Pridmore, Brant --- "Genetic testing - the privacy issues" [1996] PrivLawPRpr 47; (1996) 3(5) Privacy Law & Policy Reporter 85

---

Genetic testing -- the privacy issues

Brant Pridmore

In response to a 1992 report by the House of Representatives Standing Committee on Industry, Science and Technology, the previous Commonwealth government requested the Privacy Commissioner to prepare a discussion paper on the privacy implications of genetic testing. The terms of reference asked the Commissioner to:

• identify the privacy issues raised by the collection of genetic information in the fields of employment, health/life insurance, superannuation, law enforcement and scientific research;
• identify the consequences for individual privacy of the use and disclosure of personal information from genetic testing; and
• examine possible methods for protecting the privacy of personal information from genetic testing and for balancing privacy and other public interests.

What makes genetic testing information different?

Genetic testing information has a number of characteristics that distinguish it from commonplace health information. While other sorts of personal information can have some of these characteristics, much genetic testing information has them all:

• a person shares part of his or her genetic makeup with genetic relatives, so genetic testing information about the person can also yield information about genetic relatives; in a sense, genetic testing information is information about more than one person;
• the science behind genetic testing is fairly new and is advancing rapidly and many uncertainties remain;
• there is considerable potential for discrimination against people with a range of genetic characteristics, just as people with disabilities are often discriminated against now;
• apart from sex cells, every cell in a person's body contains all their genes, so almost any biological sample can be analysed and re-analysed for different genetic characteristics;
• a person's genetic characteristics influence many of the things (like physical appearance and some psychological characteristics) that affect his or her sense of personal identity;
• by-and-large, a person's genetic characteristics are with him or her for life -- they cannot be changed;
• some genetic testing information has great predictive power about a person's future experience; and
• in making predictions about the future, genetic testing information often only tells us about the chances that something will occur -- it does not tell us that it certainly will.

Who uses genetic testing information?

There are five main groups that have an interest in using the results of genetic tests, apart from the person tested:

• doctors and other health care providers are the main users in Australia;
• medical researchers also use genetic testing information, often to investigate the causation or incidence of a particular health condition in the population;
• forensic scientists can use genetic testing to identify suspects accurately, just as they have long used fingerprints for the same purpose;
• insurance companies clearly have an interest in information that can predict a range of health risks. Many genetic tests do just this;
• employers, especially those who offer substantial sickness, disability or death benefits to their employees, also have an economic interest in information that can predict employees' future health experience.

Given the somewhat fragmented approach to privacy issues that currently prevails in Australia it is not surprising that very different privacy protections apply to the handling of personal genetic information, depending on who is doing the handling.

Clinical practice

The responsibilities of health care providers in relation to privacy protection are largely based on codes of professional ethics, especially the Australian Medical Association's new code of ethics which says:

Keep in confidence information derived from your patient, or from a colleague regarding your patient, and divulge it only with the patient's permission. Exceptions may arise where the health of others is at risk or you are required by order of a court to breach patient confidentiality.

This is clearly a very general statement and to be of much practical assistance the code of ethics really needs to be supplemented with a clear set of guidelines on what circumstances would justify making disclosures without the patient's consent and what safeguards should be applied to such disclosures.

In practice, the complex issues surrounding genetic information -- and particularly questions about disclosure of information when the subject of the information does not consent -- are resolved by counselling and negotiation between the individual doctor and patient. This is not entirely bad: it does allow for flexibility, which is desirable in such a complicated area. On the other hand, it leaves the privacy rights of the test subject undefined and relies for its efficacy on the judgement of individual doctors.

Genetic registers

Genetic registers are aggregations of the most sensitive type of personal genetic information. They are used by clinicians to trace heritable health conditions from generation to generation of the one family. They contain detailed information about family members, including medical histories and `pedigrees'. People often supply information on other family members without their consent. Registers may also contain blood and tissue samples.

Australia has some guidelines for the use of genetic registers in medical research, issued by the National Health and Medical Research Council (NHMRC). But these hardly afford adequate protection for the privacy of the personal genetic information involved. They are based largely on a description of existing conventions; they are non-prescriptive and place relatively few constraints on the way the keepers of registers may handle the personal information they contain. They are not enforceable.

The Anti-Cancer Council of Victoria is currently working on guidelines for the Familial Adenomatous Polyposis Register, which will address a range of ethical questions, including questions of personal information privacy. Hopefully this work may result in better guidelines for the handling of information on genetic registers generally.

Medical research

Most medical research in Australia is carried out under the aegis of the NHMRC. Guidelines prescribe that individual research proposals, including their privacy implications, are vetted by Institutional Ethics Committees (IECs), which are obliged to include non-scientists among their members.

On the information privacy side, a written protocol addressing the way data for the study will be collected, used and protected, is prepared and considered by the relevant IEC. The protocol is meant to adhere to a set of requirements that include the following:

• the consent of subjects to the use of their information should normally be obtained except where: obtaining consent is likely to cause unnecessary anxiety or to prejudice the scientific value of the research; and not obtaining consent will not disadvantage the subjects;
• access to medical records should normally be restricted to medically qualified investigators and research associates responsible to them;
• investigators and their associates should preserve the confidentiality of information about research subjects. Records must be kept at least as secure as they were in the source from which they were obtained;
• the use of confidential personal information should not be allowed to cause material, emotional or other disadvantage to any individual.

