in genetic materials which exist in various forms in biological organisms. When considered at the level of the individual this includes genotype, phenotype, mutation and sequence information, and when considered at the level of genetic compositions it includes individuals, communities, populations, species and so on.
Genetic information (at the level of individuals and compositions) has been argued to be different to ordinary personal information (such as a name in a tax record) because the information is predictive, is shared between (genetic) relatives, allows inferences to be drawn, deals with probabilities rather than certainties, lasts for a whole lifetime and makes up an intimate part of a person’s identity information.[1] It is this different character which has raised the possibility of regulation according to different rules than those currently applied to information privacy like that set out in the Privacy Act 1988 (Cth) or the Telecommunications Act 1998 (Cth).
The following discussion briefly examines the current developments in Federal privacy regulation as it relates to genetic privacy and contrasts two different approaches currently present in proposed Federal legislation. The analysis shows that the Federal Government’s privacy proposals deal with protecting the genetic information itself while the scheme proposed by Senator Natasha Stott Despoja protects the collection of the genetic material from which the genetic information is later derived. The consensus from the Federal Parliament indicates a willingness to legislate for genetic privacy, although the specific approach does not appear to have been decided. The paper does not consider the privacy issues for genetic information in the criminal law[2] and in State and Territory legislation[3] even though they have attracted some attention in the legislatures.
The issues for a genetic privacy scheme in Australia were well illustrated in a submission to the recent Senate Legal and Constitutional Legislation Committee investigation into the Genetic Privacy and Non-discrimination Bill 1998.[4] Robyn Thompson sought to recover the blood spot samples taken from her children at birth for screening and stored at the Murdoch Institute at the Royal Children’s Hospital in Victoria. Blood spots are taken from most babies born in Australia, stored on cards known as ‘Guthrie cards’ and used to test for disabling diseases which can be prevented with early treatment.[5] Concerned about the storage of her children’s blood samples and their potential uses, Robyn contacted the Murdoch Institute, speaking with a ‘student’ and a ‘secretary’ before eventually speaking with the ‘director’. Robyn was asked to get her children’s consent (as they were presumably over 18 years of age) for the return of the blood spots, which she did. The blood spots were eventually returned, but Robyn argued there was no need for her children’s consent as the blood spots were theirs anyway and the Murdoch Institute should have returned them confirming both that they had not been used for any reason and that all data had been destroyed.
Robyn’s concern was brought about by a television program examining the use of the stored children’s blood samples to identify a murder victim. Robyn’s submission reports that the Murdoch Institute’s justification for holding the blood spots after the initial screening was to confirm the test results and for potential legal actions at some time in the future (identifying the period of 50 years as suitable). The Murdoch Institute also claimed the blood spots were safe and secure and no one had access to them. Interestingly, the ‘secretary’ and the ‘director’ both questioned Robyn’s concerns and even suggested the practices were acceptable to them — ‘She [the secretary] then proceeded to tell me how she felt about her children’s blood samples and that she didn’t have a problem with that’.
This incident highlighted the insensitivity of the institution in dealing with a person who felt they did not consent to the blood sample storage, and questions the circumstances in which blood samples will be provided for genetic testing without the consent of the individual or their family. For example, will an employer or insurer have access to these genetic materials? Who decides and on what grounds? Other issues raised by this incident include the initial consent to the collection, the rights of children to consent and deal with the genetic information, the access, storage, correction and disclosure of the genetic material and genetic information, the uses of the genetic materials for a purpose other than that for which they were collected and finally, the destruction of genetic material.
This example is also significant because while many of the issues raised do not directly relate to genetic information, they do make up the circumstances in which genetic privacy is considered and it is this broader perspective which may need to be considered in the regulation of genetic privacy — that is, privacy of the person, privacy of space (to conduct personal affairs in private), privacy of communications and privacy of information.[6]
The legislated Information Privacy Principles in the Privacy Act 1988 attach to information which is ‘personal information’. ‘Personal information’ is defined in s 6 to mean:
information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.
Genetic information which is ‘personal information’, which has been collected or exists in a ‘record’, relates to an ‘individual’ and is held by an ‘agency’, will be subject to the Information Privacy Principles. The term ‘agencies’ includes a Minister, a Department, a body established by or under a Commonwealth law, a body established by the Governor General or a Minister, a person holding an office or performing the duties of an office established by or under a law of the Commonwealth, the Federal Court and the Federal Police.[7] ‘Record’ is defined to mean a document, a database (however kept) or a photograph or other pictorial representation of a person. It specifically excludes a generally available publication, anything kept in a library, art gallery or museum for the purposes of reference, study or exhibition and certain other documents held under the Archives Act 1983 and the Australian War Memorial Act 1980.
The Privacy Act 1988 has also been extended to include certain health programs (such as Medicare and the Pharmaceutical Benefits Program)[8] and Public Interest Determinations[9] which may include genetic information; for example, Public Interest Determination No 7 permits the disclosure of personal information about Australians overseas to their next of kin in certain limited circumstances and this most probably includes identifying genetic information.
Outside this legislative scheme some privacy is provided by guidelines for medical research approved by the Privacy Commissioner under s 95 of the Privacy Act 1988.[10] Apart from this there are a range of self-regulatory guidelines for health information[11] and insurance[12] and some general obligations to maintain confidences.[13]
The Privacy Commissioner, on instructions from the Federal Govern-ment, issued the National Principles for the Fair Handling of Personal Information (usually known as the National Privacy Principles or NPPs) in February 1998 and then in a revised form in January 1999.[14] In December 1998 the Federal Government announced it would introduce legislation to support and strengthen self-regulatory privacy protection in the private sector based on industry codes.[15] Where an industry does not develop its own codes the legislative framework will apply,[16] which appears to be the proposed NPPs. Importantly, these principles do not deal with coverage, implementation and compliance mechanisms.
The Federal Government recently instructed the Privacy Commissioner to investigate personal health information.[17] The Privacy Commissioner has since developed an issues paper and a discussion paper.[18] The extent of coverage for genetic information in this investigation and final report is unclear, although the Privacy Commissioner understands genetic information to extend beyond the limit of personal health information:
Clearly personal health information also includes genetic information. The Privacy Commissioner’s view is that the question of whether genetic information requires specific additional protection is a separate issue that may warrant further investigation.[19]
The effect of the Privacy Commissioner’s investigations and any legislation which results will be limited to personal health information, which most probably leaves the remainder of genetic information to be covered by the NPPs and any legislation dealing with these principles.
Genetic information which is not personal health information may include genetic information used in employment, insurance, personal injury litigation (such as determining life expectancy and risk of diseases), family law (such as paternity, settlement of estates, adoption and kinship), education and commercial uses (such as behavioural dispositions and life expectancies for mortgage agreements) and immigration (such as identity and predispositions). As the science and technology for understanding genetic information progresses it is possible to conceive (in a deterministic world) that genetic information might be used in direct marketing to target groups with predispositions to a particular good or service.
Under the current Federal proposals the privacy rights will attach to the genetic information itself and each sector will develop its own codes or rely on the NPPs. This will require careful consideration by the Privacy Commissioner to ensure nationally consistent standards are applied and the integrity of genetic information is maintained across the different sectors. For example, a predisposition (such as being more likely to favour risky investments over more conservative ones, or to make a full disclosure rather than an exaggerated disclosure) may be relevant to an employer, an insurer, a mortgagor and in a family dispute. In these circumstances the standards of disclosure need to be consistent across sectors to ensure that lawful disclosure in one sector does not undermine stricter disclosure in another sector.
An alternative scheme has been proposed by Senator Natasha Stott Despoja in the Genetic Privacy and Non-discrimination Bill 1998:
I believe genetic privacy (and genetic discrimination) is best dealt with in a comprehensive privacy scheme. This Bill cannot stand without the broader privacy issues being addressed and should be seen as a contribution to the ongoing debate. I introduced this Bill to stimulate debate, highlight pressing concerns and provide policy initiatives for the Government. Without a comprehensive privacy scheme, similar to the scheme proposed by the Attorney General [in 1996 and not 1998], Bills such as this, and dealing with other areas of particular concern (such as surveillance, smart cards, electronic commerce, etc), will be necessary. I would also note a range of other issues addressed by this Bill (such as the regulation of Australian research, consent, property rights over genetic materials, etc) need to be considered in this debate. I welcome this broader approach to privacy regulation in Australia and I hope the belated recognition of the need for this debate stimulates the necessary activity.[20]
The scheme proposed by Senator Stott Despoja is a stand alone scheme dealing with each of the issues detailed in the NPPs as well as a range of the other important privacy related issues including consent, ownership, discrimination and research.
