Privacy Implications of Genetic Research
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
Remarks at the Privacy Laws and Business 23rd Annual Conference
July 7, 2010
Cambridge, United Kingdom
Assistant Privacy Commissioner of Canada
(Check against delivery)
I am very pleased to be part of this panel, trying to tackle an issue that is both highly relevant and still difficult to fully comprehend: the potential for genetic research and, consequently, its implications for privacy.
I will address the subject by,
- First, giving you a description of the approach of the Office of the Privacy Commissioner of Canada – the level of importance we give to the issue, our activities and our general stance;
- Second, I will provide the broad strokes of the legal principles that govern the protection of privacy in the context of genetic research in Canada,
- Third, I will share with you concrete examples of the issues we have taken a position on or have been particularly singled out in our consultations with experts, and
- Finally, I would like to put to you what we see as the basic elements that should guide us in this fast progressing field to both allow the progress of genetic research for the benefit of all and yet preserve the fundamental right to privacy of each person.
But first, let me underscore my first point on the difficulty to fully comprehend the potential and the limits of genetic research. I believe that the scientific uncertainty around the potential of genetic research is determining of the legal issues at play, particularly with regard to the notion of meaningful consent.
What we observe in Canada is how our Privacy Law Framework, which is based on meaningful consent, proves to be a challenge to the advancement of genetic research.
The fact is that we are, with respect to genetic research, running into unexplored territory: what is truly the potential of DNA information? How accurate is the information it provides and therefore how really effective is its collection? And for what purposes is it truly effective? If purposes cannot be clearly defined, how can consent to provide genetic information be meaningful?
My point is that the scientific uncertainty about DNA – how predictive is it? How reliable is it even for the present? - calls for corresponding legal measures, clear parameters around the scientific uncertainty to ensure meaningful consent, to avoid function creep, or erosion of fundamental rights, while allowing at the same time the flexibility generally necessary to fulfill the public interest in genetic research.
The search for this balance between clear norms to protect privacy and a flexible framework to allow research will colour, so to speak, the positions I will put forward today.
III. OPC FOCUS
In an exercise to ensure its relevance and effectiveness, the Office of the Privacy Commissioner of Canada has identified four priority issues for the protection of privacy, four issues that we felt constituted the most pressing risks to privacy, considering their prevalence and their potential for intrusion.
- national security, of course, considering the seemingly insatiable thirst of governments for personal information since 9/11,
- information technology for the unprecedented breadth of diffusion of personal information in a vulnerable infrastructure,
- identity management, in response to the increase in identity exposure and theft – and –
- genetics, in view of the unparalleled sensitivity of personal information it yields and fast pace of development in the area.
IV. OPC Activities
Our activities cover both forensic and medical biobanks. The Canadian DNA Identification Act makes the OPC an ex officio member of the Advisory Committee to the National DNA databank. The Committee meets twice a year and I represent the OPC on that Committee.
We also review Privacy Impact Assessments which, under Treasury Board Policy, must be developed for any new federal government initiative “involving the collection, use or disclosure of personal information” to “resolve privacy issues that may be of potential public concern”.
Another sphere of activity is advice to Parliament. As independent agent of Parliament, we inform Parliament in the legislative process regarding genetic testing. Lately, this has mainly taken place in relation to forensic testing since the DNA Identification Act has come under review. I will not develop this point since this is not the focus of this panel but I would be happy to answer questions in this regard.
Finally, we also focus on genetic research by nurturing and informing knowledge development and social debate in this area. This last point is crucial and an illustration of my first point: genetic research is introducing such unprecedented possibilities, that it defies our current social norms which need to be discussed in that light.
We have brought together, on our own or with Genome Canada, experts, academics, researchers and policy makers in workshops to scope out the issues and develop models for a framework to address them, seeking to reconcile the imperatives of medical research and the fundamental right to privacy.
My presentation today is based on these discussions and will also give way to an updating of our 1992 Paper on genetic testing.
V. Canadian Legal Principles on DNA Collection
The right to Privacy is protected mainly by section 8 of the Canadian Charter of Rights and Freedoms which protects against unreasonable search or seizure and section 7 which protects the right to security of the person.
In relation to DNA testing, the Courts have stated that
- DNA constitutes personal information
- In fact, DNA constitutes such sensitive personal information that it warrants the highest possible level of protection.
