FOURTH PRIVACY ISSUES FORUM

AUCKLAND, NEW ZEALAND

THURSDAY 10 JULY 1997

GENETIC PRIVACY

LOOKING BACKWARDS - LOOKING FORWARD

The Hon Justice Michael Kirby AC CMG ¹

 

NEW PROBLEMS

It seems aeons ago since I was working on the OECD Guidelines on Transborder Data Flows and the Protection of Privacy ² . They were my introduction to privacy protection in times of great technological change.

It is not as if the notion of protecting privacy as a fundamental human right was new. The Universal Declaration of Human Rights, adopted in 1948, included privacy in its catalogue ³ . Its provisions were subsequently reflected in the International Covenant on Civil and Political Rights ⁴ and in the European Convention for the Protection of Human Rights and Fundamental Freedoms ⁵ . The formulation of specific and detailed principles for the protection of privacy began in the Nordic Council and advanced in the Council of Europe. Its work became the foundation for the OECD exercise with its potential to influence law-making on an intercontinental scale - including in countries as far from OECD headquarters as New Zealand and Australia.

The OECD Guidelines were adopted in 1980. They were accepted by Australia in 1984. They led directly to federal privacy legislation in Australia in 1988. In 1990 I was recalled to the OECD to chair a second committee. It developed a further set of Guidelines on the Security of Information Systems . Last year, I was associated briefly with the current work of the OECD which is in the field of Cryptography Guidelines ⁶ . The passage of nearly 20 years since the first OECD Committee commenced its work has seen astonishing developments in information technology. Those developments present new and complex questions. They render necessary the reconsideration of the original OECD Guidelines on Privacy for their application to the information technology of today and tomorrow.

Quite apart from privacy, data security and cryptography in the context of automated data, the intervening decades have seen a proliferation of surveillance technologies which afford law enforcement agencies and others new powers to intrude into individual privacy ⁷ . Those powers often show up the inadequacies of common and statute law ⁸ . On more than one occasion they have engaged the attention of the European Court of Human Rights ⁹ . Indeed, three cases involving the use of electronic surveillance currently stand for judgment before the High Court of Australia ¹⁰ . So the implications of new information technology for the right to privacy, recognised by international law, are lively topics. They are under regular legislative, administrative and judicial attention in countries such as New Zealand and Australia.

Yet it is not of these that I wish to speak. They merely provide the background of concept and principle for my assignment. Instead, I want to review the implications of a different technology that has arisen in a way not contemplated when the OECD Guidelines were adopted. It has arisen from the marriage of advances in information technology with the new science of biology and genetics.

GENOME AND PRIVACY

The Human Genome Project was launched in 1988. Before that, for 20 years, informal cooperation had been going on. But over the past decade scientists have been engaged in the greatest scientific cooperative project in history. Its purpose is to record the location of the estimated 100,000 human genes and to map the intervening sequences. Mankind is now examining the basic structures of our being. There we will find the markers which identify whether the subject will be tall or short, blue-eyed or black-haired. We will discover whether the subject has a susceptibility to common diseases such as cancer or heart failure or Alzheimer's disease ¹¹ . The potential is there for discovering propensity to schizophrenia or diabetes or asthma, to the deficiencies that make us prone to alcoholism or catastrophic diseases including Huntington's, cystic fibrosis, fragile X, muscular dystrophy and so on. The potential to benefit humanity is enormous. There has never been anything quite like it before in medicine. To understand, one has to reach into a metaphor of mapping and the work of the great cartographers of medieval times, who mapped our planet and mapped the stars and told us about ourselves as creatures of the universe we live in. The Human Genome Project is assembling the encyclopaedia of medical practice in the millennium we are about to enter. The hit and miss of the past will gradually give way to scientific knowledge of great accuracy, high predictability and even certainty. The heroic aim of the Project was well expressed by the Australian Aboriginal poet, Oogeroo of the Nunuccal ¹² :

"Let no-one say the past is dead.
The past is all about us and within
Haunted by tribal memories, I know
This little now, this accidental present
Is not the all of me, whose long making
Is so much of the past."

Within the past two years I have been appointed to two bodies concerned with ethical and legal implications of this extraordinary scientific adventure. The first is the International Bioethics Committee of UNESCO. It has prepared a Preliminary Draft for a Universal Declaration on the Human Genome and Human Rights . A penultimate edition of that document was settled by an international group of lawyers in which I participated last December. That draft will be scrutinised by a Committee of Government representatives in late July 1997. It may be expected that a final document will be presented to the General Conference of UNESCO in Paris at the end of 1997. If adopted, it will be recommended to member countries for acceptance. It may, in due course, give rise to a treaty with binding legal obligations.