Such protections are without doubt better than nothing but there is no mistaking the heavy emphasis on professional responsibility and the limited recognition of any rights of the people whose personal information is being used.

Nevertheless, the system appears to work reasonably well in practice. There do not seem to have been major abuses of personal genetic information in the medical research context.

Where research involves the collection or disclosure of personal information by a Commonwealth agency that may breach one of the Information Privacy Principles (IPPs) in the Privacy Act, that Act provides that the NHMRC may, with the approval of the Privacy Commissioner, issue privacy guidelines applying to the research.

In June 1995, the Commissioner approved a revised version of Guidelines for the Protection of Privacy in the Conduct of Medical Research, produced by the NHMRC. The Australian Health Ethics Committee of the NHMRC reports annually to the Privacy Commissioner on the application of the guidelines.

Genetic fingerprinting

On the collection side, there have been recent changes to legislation governing the taking of forensic samples. Currently, in most jurisdictions, legislation permits a police officer above a certain rank to use reasonable force to carry out a medical examination of a person in custody for an offence if there are reasonable grounds for believing that this will afford evidence about the offence.

However, in Victoria, police can, with the agreement of a magistrate, use reasonable force to obtain a blood sample from a person suspected of murder, manslaughter or a sexual offence even if the person has not been charged. A similar approach has been adopted in the model national criminal code being developed by the Standing Committee of Attorneys-General. The Commonwealth has already introduced legislation based on the model code and other jurisdictions are expected to follow suit.

Another major initiative in the law enforcement area is the development for the Australasian Police Ministers' Council of a proposal for a national databank to hold genetic identification profiles. If such a proposal goes ahead, serious privacy concerns will have to be met, including the range of people whose profiles would be held, regulation of access and measures to ensure that information is used only for the purpose for which it was collected.

Insurance

The collection and use of testing information is an emerging issue for the insurance industry.

The Life Investment and Superannuation Association of Australia (LISA) has issued a draft code of conduct for the life insurance industry in relation to genetic testing, including the handling of genetic test results. The draft policy makes the following recommendations about life and disability insurance companies:

• they will not initiate any genetic tests on applicants for insurance;
• they may request that existing test results be made available to the insurer for the purposes of classifying the risk;
• they will ensure that the results of existing genetic tests are only obtained with the written consent of the individual concerned;
• they will ensure that strict standards of confidentiality apply in the handling and storage of the results of genetic tests;
• the results of genetic tests will only be used in the assessment of the insurance application of the individual on whom the test was conducted. The results will not be used in the assessment of insurance applications of relatives of the tested individual;
• the results of genetic tests will not be made available to third parties other than reinsurance companies that may be directly involved in assessing the risk.

Although the draft policy may not be perfect, and is certainly expressed only in general terms, it is encouraging that the industry has paid systematic attention to the issue at this relatively early stage. Of course, questions of effectiveness and enforceability remain.

As well as life insurance offices, health insurance funds may collect some testing information relating to pre-existing conditions. Health insurance funds in Australia are prevented by law from charging different premiums on the basis of health risk. And superannuation funds may sometimes hold genetic testing information about their members. Neither health insurance funds nor superannuation funds operate under any code relating to the privacy of personal information, let alone one specifically relating to genetic information.

Employment

This is an area where genetic testing has yet to emerge as an issue of significance. And it is a blank sheet so far as standards for handling personal genetic information are concerned. There has so far been little or no use of genetic testing information in employment contexts in Australia but as the number of available tests increases and the costs of administering them decrease, employers will be tempted to use testing information to aid their decisions about prospective and existing employees.

Misuse of genetic testing information in this field could clearly be disastrous for the people affected. Anti-discrimination law -- in particular disability discrimination legislation -- may offer some remedies for improper use once it has occurred but is not designed to cover the full range of privacy issues that may arise from employment related handling of testing information.

Next steps

The Commissioner was asked to prepare a discussion paper and in line with this the document does not make firm recommendations for particular policy measures. There has not yet been an official government response to the paper and there is little point in speculating at this stage.

However, it is worth noting that the Commonwealth Government's stated policy position supports the development of a consistent national approach to privacy protection in the private sector. It supports `a consistent Australia-wide approach' and says that the government will `as a priority, and in consultation and development with the states and territories, ensure the implementation of a privacy law regime in Australia comparable with best international practice.' Consultations have begun on the possible shape of such a scheme.

If a nation-wide applying to the private sector is put in place, it is likely that many existing privacy arrangements -- including those that apply to the handling of genetic testing information -- will need to be reviewed.

Copies of The Privacy Implications of Genetic Testing are available for $12 from the office of the Privacy Commissioner: phone [phone], fax [phone], e-mail [e-mail], post GPO Box 5218, SYDNEY NSW 2001.