In the context of forensic bio-banks, but applicable to genetic research in general, the OPC has put forward the position that
- DNA collection is, in principle, an invasion of privacy,
- That it may be allowed whether upon meaningful consent or, in the case of forensic DNA testing, under overriding public interest,
- That DNA is “the ultimate identifier”, holding the veritable life code of a person, and consequently, calls for the highest protection in relation to the conditions of collection as well as the security of the information.
- These conditions are guided by the following basic considerations:
- The collection must be minimal, in the sense of strictly as necessary for the stated purpose,
- It must be subject to authorization under the law, meaning either free and informed consent of the individual or judicial authorization,
- It must be protected with strict access rules to prevent unlawful disclosure,
- The bio-bank, and the regime for collection and protection of the data must be subject to an independent, robust governance structure, including strong consent protocols, clear privacy policies and effective oversight mechanisms.
VI. The issues before us
Let me start by describing current issues that arise in our examination of privacy in relation to genetic testing, to then move to two concrete examples of files we have intervened on – one a Privacy Impact Assessment, on government led genetic research, the other our review of legislation on assisted reproductive technology.
- Autonomy: if we accept that the right to privacy is the right to control the disclosure of one’s personal information, then autonomy is the central element of privacy. In our view, it is entails,
- The autonomy to choose to know about one’s genetic information or not, and
- The autonomy to protect that information from others.
- Flowing from that is the notion of meaningful consent:
- Canadian Law, as most legal regimes, defines meaningful consent as “free and informed”. In this age of “opt in” and “opt out” consent, I would add that meaningful consent must be deliberate.
- In the context of genetic research, the question is how can consent be truly free and informed and therefore meaningful, in the face of such scientific complexity, where very few will understand its implications?
- How can consent be specific enough to be valid, when its scope is difficult to define, again, in view of the scientific uncertainty of where the research can go?
- How can withdrawal of consent be accommodated in the context of the continuity and integrity of research?
- Can minors give consent? If parental consent has been given for a minor, should “re-consent” be sought after a certain age and if so, after what age?
- If broad consent is given to accommodate the scope of scientific research, is still informed and deliberate?
- In relation to security of the data,:
- What is a truly secure regime for such sensitive information? How do we keep it secure as it crosses borders? How do we ensure security and oversight in transnational genetic databanks?
I hope to illustrate how we have handled these questions in two concrete examples. The first is our Privacy Impact Assessment review, currently underway of Statistics Canada’s Canadian Health Measures Survey (CHMS). It is a longitudinal study to develop benchmarks in public health and it requires biological specimens, some for genetic testing.
- Participation in the CHMS is voluntary;
- The CHMS collects the specimens upon consent and consent can be withdrawn;
- The samples are used for both genetic testing and non-genetic testing;
- For genetic testing,
- Candidates must be over 20;
- Specimens and identity are kept separately but may be re-linked if needed; the reason for allowing re-linking is to allow withdrawal of consent as well as to pursue new avenues of research as necessary, and therefore collect additional information;
- Specimens are stored indefinitely;
- Data may be shared with Health Canada and the Canada Public Health Agency;
- Commercial use is not envisaged;
- There would be periodic reviews of storage and research protocols by an accredited, independent outside agency.
In analyzing this Privacy Impact Assessment, we have made several recommendations, which we are still discussing with Statistic Canada – and which bring out my initial point about the scientific uncertainty around DNA and, therefore, the importance of legal parameters to circumscribe it:
- For example, on anonymization of samples we understand Statistics Canada and the Canada Public Health Agency may identify uses of the research that cannot all be predicted at the outset and therefore may require re-linking to identity to obtain additional information and therefore pursue the necessary research; moreover, we recognize that samples must be “re-linkable” to allow effective consent withdrawal; a practical approach to privacy that both preserves the right to privacy and allows proper research could be to offer participants two options: either they choose true anonymization and therefore forgo the right to withdraw consent or “re-consent” to further research or they keep these rights but then allow the possibility of re-linking;
- On consent, we raised the issue of how consent can be meaningful if uses for the specimens cannot be specified at the time of consent; in this case, a practical approach to privacy may mean broad consent with a robust governance structure that may distinguish between valid consent for certain similar purposes identified at the moment of consent – considered primary purposes - and the necessity to return for “re – consent” for other new, distinct purposes;
- On retention, we question the indefinite storage period precisely because potential uses of the DNA can change according to scientific research developments and therefore compromise the validity of initial consent and distinction schedule.