In addition to the UNESCO appointment, I have joined the Ethics Committee of the Human Genome Organisation itself. This body was formerly based in Bethesda, USA. Its secretariat is now in London. It produces recommendations which are addressed to the Council of HUGO. The most relevant of these has been adopted as a HUGO Statement on the Principled Conduct of Genetic Research ¹³ .

There are many diverse problems for human rights and for policy decisions presented by the Human Genome Project and genomic research. Thus, the UNESCO draft deals with the general proposition that the human genome is the common heritage of humanity. It contains articles concerning research on the human genome; the rights of the persons concerned; the conditions for the exercise of scientific activity in relation to the genome; various duties of cooperation in relation to genomic research and specific provisions on the promotion and implementation of the Declaration once adopted.

Amongst the articles concerned with research on the human genome is Article 5. In its current draft, it states:

"No research or applications should be allowed to prevail over the respect for human dignity and human rights, in particular in the fields of biology and genetics".

Amongst the articles dealing with the rights of persons concerned are the following:

"Article 6(b)

Before ... research, treatment or diagnosis is done, the prior, free and informed consent of the person concerned shall be obtained or ... that of a representative guided by the person's best interests ...

Article 7

No one may be subjected to discrimination based on genetic characteristics that is intended to diminish or has the effect of diminishing human dignity or impairing the right to be treated equally.

Article 8

Genetic data associated with a named person and stored or processed for the purposes of research or any other purpose must be held confidential and protected against disclosure to third parties".

I emphasise that these are preliminary drafts. They may be altered. But they give something of the flavour of the work of the UNESCO Committee. None of us in UNESCO or HUGO doubts the importance - scientific, moral and economic - of the issues which genomic research presents. One of those issues concerns genetic privacy.

Genetic privacy has been the subject of much writing. In 1992 the Canadian Privacy Commissioner issued a report on genetic testing and privacy. He concluded ¹⁴ :

"No surveillance technology is more threatening to privacy than that designed to unlock the information contained in human genes. ... [We are] seeking a medically powerful but potentially dangerous treasure: information about how our genes make us tick. Today we can ask who among us is likely to have healthy babies or fall ill with a genetic disease. In the future, we may be able to use genetic testing to tell us who will be smart, be anti-social, work hard, be athletic or conform to prevailing standards of beauty. One is struck by the parallel between unlocking the gene in the nineties and unlocking the atom in the forties. In both cases the excitement of discovery dulled critical assessment of the implications. In both cases we allowed scientists to unleash forces which can alter life as we know it, paid for their efforts with public funds and, at least initially, set few ethical or legal controls on the enterprise".

In 1995 the Privacy Commissioner of New Zealand participated in a conference organised by the Health Research Council of New Zealand concerning the use and misuse of human genetic information. He pointed to the limitations of the New Zealand Privacy Act from the point of view of medical data. That Act gives no protection for information about people who had died more than 20 years earlier. It does not detail answers to the many problems posed by the collection, use, storage and destruction of genetic information. In particular, it does not address the setting up of a national data base to contain individual DNA profiles. The New Zealand Privacy Commissioner reminded his audience that the Privacy Act permitted him to issue specific Codes of Practice which could modify the general information privacy principles in ways relevant to the particular problem in hand. By identifying some of the problems, he posed a question of legal principle which remains to be answered. Is it appropriate to deal with such questions under delegated legislation? Or are these matters of such importance and sensitivity that they should have specific attention of an elected Parliament ¹⁵ ?

The Privacy Commissioner in Australia in 1996 issued an Information Paper ¹⁶ identifying many of the problems to which I will now turn. A great value of this paper is the inclusion of information on developments in other jurisdictions. So far, then, there has been much discussion but few conclusions and still fewer laws.

GENETIC INFORMATION AND PRIVACY

One of the members of the UNESCO Committee is Professor Bartha Knoppers of Montreal, Canada. She is also currently the chair of the HUGO Ethics Committee. Under the auspices of UNESCO, she has produced a discussion document on the issues which I wish now to raise ¹⁷ . By raising those issues with you, by reference to Professor Knoppers' paper, I seek to engage the input of this body of experts on privacy upon some of the key questions which are presented to privacy law and policy by the advances of genetic science. I acknowledge my debt to Professor Knoppers' analysis. We should use this opportunity collectively to address some, at least, of the problems to which she calls attention.

Professor Knoppers divides her examination of genetic privacy into two parts. The first relates to disclosure and access. The second to security mechanisms designed to uphold the chosen legal regime.

1. disclosure and access:

The starting point is an acceptance that genetic information, being a subset of medical and healthcare information about an individual, is prima facie entitled to the same protections for privacy and confidentiality which, from the time of the Hippocratic Oath, have bound health personnel to respect all information secured in the healthcare relationship.

As against this general principle, some recent international elaborations have suggested the need for modifications. In particular, it has been proposed that genetic information should be shared, as a form of familial property, amongst family members who have a legitimate interest in genetic information that affects them ¹⁸ . The same thought can be seen in earlier suggestions about a "higher obligation" to members of society which may authorise, in exceptional cases, a breach of the general principle of medical confidentiality. The instances cited include cases of psychiatric knowledge which could be relevant to the protection of the community and cases involving HIV/AIDS sero-status where the conduct of the patient may put a partner or others at risk of which they would otherwise be ignorant ¹⁹ .

Professor Knoppers analyses the suggested rules and exceptions for the disclosure of, and access to, genetic information. She does so under a number of sub-headings:

(a) The subject (person tested): It has long been assumed that anyone undergoing medical intervention or participating in research would automatically receive, and want to have, the results as an attribute of the respect due to the human person. However, this is not so clear cut in the case of genetic information. Thus the HUGO Ethics Committee has recommended that participants in human genetic research should be given "choices to be informed or not with respect to results or incidental findings". Such choices should be respected out of recognition that some people would wish not to know that they carry a gene which will inevitably proceed to serious (and possibly fatal) genetic disorders ²⁰ .

The privacy principle which ordinarily applies at a national level requires full disclosure of, and access to, the subject's own genetic information. Occasionally there are exceptions, as for results concerning paternity ²¹ . Given the early stage of genomic understanding, general consent forms promising access to genetic data may need reconsideration. Thus, in the future, the subject may not wish to have total access to the vast range of data likely to be developed from a genetic sample. The facility for change of mind by the subject must be allowed given the rapid advance of genomic understanding and its potential to present increasingly detailed prognoses of genetic abnormalities.

(b) Family members: In general, at the moment, family members are grouped for the purposes of international principles and most domestic laws amongst "third parties" to whom genetic information of the subject may not be given without the subject's specific and informed consent. But more recent international statements have begun to recognise the possible need, in this context, to develop a new sub-classification of third parties. Of its very nature it is essential in the case of genetic information to consider the special position of those third parties who are family members in the same genetic group. This has been recognised by HUGO, the World Medical Association and an Expert Group of the World Health Organisation ²² .

In the United States a Presidential Commission expressed four conditions for disclosure of genetic information to family members without the subject's consent ²³ . Similar principles have been adopted in Canada, the United Kingdom and the Netherlands. Without legislative change, it is open to question whether the rules of the common law and of equity as to confidentiality would be adapted by court decisions where a subject complained about disclosure of the subject's medical information, even to a family member ²⁴ .

(c) Insurers/employers: A great deal of attention both in international bodies and in national enquiries has been addressed to access by other third parties such as insurers or employers. Reference has already been made to the UNESCO draft. It contains a requirement that the confidentiality of genetic data "associated with a named person and stored or processed for the purposes of research or any other purpose, must be protected from third parties" ²⁵ . At a national level, the general principles safeguarding the subject's medical data from disclosure to insurers or employers without consent remains the norm ²⁶ . Some countries have introduced a statutory prohibition to forbid contractual obligations which would otherwise give such third parties a free hand ²⁷ . At least one other country has adopted a voluntary moratorium on access to genetic information by employers and insurers ²⁸ . In the absence of legislation, the employee or insured is extremely vulnerable to pressure to "consent" to affording direct access to the entirety of genetic data or to specified data. There is a significant question for legislative decision here. It is presented by a consideration of those laws which have opted for a wall around access to ambit genetic information. Yet it is difficult, in principle, to exclude precise and accurate data whilst at the same time permitting a battery of old-fashioned medical checks of the kind long tolerated as pre-conditions to certain forms of employment and particular insurance coverage.

(d) Researchers: The question of access to anonymised genetic data troubled the original OECD Committee. It is still the subject of debate both at an international and national level. In 1992 the HUGO Ethics Committee approved the principle that DNA sequence data "should be openly available to the scientific community" ²⁹ . The WHO experts agreed to access "provided that strict confidentiality is observed or that identifying characteristics are removed" ³⁰ . The disjunctive may worry some privacy guardians. There are similar debates at the national level. Whilst in some countries anonymised data is approved as necessary and useful to combat disease ³¹ , in other countries strict guidelines or laws require that even anonymous material should not be used without first giving the patient the opportunity of objecting to the inclusion of his or her data ³² .

(e) The State: The draft UNESCO Declaration illustrates the link between genetic information and the responsibility of the State. The State must prevent discrimination on the basis of genetic characteristics ³³ . Yet, at the same time it must foster dissemination of knowledge concerning the human genome ³⁴ . These provisions can be reconciled by codification or by anonymising the data. The 1992 Canadian report stated that "persons should have reasonable expectations of genetic privacy" and "governments should not oblige persons to learn about the genetic traits or disorders" through mandatory testing. A private draft Genetic Privacy Act in the United States reflects this principle. Save for an exception for law enforcement, it provides that no one may be compelled to disclose such genetic information in legal proceedings ³⁵ .

2. security mechanism

(a) International and regional: The Statement on the Principled Conduct of Genetic Research issued by HUGO in 1996 recognises the importance of individual privacy and the need to protect it against unauthorised access. It advocates that such information should be coded and given appropriate security. Similar advice is given by the WHO experts and by the Council of Europe. The object is to prevent the haemorrhage of such potentially intrusive data from which a vast amount of information on the subject could now, or in the future, be derived.

(b) National: At the national level those countries which have adopted legislation for the protection of individual data generally have an established regime which can be applied or adapted for the protection of genetic data. That regime may need modification and fine-tuning. But at least there are legal sanctions and procedures in place with standards for the guidance of all concerned. In a country such as Australia where comprehensive privacy legislation has not been enacted and where its extension was recently rejected ³⁶ , the absence of enforceable legal protection may present problems for the individual at risk. Equally important perhaps, it may present problems for the movement of genetic data in, through and out of such a country because that country is unable to demonstrate to outsiders an established and effective privacy protection regime. Of course, medical tradition, developed guidelines and the recommendations of a privacy guardian ³⁷ will go part of the way towards protecting privacy interests. However, it seems likely that the heightened potential of the combined technologies of genomic research and informatics and the international movement of such personal data will eventually demand legislative standards in New Zealand and Australia. Indeed, it has lately been suggested that business interests, rather than vocal individuals, may ultimately prove the major lobbying group in Australia to this end ³⁸ .

CONCLUSION

The foregoing touches but lightly upon some of the main controversies that arise in protecting the privacy and confidentiality of genetic information. It is the value of a meeting such as this that experts on privacy can afford their comment for the guidance of international bodies such as UNESCO, WHO and HUGO working in this area. They can also draw on the work of such bodies to stimulate the development of guidelines, codes of practice, administrative rules and legislation for national consideration. The challenge is to adapt and expand the basic privacy principles to the new technologies and the novel problems - moral, legal and economic - which they present.

1	Justice of the High Court of Australia. Formerly Chairman of the OECD Expert Group on Transborder Data Flows and the Protection of Privacy; former Chairman of the OECD Expert Group on Security of Information Systems; former Commissioner of the WHO Global Commission on AIDS; Member of the International Bioethics Committee of UNESCO; Member of the Ethics Committee of the Human Genome Organisation (HUGO). President of the International Commission of Jurists. Personal views.
2	Organisation for Economic Cooperation and Development, Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980). See Australian Law Reform Commission, Privacy , Vol 2 (ALRC 22), Canberra, 1983 at 79-80.
3	Art 12.
4	Art 17.1.
5	Art 8.
6	M D Kirby, "OECD Cryptography Guidelines in Context" (1996) 3 Privacy Law and Policy Reporter 121; (1997) 7 Journal of Law and Info Science at 137.
7	S Bronitt, "Electronic Surveillance, Human Rights and the Criminal Justice" (1997) 3 (2) Aust J Human Rights 183 at 186.
8	Malone v Metropolitan Police Commissioner [1979] Ch 344 at 367.
9	Klass v Federal Republic of Germany (1975) 2 EHRR 214; Malone v United Kingdom (1984) 4 EHRR 330; Kruslin v France (1990) 12 EHRR 547.
10	Ousley v The Queen (validity of warrants authorising use of listening devices); The Queen v Swaffield and Pavic v The Queen (covert use of devices by alleged surreptitious agents of police without warnings to accused).
11	R Williamson, "What is the New Genetics?" in Shiron (Uni Melbourne) Vol 3 No 5 May 1997 at 5. See also M D Kirby, "The Human Genome Project - Promise and Problems" 11 J Contempt Health Law & Policy 1 (1994) at 5; cf T H Murray et al (eds) The Human Genome Project and the Future of Health Care (1996) vii.
12	K Walker (Oogeroo of the Nunuccal) "The Past" in The Dawn is at Hand (1996) at 25.
13	(1996) 3(2) Genome Digest at 3.
14	Privacy Commissioner of Canada, Genetic Testing and Privacy Ottawa, 1992.
15	B H Slane "Whose Genes Are They Anyway? - The Use and Misuse of Human Genetic Information". Unpublished paper for a conference organised by the New Zealand Health Research Council, 26 July 1995.
16	Australian Human Rights and Equal Opportunity Commission, Privacy Commissioner, The Privacy Implications of Genetic Testing (Information Paper No 5), September 1996. See also B A Hocking et al "DNA, Human Rights and the Criminal Justice System" in (1997) 3(2) Aust J Human Rights at 208.
17	B N Knoppers, "Privacy, Confidentiality and Genetic Information", as yet unpublished paper for UNESCO, International Bioethics Committee (1996).
18	World Health Organisation (WHO), Guidelines on Ethical Issues in Medical Genetics and the Provision of Genetic Services , Geneva, WHO, 1995, D C Wersz et al (eds) at 7.2.2. See Knoppers above n 16 at 4.
19	Trasoff v Regents of University of California 551 P 2d 334; 17 Cal 3d 425 (1976). See "Must the Doctor Tell?" (1996) 3 JLM 270; "Medical Duty of Confidentiality and Prospective Duty of Disclosure" (1995) 3 JLM 75; "HIV/AIDS and the Law" Need for Reform in Australia" (1994) 1 JLM 9; "Professionals and Confidentiality" (1992) 12 Syd L Rev 317. Reflections of this controversy appear in the Pugmire case in New Zealand. See "A Matter of Balancing Rights", in Private Word (News by the NZ Privacy Commissioner, Issue No 14 (March/April 1997) 1, 7-8.
20	HUGO, Statement on the Principled Conduct of Genetic Research (1996) 3(2) Genome Digest 3. See Knoppers above n 16 at 7.
21	Ibid, at 8-9 for a collection of these laws.
22	Ibid, at 9-10.
23	They were (1) that there was a real attempt to secure voluntary consent of the subject; (2) that there was a high possibility of harm if the information was withheld; (3) that the harm would be serious; (4) that appropriate precautions were taken to limit the genetic information disclosed.
24	Cf Breen v Williams (1996) 186 CLR 71; (1994) 35 NSWLR 522 (CA).
25	Art 9.
26	Knoppers, above n 16, 15.
27	Belgium, Norway and Denmark.
28	France.
29	Knoppers above n 16, 17 quoting HUGO Position Statement on (c): DNA (s): Patents (1992).
30	WHO Report, above n 17.
31	For example Switzerland, cited Knoppers above n 16, 19.
32	The Netherlands and Quebec, cited Knoppers ibid, 20.
33	Art 8.
34	Art 16.
35	Genetic Privacy Act proposal see G J Annas and L H Glantz and P A Roche Proposal (Boston, 28 February 1995).
36	See G Greenleaf, "Commonwealth Abandons Privacy - For Now" (1997) 4 Privacy Law and Policy Reporter at 1 (April 1997. Cf Merritt, "The Problem for Business: No Privacy", Australian Financial Review, 17 April 1997 at 14. Ibid, "NZ Cuts Back Privacy Laws to Suit Australia", 21 April 1997 at 9. See also M Kingston, "Push to Protect Privacy of Files" in Sydney Morning Herald 28 April 1997 at 1.
37	Such as the recommendations in the Australian Privacy Commissioner's Discussion Paper above n 15.
38	See Merritt and Kingston above n 38. See also "70 per cent of Companies support privacy laws - Price Waterhouse Survey" (1997) 4 Privacy Law & Policy Reporter 21.