Under the auspices of Genome Canada and the Office of the Privacy Commissioner

Remarks at the Genetics and Privacy Workshop

November 27, 2009
Ottawa, Ontario

Address by Chantal Bernier
Assistant Privacy Commissioner of Canada

(Check against delivery)

---

I will structure my comments on the draft policy brief by stating, first, the general approach of the Office of the Privacy Commissioner, as the guardian of the right to privacy, and, second, our specific comments on the three options put forward in the Draft policy brief.

Approach

As an Annex to the Policy Brief, Professors Knoppers and Caulfield have provided a chart of the factors relevant to bio-bank policy oversight. Of the factors, two particularly guide the intervention of the Office of the Privacy Commissioner of Canada: socio-cultural norms, which inform us in the application of the law, and domestic legislation, with which we are mandated to ensure compliance.

In relation to socio-cultural norms and domestic law, I would set the stage with a few basic principles:

• At the risk of stating the obvious, in our society, genetic information constitutes personal information.
• Personal information is private.
• Personal information is defined as information that can be traced to an identifiable individual.
• Privacy is a fundamental right, both intrinsic and instrumental, but it is not an absolute right.
• That means that privacy, like all individual rights, must be balanced with collective rights, with the greater public interest.
• Genetic privacy is the protection from disclosure, without consent, of genetic information.
• Respect for genetic privacy, therefore, resides in the conditions of consent.
• To be legitimate, consent must be meaningful, which is to say,
  • Informed, and
  • Autonomous.

These few basic principles dictate the questions for us to ask in assessing the draft policy brief before us, questions that amount to a necessity and proportionality test:

1. When and why would the collective right to research justify the request for genetic information?
2. When the request is justified, what constitutes meaningful consent in this area?
3. When the genetic information is collected, how is it kept secure, either through privacy safeguards (eg controlled access, segregation of samples) or through governance structures?

In the draft policy brief, the need for information in general is impeccably addressed in the first paragraph but the need for personal information, meaning information that can be traced to an individual, needs to be better explained.

The test for necessity and proportionality requires that we answer these questions:

1. Why is the name of the individual needed?
2. How is the collection of that information proportionate to that need?

I have already said that I believe the issue of the necessity for personal information needs to be made clearer in the paper, so I will move to the issue of proportionality and this takes us to the crux of the matter: consent and what constitutes meaningful consent – i.e. informed and autonomous- in this context.

At our Genetics and Privacy Workshop of March 23, 2009 at the OPC, the issue of consent was raised under different angles which I believe are relevant here:

• Given the complexity of genetics and bio-banks, how is “meaningful consent” defined in this regard?
• How much is the concept of meaningful consent driven by the concept of a reasonable person?
• Are expectations of privacy changing and therefore the requirement for consent changing?
• How does consent stand in front of public interest?
• Can consent be attached to more than one purpose?
• Shouldn’t consent be given for a certain duration and scope?
• Can consent be meaningful when open-ended?
• How can consent be withdrawn?

With this in mind, let me turn to my comments on the options.

The three options

Option 1 ensures the highest protection of privacy but is described as “too costly and too cumbersome” and not respecting “the wishes of individuals who may want to be involved in bio-banks”.  

To this I would reply that i) costs and inconvenience do not strike me as considerations that may outweigh the fundamental right to privacy, particularly in regard to information as potent as genetic information and ii) those who really want to be part of a bio-bank will provide consent as needed. In light of the few basic principles above, I would suggest that we proceed with the highest respect for genetic privacy and, therefore, with the greatest assurance of meaningful consent.

Hence we welcome Option 1.

Option 2 rests upon the legitimacy of the “initial broad consent”. If that initial broad consent is meaningful, in other words, informed of the potential uses of the personal information and of the consequences of such use, including the risk of collecting and using such information, then it may be considered a proper negotiation, so to speak, of the right to privacy in favour of public interest. Technological developments, however, such as networks of bio-banks or open-ended future uses of samples, create such uncertainty in use and management of genetic information that it will be a challenge to ensure that the “initial broad consent” is “informed”.    

Consequently, Option 2 is less protective than Option 1. To be made sufficiently robust from a privacy point of view, it would require proper conditions upon obtaining “broad initial consent”, taking into account the challenge of the scientific complexity of the area.  

Option 3, if I understand it correctly, seems like consent by default. I would submit that it does not meet the test for meaningful or informed consent.

We would not welcome option 3.  

In conclusion, we would like to see the Draft policy brief modified in the following direction:

• Expanding on the circumstances that would justify the request for personal information.
• Addressing the definition of meaningful consent in the specific context of genetics, meaning, taking into account the complexity of the area, the potential uses of the information, the potential exchanges of information, the personal benefits and the personal risk;
• Addressing in greater detail the governance structure for securing consent as well as for securing personal information.

Merci.