- On review of processes, we recommended it occurs every 5 years by an accredited, independent body.
We are continuing our dialogue with SC and CPHA but there is clearly a tension to ease between the objectives of the scientific research and the limits imposed upon them to protect privacy.
- A second concrete example of our work in relation to genetic testing is our intervention in the creation of the Assisted Reproduction Agency of Canada. The mandate of the agency is generally to:
- Protect the health and safety of Canadians in assisted reproduction,
- Protect the well-being of the children born out of assisted technology,
- Ensure research in the area evolves in a controlled environment.
- With that view, the agency, and in regard to what is relevant to our discussion,
- Exercises oversight over assisted reproduction and
- Establishes a Personal Health Information Registry containing information as it pertains to donors, persons undergoing procedures and children conceived, including genetic information.
- When the Assisted Reproductive Technology Legislation was brought into force in 2004, the OPC insisted on mainly three principles:
- Donors have the right to control access to their identities, except in specific circumstances that raise health and safety concerns,
- Persons using AHR , the children conceived and their descendants must have access to relevant information about the donor such as medical history, genetic information and personal characteristics ,
- But the identity of the donor cannot be disclosed without the donor’s consent.
- The privacy regime adopted by the Agency does follow our recommendations recognizing that the success of the AHR regime will depend on the policies to protect personal information. Specifically,
- All donors and persons undergoing AHR must consent in writing regarding the collection, retention, use, disclosure, destruction and transfer of their personal information;
- Disclosure of health information is regulated by the Act and disclosure of identity is subject to consent unless it is required by a physician to address health and safety risks to a person undergoing AHR.
- The Agency reports to a Board that will hold it accountable for all its policies including privacy.
The Assisted Reproduction Agencies example is a segway to my next point: emerging issues. As we resort more and more to assisted reproduction, we can see on the horizon an increase in the conflict that will oppose the donor’s condition to remain anonymous to the offspring’s claims to the right to know one’s genitor.
THE ISSUES ON THE HORIZON
We are also watching trends in direct to consumer testing to see whether privacy is properly protected in the myriad of new sites and companies that offer genetic testing as a service. Our Research Branch is studying the issue and we have funded a study to be posted on our website on Privacy Policies and Practices of Direct-to-Consumer Genetic Testing Companies.
Privacy issues relate not only to the protection of the very sensitive information provided in a genetic sample, but also the data that accompanies it – financial, in the course of the commercial transaction, life style, age or other information provided with the sample and, more importantly, and unique to genetic testing relating to the information it generates in itself. That information is too often inaccurate, misleading and, at times, harmful.
We are also examining the issue of genetic surveillance, keeping abreast of trends to collect genetic information whether for employee monitoring, population tracking, insurance purposes and what new uses of genetic information are put forward, from increasing commercial activity as well as expanding research needs.
THE BASICS TO MOVE FORWARD
In this context of uncertainty, I would like to leave you with what I see as at least some beacons to protect privacy within the progress of genetic research.
- First, we need to inform the public of trends, developments and privacy implications of genetic research to generate a societal debate.
- We also need to promote knowledge development and multi disciplinary discussions among experts. We need to ask - what is, according to our social values, the proper balance between the public interest in scientific research and the collection of genetic information?
- What constitutes, deliberate, valid consent? How much control do we want to maintain over genetic information and therefore how explicit do we want consent to be in the context of the practical reality of research?
- Second, we need a clear legislative framework to protect genetic information – the model of the Act on assisted reproductive technology is, in our view, a good example: it regulates every aspect of the management of genetic information to protect the fundamental values underlying the right to privacy.
- Current legislative regimes on data protection simply do not correspond to the specific reality of both the potential and the implications of genetic research, whether on meaningful consent, on expressly specified objectives, or on primary or secondary purpose.
- In addition, we need international norms to govern cross-jurisdictional issues relating to genetic testing.
- Third, we need to maintain a minimalist approach which, in our view, entails:
- Limiting the collection to what is strictly necessary according to the objectives of the research; and
- Providing for re-consent, in case additional information is needed or additional purposes are identified in the process of the research.
- Finally, we must develop an architecture of oversight that corresponds to the level of sensitivity of DNA information and therefore ensures compliance with the fundamental rights and values that must remain unchanged, in this ever changing field.
- Date modified: