Genetic Information and the Right to Privacy

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

United Nations Educational, Scientific and Cultural Organization (UNESCO), Eighth Session, International Bioethics Committee

September 13, 2001
Paris, France

George Radwanski
Privacy Commissioner of Canada

(Check Against Delivery)


The Universal Declaration on the Human Genome and Human Rights is a powerful affirmation of the values that govern science in democratic societies.

In particular, it affirms the fundamental human right of privacy, which, some have argued, is the right from which all others flow.

So UNESCO is to be commended for seeking to develop guidelines on the privacy and confidentiality of genetic information.

Much of the focus of the guidelines will concern the collection and use of genetic information for scientific and medical research. That's appropriate. We want to ensure that research moves forward. But at the same time, we want to ensure that well-established privacy and ethical standards apply to it.

The greater area of concern, in my view, is the use of genetic information outside the context of medicine and research-particularly in employment and insurance. It is here that a code of genetic privacy is most needed.

It would not be meaningful enough, or effective enough, for the code to be a series of well-meaning statements of recommended best practices.

I believe that you need to issue a code that is prescriptive and directive, that counters the threat of the misuse and abuse of genetic information, and that puts control of that information back into the hands of the people it belongs to.

In my view, a privacy code for genetic information - if it is to implement the Declaration - must do the following.

It must affirm that people have a fundamental, enforceable right to genetic privacy.

They must not be subject to genetic testing, by the state or by the private sector, without their consent. They must not be denied services and benefits because they refuse to undergo genetic testing.

Subject to an important exception, control of genetic information must rest with the person from whom the information is collected.

The individual must be able to control the collection, use, retention, and disclosure of his or her genetic information. The exception is that genetic information about an individual may also be information about siblings, parents, or children. The code must recognise the right of individuals to control genetic information as it affects them, whether the information is from their bodies or someone else's.

The code must give effect to the Declaration's recognition of the right not to know.No one should have to know their genetic makeup unless he or she consents to do so.

It must give effect to the Declaration's provisions regarding discrimination that infringes human rights, fundamental freedoms, and human dignity. But it must go further, and be more explicit, in banning genetic discrimination in, for example, employment, insurance, education, or criminal law.

The code must stipulate that genetic samples and information collected for one use may not be used for another without consent.

It must govern collection, analysis, retention, and disclosure of genetic material, not just the genetic information derived from it.

Finally, the code should also call for effective oversight mechanisms, such as those provided by the appointment of Privacy Commissioners, to ensure that its provisions are respected.

Let me now explain the basis of these recommendations.

First, the fundamental right to genetic privacy.

Genetic information is personal health information.

Health information is fundamentally personal and sensitive. It needs the highest level of protection to ensure that it can never be used to the detriment of the individual to whom it belongs.

At the same time, it is critical that privacy considerations not unnecessarily hinder important medical and health research.

I believe that privacy rules regarding the use of personal health information for research must be drafted and interpreted in such a way as to permit the use of the information, subject to a critical caveat:

  • It must be explicitly ensured that such information, including genetic information, can be used for health research only in ways that permit no possible harm to come to the individual.
  • More specifically, it must be ensured that such information can under no circumstances find its way back to the individual's employers, insurers, government authorities, commercial enterprises, family or friends, or indeed to anyone outside the research process.

Genetic information is particularly sensitive, intimate, and powerful. Partly that is because, at least outside the medical and scientific fields, it's widely misunderstood.

It is often given predictive value far beyond what it deserves.

Just because someone has a genetic predisposition towards cancer, for example, it does not mean he will die young. It may not occur until the individual is 80.

It may occur, be detected early and cured, and the individual will live a healthier life than most. Or the individual, armed with the knowledge of this genetic predisposition, may make lifestyle changes that reduce the likelihood of cancer occurring at all.

Conversely, an individual with a flawless genetic profile may die of an infection, contract a lethal or debilitating virus - or step carelessly into Paris traffic.

That is why many non-medical uses of this information can be unnecessarily negative.

Genetic information can be used by employers to exclude hiring people who are less than genetically perfect yet are perfectly healthy.

Insurers can use it to deny health or life insurance to people judged to be genetically risky.

It could be used to determine who will get funds for education or training.

Banks could use it to determine whether you get a mortgage. It could be used in making decisions about child custody or adoption.

Schools could use it to stream children into particular programs. Parents could use it to make decisions about their support for a child's future.

Such discriminatory uses would be as socially unacceptable as they would be scientifically misguided. It is essential that UNESCO's code to preclude them.

But genetic information can also be used very positively. We are only just beginning to understand its medical uses, in diagnosis, reproductive planning, disease prevention, treatment, and research.

And some non-medical uses of the information are positive, too. In certain criminal law cases, for example, it can provide positive identification that helps apprehend the guilty and exonerate the innocent.

But if people are afraid that their genetic information will be used against them or their families, they may decide that the possible benefits are not worth the risk, and avoid genetic testing.

The medical benefits of our growing understanding of the genome will be lost to them and to us. Conversely, if people are confident about their control of their genetic information, it will facilitate legitimate use of genetic analysis for all sorts of socially valuable purposes.

Genetic information is not just information about the person tested, but often about that person's parents, siblings, and offspring. That, of course, is part of the reason the information is so sensitive and powerful. But it complicates the right of privacy, and is a special challenge for data protection.

The code has to ensure that the rights of all the affected parties are given due consideration. People have to be able to control information as it affects them, and to the degree that it affects them.

That includes the right not to know. People do not know their own genetic information unless it is revealed to them through testing, either of themselves or of a relative. The personal consequences can be powerful-for example, learning that one carries the genetic marker for Huntington's disease. No one should have to bear those consequences unless they consent to do so.

Above all, as I have said, the code must protect people against discrimination. We cannot allow the development of a "genetic underclass."

Except in the most exceptional circumstances where a work environment might produce genetic changes that must be monitored, employers must be prohibited from collecting personal genetic information about job applicants or employees.

The prohibition must extend to so-called voluntary testing-where consent to testing becomes a de facto condition of employment.

Insurers must likewise be prevented from discriminating on the basis of genetic information because, as I have said, it is not a reliable or an appropriate predictor

This must extend to an absolute prohibition on the use of genetic information in underwriting life, health, long-term care, and disability insurance.

It is not enough to prohibit insurers from demanding the information. If we permit some people to try to obtain lower insurance rates by volunteering genetic information that is believed, perhaps incorrectly, to make them lower-risk, it is only a matter of time before we have de facto mandatory testing for insurance. And that will be the end of genetic privacy.

The code needs to stipulate that information collected for one purpose cannot be used for another without consent. This is a standard fair information practice, which applies to all information, not just genetic information.

But it is particularly important to emphasize with respect to genetic information. This is because of the amount of information obtainable from a DNA sample, the longevity of the sample, and the possibility of re-testing and discovery of new uses.

This limitation must also apply to genetic material and information collected for forensic identification purposes

The desire for effective criminal identification should not lead us down the path to a genetic register of an entire population. In Canada, we collect DNA samples only from offenders who have been convicted of a strictly limited range of serious offences.

In order to limit use, we have to ensure control of genetic samples themselves, not just the information derived from them.

Genetic material can easily be collected without consent or even knowledge-from a discarded facial tissue, from saliva on a sealed envelope, from hair cuttings on a barber's floor. Many existing privacy laws do not adequately address this, because they control only information, rather than the material from which the information is derived.

We have evidence-anecdotal, but evidence all the same-of genetic samples being used and disclosed, but escaping privacy laws because the information derived from them is communicated person-to-person and never recorded.

If we are to prevent the code being circumvented, we need to ensure that the scope of the code extends to the samples themselves - while making appropriate provision for legitimate police investigative techniques in collecting evidence with regard to specific serious crimes.

Finally, these rights must be enforceable. A complaint mechanism must be available, backed by investigative powers and the force of law. That's what Privacy Commissioners do.

So these are the reasons I've recommended that your code contain those provisions.

I hope that what I've said today is useful to you in developing a privacy code for genetic material. In the time remaining, I'd be happy to answer any questions you might have.

September 13, 2001 - UNESCO's news release: The Human Genome and the Patent Boom Challenge, September 11, 2001.

Date modified: