Privacy of Genetic Information

1. Privacy of Genetic Information Ann Cavoukian, Ph.D. Information & Privacy Commissioner/Ontario Ken Anderson Assistant Commissioner University of Toronto Law School Toronto, Ontario March 15, 2005

2. What is Privacy? • Information Privacy: Data Protection • Freedom of choice; control; informational self-determination. • Personal control over the collection, use and disclosure of any recorded information about an identifiable individual.

3. Summary of Fair Information Practices • Accountability • Identifying Purposes • Consent • Limiting Collection • Limiting Use, Disclosure, Retention • Accuracy • Safeguards • Openness • Individual Access • Challenging Compliance

4. What Is genetic information? • “Biological samples” can be defined as biological material in which nucleic acids are present and which contain the genetic makeup of an individual. — EC Directive on Data protection, 1995 • “Genetic data” is information about heritable characteristics of individuals. — UNESCO International Declaration on Human Genetic Data, 2003 • In Canada, “human genome" is defined as the totality of the DNA sequence of the human species. — Department of Justice, Assisted Human Reproduction Act, 2004

5. The Right to Know or Not Know • Historically, maintaining the ability to control one’s personal information has revolved around the concept of the “right to know” -- namely, the right of access to one’s own personal information that governments and others may have in their custody and control. • In the context of genetic testing and the information arising from it, however, the right to know is transformed into the right “not to know.”

6. How is genetic information used in healthcare? • Knowledge of our genetic makeup • Testing can: • Reveal hereditary traits. • Better diagnose a patient’s existing disease. • Predict risk of illness in the future. • Advance clinical research programs. • Assist with criminal investigations. • Assist with pharmaceutical research and development.

7. Types of Genetic Testing • Pre-natal diagnosis • New-born screening • Pre-symptomatic testing • Diagnostic testing • Genetic screening • Carrier testing • Susceptibility testing • Identification

8. Problems in Using Genetic Information • Over-information • Not necessarily predictive • Insurance • Workplace • Unintended discrimination

9. Is genetic information the same as other health information? • In Article 4 of the UNESCO International Declaration on Human Genetic Data, human genetic data is given a special status, since; • (a) it can be predictive of genetic predispositions concerning individuals; • (b) it has a significant impact on the family; • (c) it contains information the significance of which is not necessarily known at the time of the sample and; • (d) it has a cultural significance for certain persons/groups.

10. Four Major Different Normative Approaches to Genetic Information • 1. Personal information approach —genetic information in its definition of personal information. • 2. Sensitive Information approach — prohibits the processing for sensitive data unless law requires it, is for public health purposes, or explicit consent is obtained. • 3. Health or Medical Information Approach — covered expressly or impliedly by the definitions of health or medical information. • 4. Genetic Information Approach — accords special status to genetic information and defines what constitutes genetic information and distinguishes it from other types of data, general personal information and health information.

11. Of Volume, Depth and Speed • Argument put forth by, Trudo Lemmens and Lisa Austin, that a combination of the following three elements constitute the primary reason why there is a need to develop appropriate regulatory measures with regards to genetic testing and privacy. • The volume of information that can be extracted from one sample; • the speed of testing and; • its link with computer technology. Of Volume, Depth and Speed: The Challenges of Genetic Information Trudo Lemmens and Lisa Austin, February 2001

12. Of Volume, Depth and SpeedWhich Definition? • Any type of regulation or legislation developed in the context of genetics will have to be attentive to the problem of defining what constitutes genetic information. • Regulation that defines genetic information narrowly may lack coherence and become unenforceable. • Privacy legislation aimed at curbing genetic discrimination will have to be carefully drafted so that a narrow scope does not undermine the efficacy of such efforts.

13. Of Volume, Depth and SpeedGlobal Examples • Austria — introduced a sweeping federal law prohibiting the use of genetic data by insurers. However, there is nothing in the statute that clarifies how and why genetic information other than genetic test results will be excluded from further consideration by insurance companies. • Norway — introduced Biotechnology Act that not only includes a general prohibition on the use of genetic data for insurance purposes but also makes an exception for diagnostic information resulting from genetic tests.

14. Of Volume, Depth and SpeedNeed for Public Debate • Three reasons justify careful analysis, public debate and regulatory intervention. • Although genetics does share may characteristics with other health information, that does not mean that we have found satisfactory ethical, legal and regulatory answers. • The explosion in genetic research brings many issues, (medical, legal, etc) to a whole different level. • The combination of volume of data from one genetic sample combined with the speed of testing and computer technology makes it necessary to look at how adequate current regulatory approaches are.

15. Of Volume, Depth and SpeedEthics of Disclosure • Characteristics of genetic information calls into question the disclosure or non-disclosure of health information to third parties. • Guidelines adopted by the Science Council of Canada: • Reasonable efforts to elicit voluntary consent to disclosure have failed. • There is a high probability both that harm will occur if the information is withheld and that the disclosed information will actually be used to avert harm. • The harm that identifiable individuals would suffer would be serious. • Appropriate precautions are taken to ensure that only genetic information needed for diagnosis and/or treatment of the disease in question is disclosed.

16. Swiss Principles • Swiss law fundamentally states that federal and cantonal data protection regulations are applicable to genetic data. Therefore, the following basic principles are fixed: • Legality (personal data must be processed in a lawful manner). • Purpose binding (personal data may only be processed for the purpose either for which it was collected or which is evident from the circumstances, or which is provided for by the law). • Proportionality (data processing must not be excessive). • Integrity (whoever processes personal data must ensure that the information is correct). • Security of data processing (personal data must be protected against unauthorized processing by appropriate organizational and technical means). Bruno Baeriswyl, Privacy Commissioner of the Canton of Zurich, Switzerland Swiss Genetic Data Legislation: A European Model Concept, 2005

17. Fair Information Practices:A Brief History • OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. • EU Directive on Data Protection. • CSA Model Code for the Protection of Personal Information. • Canada Personal Information Protection and Electronic Documents Act (PIPEDA).

18. Current Privacy Legislation in Canada • Charter of Rights and Freedoms. • Federally, PIPEDA and the Privacy Act. • Bill C-47, Human Reproductive and Genetic Technologies Act. • 1992 Privacy Commissioner’s Genetic Testing and Privacy. • House of Commons Standing Committee on Human Rights and Status of Persons with disabilities (1997). • Professional confidentiality (provincial laws). • Human rights legislation. • Statutory torts. • Provincial legislation to specifically address health information protection. • Voluntary professional codes of genetic privacy.

19. Ontario Law Reform Commission’sProject on Genetic Testing • The Office of the Information and Privacy Commissioner/Ontario commends the adoption of the following general principles when assessing genetic testing from a privacy perspective: • There should be no mandatory testing of individuals. • No individuals should be advised of their genetic traits or disorders, absent their consent. • Genetic screening or monitoring of individuals in employment situations should be permitted only if the individual volunteers to be tested, and retains complete control over the use and disclosure of the resulting genetic information. • No individual should be denied any benefits or services for refusing to undergo genetic testing. • The establishment of databanks containing genetic information relating to an entire population should be prohibited. • Governments should abide by the principles of the ‘Code of Fair Information Practices’ as entrenched in Ontario’s Freedom of Information and Protection of Privacy Act and Municipal Freedom of Information and Protection or Privacy Act, when collecting, retaining, using, and disclosing genetic information in their custody and control.

20. The Genetic Testing and Privacy Report • The IPC concurs with Recommendations 21 and 22: • In brief, the Federal and provincial governments along with the private sector should work towards the following: • Including explicit privacy protection in the form of a right to privacy, in the Charter of Rights and Freedoms. • Reviewing the Privacy Act (in Ontario, the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act), and strengthening its provisions. • Introducing legislation to regulate specific aspects of genetic testing, such as forensic DNA analysis. • Legislating and/or adopting policies, federally and provincially, to regulate private sector intrusions into genetic privacy. • Fostering respect for genetic privacy.

21. Need to Protect Genetic Samples • The need to protect genetic samples must be accorded enough privacy protection due to the fact that these samples can reveal potentially sensitive information about ourselves and our families.

22. Genetic Samples and Legislation • The overarching question is twofold: • Do genetic samples deserve to be protected under current privacy/confidentiality legislation and; • If they do deserve special protection, how does one go about protecting such samples?

23. International Declarations that Deal with Privacy of Genetic Information • Helsinki Declaration: Recommendations Guiding Physicians in Biomedical Research. • The UNESCO International Declaration on Human Genetic Data. • EC Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data. • The Human Genome Organization, HUGO. • Bilbao Declaration. • Council of Europe, Convention on Human Rights and Biomedicine. • European Convention on Human Rights. • Genetic Privacy Act. • HIPAA, US 1996.

24. Could a genetic sample be included in a definition of “personal information?” • Council of Europe: “An individual shall not be regarded as identifiable if identification requires an unreasonable amount of time and manpower.” • Health Insurance Portability and Accountability Act (HIPAA) of the United States does not protect tissue, blood or other samples despite the fact that the samples are easy to obtain. • Commonwealth of Australia, Privacy Amendment (Private Sector) Act 2000: “Personal information means information or an opinion (including information or an opinion forming part of a database) whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.”

25. Other Types of Genetic Samples Considered “Personal Information” • Fingerprints. • Specimens dealt with for research projects. • Newborns have their genetic material logged and stored via Guthrie cards. The cards are stored indefinitely. • DNA databanks are used forensically for serious offenders in Canada and the US, to keep the DNA of repeat serious offenders on file to prevent/catch recidivists. • Genetic biobanks, derived for population genetics.

26. Argument to Protect Genetic Samples Under Current Privacy Legislation • Genetic samples and information travel in tandem. • Samples are therefore closely analogous to other sources of personal information and should be protected by the same consistent rules with those applying to the personal information derived from samples. • It is impossible to completely anonymize DNA since there is always a means to identifying the tissue or the sample (Nuffield Trust). • There is the potential for abuse of genetic samples, due to the potential of storing the information indefinitely, using the sample for a secondary source of information, and potentially revealing information concerning the sample to third parties.

27. Anonymized and Aggregate Genetic Information • Genetic data which has been anonymized or aggregated does not have the potential to be identified. • Where there is no reasonable possibility of identifying a specific individual, either directly, indirectly, through manipulation or linkage of information, there is no need to provide privacy protections (HIPAA, 1996).

28. Case Study: IcelandCommercialization of Gene Pool • 1999, Iceland’s parliament approves creation of a health sector data base. • The legislation will give a single company, deCODE, monopoly to create a comprehensive genetic database for the entire population. • The Icelandic Medical Association, IMA, launched a worldwide campaign to protest the commodification of an individual’s DNA. • This legislation “…..violates basic principles established to allow the use of these resources and at the same time uphold patient autonomy and dignity.” — Icelandic Medical Association, 1999

29. Iceland: Privacy and Trust • In a report to the World Medical Association, Iceland’s doctors cited these specific concerns: • Invasion of privacy: The IMA describes the plan as a “great threat to personal privacy. The data in the database are encrypted but not anonymous; a key is available to connect names to the coded information.” • Breach of patient–physician trust: Iceland’s doctors argue that the transfer of medical records to third parties will undermine the confidence between patients and physicians. Ethics:“Is it ethical to sell or give away individual genetic data without obtaining informed consent from patients?”

30. Iceland: Brave New World • The European Union is providing 8.1 million euros for the GENADDICT project which will combine the work of eight public and private research organizations, Iceland’s National Centre of Addiction Medicine and deCODE. • The consortium of health organizations will carry out genotyping of individuals with alcohol, nicotine, cocaine and other addictions in order to characterize their genetic make up.

31. Iceland: Supreme Court • 2004, Iceland’s Supreme Court ruled that that the law creating the database did not comply with the country's privacy protections. • Article 71 of the Icelandic constitution: “Everyone shall enjoy the privacy of his or her life, home and family.” • The court also ruled that simply removing or encrypting information such as name and address were not sufficient to prevent the identification of individuals in the database.

32. Iceland: Supreme Court (cont’d) • The ruling created a legal precedent for living relatives seeking to prevent the transfer of certain records into the database. • When created, the Icelandic Health Database presumes the consent of Icelanders to be included in the project, unless they opt out. • To date approximately 7% of Iceland’s population has opted out of the project.

33. Case Study:AustraliaPrivacy of Genetic Samples • Australia asserts that all genetic samples can reveal genetic information by DNA analysis. • Therefore, it was determined that genetic samples should be accorded coverage under the Privacy Act.

34. Australia: Privacy Act • The Inquiry concluded that the Act does not cover genetic samples, even when they are identifiable to an individual. • Privacy Act’s key term in defining coverage is “personal information.” Section 6(1): “information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.” • Therefore, the Australian Privacy Act only applies to the handling of personal information in a record. • Therefore, the Privacy Act will only cover whether genetic information is “information” and if it is held in a “record” and whether “identity is apparent” or can reasonably be ascertained from the information.

35. Australia:Commission’s Recommendations • The Commission argues that a right of access to an individual’s bodily samplesshould extend to his/her genetic relatives. • When seeking consent for access, the organization should tell the individual from whom the sample comes, that the sample will be handled only by health professionals and that, in most cases, the only information given to genetic relatives will be familial genetic information. • The Commission believes the Privacy Act should cover samples under “personal information” and “record.”

36. Case Study:IsraelProject “Dor Yeshorim” • The community of Ashkenazy Jews are known to have a high frequency of carrying the recessive gene for Tay-Sachs disease -- a degenerative neurological condition that is fatal in early childhood. • “Dor Yeshorim”encourages young Orthodox Jews to have a blood test to determine whether they are carriers of genes for three genetic diseases: Tay-Sachs, cystic fibrosis and Gaucher disease. • After testing, each person is assigned a six-digit identification number. If two people begin to date or a marriage is being arranged, they are encouraged to call the Dor Yeshorim “hotline” in New York and provide their ID numbers. • If a recessive gene has been found in one or both of the individuals, the couple is asked to come in for genetic counselling and will be advised of the risks involved.

37. Israel: Genetic Wallflowers “Some parts of it will make most geneticists hair stand on end. When there is strong pressure within a community to have genetic tests and to check on the genetic profiles of whomever they date, all individuals within that community may feel that they must be tested, whether they want to or not. That takes away the sacred principle of autonomy ... and as more and more genes are added to the list, some people will run the risk of being genetic wallflowers, rejected by every suitor because of the recessive genes they carry. This is a miniature, but significant version of Big Brother.” Dr. Francis Collins, Director of the United States Centre for Human Genome Research

38. Genetics and InsuranceUnited States • February 2005, the United States Senate passed a ban on genetic discrimination. • The bill prevents health insurers from excluding people from coverage or charging them higher rates due to a genetic risk or predisposition to a disease. Insurers could not require customers to take genetic tests. • The measure also covers public and private health plans, employers, employment agencies, labor organizations and training programs. • Senate health committee chairman Mike Enzi, said clear national rules, rather than a hodgepodge of state regulations, is in everyone's interest.

39. Genetics and InsuranceBrazil • August 2004, Brazil's National Health Council (NHC) approved revised regulations on the ethics of research that, among other provisions, protect the rights of individuals over the genetic information that they provide for research. • The document states that under no circumstance can information on an individual gathered through such research be made available to third parties such as insurance companies, and current or future employers. • In addition, under the new rules, those who provide samples for research from which genetic information is obtained will be able to choose whether or not to be told about any of their own genetic details that are discovered by researchers.

40. Genetics and InsuranceUnited Kingdom • October 2001, the British government and the Association of British Insurers reached an agreement to institute a five-year moratorium on the use of genetic tests results in assessing applications for life insurance policies: • Up to a value of £500,000. • For critical illness and long term care. • Income protection policies up to a value of £300,000. • When assessing applications for policies above these values, insurers may only use the results of tests approved by the Government's independent Genetics and Insurance Committee, GAIC. • During the period of the moratorium, the Government is encouraging research on the scientific, medical, actuarial and social aspects of the use of genetic tests in insurance, with a view to development of a long-term policy.

41. Genetics and InsuranceCanada • The 2003 “Public Opinion Research into Genetic Privacy Issues” found that the wide majority of Canadians reject the right of insurance companies to ask for genetic information and this even if applicants have knowledge of a genetic condition. • The position of the Canadian Life and Health Insurance Association is that: “… insurers would not require an applicant for insurance to undergo genetic testing. However, if genetic testing has been done and the information is available to the applicant for insurance and/or the applicant’s physician, the insurer would request access to that information just as it would for other aspects of the applicant’s health history.” • However, those Canadians polled showed concern that, in the future, genetic testing will be used for reasons other than medical purposes.

42. Potential Avenues to Provide for Privacy Legislation Dealing with Genetic Samples • Status quo: rely on existing constitutional and ordinary provisions which apply to genetics, expecting the courts to read in the appropriate interpretation. • Amend Privacy Act definition of personal information recorded to include bodily samples. • Amend Privacy Act to include a separate definition for personal health information, similar to PIPEDA’s definition. • Reform the Privacy Act, to include part I: data collection and part II: health and genetic information. • Creation of a Genetic Information Act and National Genetics Oversight Committee. • Movement from an informed consent model to an authorization model for the use of genetic samples. • Consider genetic samples as property of the sample source.

43. Gattaca? The routine availability of identifiable genetic information about individuals may have effects that reach far beyond the provision of medical care. As the amount of detailed genetic information grows, society may be required to re-examine the basic principles of health and life insurance, review the rules that govern employment and hiring, reconsider the confidentiality rules that are part of the doctor-patient relationship, and in general re-assess the way in which individuals are categorized and treated in a variety of social and economic relationships. U.S. Congress, house of representatives, committee on government operations, Designing Genetic Information Policy Washington D.C., 1992

44. Final Thought “Anyone today who thinks the privacy issue has peaked is greatly mistaken…we are in the early stages of a sweeping change in attitudes that will fuel political battles and put once-routine business practices under the microscope.” Forrester Research, March 5, 2001

45. How to Contact Us Ann Cavoukian, Ph.D. Information & Privacy Commissioner/Ontario Ken Anderson Assistant Commissioner 2 Bloor Street East, Suite 1400 Toronto, Ontario M4W 1A8 Phone:(416) 326-3333 Web:www.ipc.on.ca E-mail:commissioner@ipc.on.ca