Senator Stott Despoja’s Bill also suggests a different approach to that set out in the current Federal proposals to regulate privacy. The Senator’s Bill protects genetic information through the protection of identifiable DNA samples. This approach was proposed in the US by Annas et al:
... the overarching premise ... is that no stranger should have or control identifiable samples or genetic information about an individual unless that individual specifically authorises the collection of DNA samples for the purpose of genetic analysis, authorises the creation of that private information, and has access to and control over the dissemination of that information.[21]
The approach of the Privacy Act 1988 and the Privacy Commissioner’s NPPs in dealing with the information itself may be entirely appropriate for information data, but may not be the most effective way of dealing with genetic information, which was Senator Stott Despoja’s justification for her Bill’s approach. Given the ease with which genetic information can be derived from genetic materials (such as a DNA sample) and the rapid improvements in technology for determining genetic information, the Senator’s approach may have some merit. The Senator’s Bill also provides a consistent privacy scheme for all genetic information across all sectors, with the exception of some legislation areas, such as law enforcement. Significantly, this proposed scheme is not inconsistent with the Government’s favoured approach for industry codes and the Privacy Commissioner’s NPPs and might constitute a basic framework for genetic information derived from genetic materials.
The research sector collects a considerable amount of genetic information and the existing regulation, outside Commonwealth agencies covered by the Privacy Act 1988, relies on the voluntary practices of practitioners and their institutions:
[s]uch protections are without doubt better than nothing but there is no mistaking the heavy emphasis on professional responsibility and the limited recognition of any rights of the people whose personal information is being used.[22]
The National Health and Medical Research Council is presently undertaking a review of the guidelines issued under s 95 of the Privacy Act 1988 as well as a range of other relevant guidelines, such as Guidelines for the Protection of Privacy in the Conduct of Medical Research (which are being reviewed according to the National Health and Medical Research Council Act 1992). The outcome of this process, when compared to the Privacy Commissioner’s personal health information inquiry, should provide some interesting insights into the approaches different sectors are likely to take to genetic privacy. The consistency and standard of proposed regulation (or self-regulation) will probably be a good measure of how effective genetic privacy regulation will be in practice and test the true commitment of different sectors to dealing with privacy issues.
Senator Stott Despoja’s Bill proposed special regulation for the research sector in what the Privacy Commissioner said ‘largely sets out good practice in the research context’.[23] The Senator pointed to the existing privacy standards and suggested the patchwork of legislation, self-regulation and vague concepts of privacy in existing guidelines were inadequate. Perhaps the significant distinction drawn by the Senator was a recognition of the potential to use genetic information in research for a number of useful purposes which might not be apparent at the time of its collection. For example, the Senator proposed specific measures for the disclosure of information for statistical or epidemiological studies without the authorisation of the person from whom the sample was collected, but subject to provisions which maintain the privacy of the individual.[24] Further, Senator Stott Despoja distinguished between the public interest in collecting genetic information in research and the criminal law, recognising that non-consensual disclosure may not be appropriate for research.
Senator Stott Despoja also dealt with the vexed issue of ownership of genetic information by proposing an authorisation process which necessitated proper process — that is, informed consent dealing specifically with the possible commercial and other uses of the genetic information. This approach replaces a property right with a privacy right founded on informed consent, attaching due process and effectively circumventing the likely restrictions property rights might impose.[25] Without this approach there is the potential for some interesting problems when the privacy property rights in the genetic information conflict with the effective patent rights established over genetic information under the Patents Act 1990, which may control the uses of genetic information in certain circumstances. For example, where an individual’s gene sequence which is also the subject of a gene patent (such as the use of the particular gene as a marker derived from a gene sequence from an unrelated source) is used as a family marker, the individual or family may have a very limited use of that genetic information.[26]
The consensus from the Federal Parliament indicates a willingness to legislate for genetic privacy. The Senate Legal and Constitutional Legislation Committee inquiry recommended ‘an ongoing responsibility for the appropriate Commonwealth departments to monitor developments, with a view to drafting legislation as required’.
However, early signs from the personal health information investigation suggest genetic privacy is unlikely to be addressed as a separate issue, but will rather become a component of a range of different industry codes or the fall back NPPs. This is very likely to result in an undermining of the requirement by the Privacy Commissioner (and the Federal Government) that privacy laws be nationally consistent[27] and is unlikely to address the broader privacy issues.
Senator Stott Despoja’s proposal has provided an alternative scheme and a comprehensive template for further debate. Perhaps the most significant aspect of Senator Stott Despoja’s Bill has been the breadth of views put to the Senate Committee inquiry by the broader community of issues which need to be dealt with in any regulatory scheme and, in particular, the issue of genetic discrimination. In the absence of an effective scheme for genetic privacy, strong prohibitions on genetic discrimination (subject to clearly stated exceptions) may restrict the potential misuses of genetic information.
Dr Charles Lawson is a Visiting Fellow at the Research School of Biological Sciences, Australian National University, Canberra ACT 0200. He can be contacted at <lawson_charles@hotmail.com> or by telephone on 0414 674 797.
AustLII:
Copyright Policy
|
Disclaimers
|
Privacy Policy
|
Feedback
URL: http://www.austlii.edu.au/au/journals/PrivLawPRpr/1999/25.html