ALRC submission to the Senate Legal and Constitutional References Committee Review of the Privacy Act 1988 (25 February 2005)
Introduction
1. The Australian Law Reform Commission (ALRC) has published a number of major reports in the past 25 years addressing privacy issues, including: Unfair Publication: Defamation and Privacy (ALRC 11, 1979); Privacy and the Census (ALRC 12, 1979); Privacy (ALRC 22, 1983); and, most recently, Essentially Yours: Protection of Human Genetic Information in Australia (ALRC 96, 2003).[1] ALRC 11 and ALRC 12) address very specific privacy related issues, but ALRC 22 is a wide ranging report on the protection of privacy in Australia . While the recommendations in ALRC 22 were substantially implemented with the passage of the Privacy Act 1988 (Cth), the report contains background information that still may be of interest to the Committee, including a discussion of the emerging technological advances that have the potential to threaten privacy.[2]
2. Essentially Yours (ALRC 96) was tabled in Parliament in May 2003, and contains information and recommendations that are directly relevant to the Senate Committee’s Terms of Reference. The following submission summarises relevant parts of the Report, but the Committee is referred to the relevant chapters of ALRC 96 for a more complete understanding of the report’s findings and recommendations.
3. The report has had considerable attention and influence internationally—including in the United States, Canada, the United Kingdom, New Zealand, China, Korea and Japan, as well as in international forums organised by the World Health Organisation (WHO), the United Nations Educational, Scientific and Cultural Organisation (UNESCO), the Organisation for Economic Cooperation and Development (OECD) and the Human Genome Organisation (HUGO). I n his keynote address opening the Symposium on Human Genetics and Global Healthcare at the XIXth International Congress on Genetics in Melbourne i n July 2003, Dr Francis Collins—the Director of the US National Human Genome Research Institute (NGHRI) and head of the international public consortium that conducted the Human Genome Project—described Essentially Yours as:
a truly phenomenal job, placing Australia ahead of what the rest of the world is doing.[3]
4. The Australian Government has not yet formally responded to the report, although it is understood that the Attorney-General’s Department and the Department of Health and Ageing are coordinating a formal Whole-of-Government response.
Essentially Yours (ALRC 96)
5. The Inquiry leading to the publication of ALRC 96 was conducted jointly by the ALRC and the Australian Health Ethics Committee (AHEC) of the National Health and Medical Research Council (NHMRC). One of the central concerns of the Inquiry, as specified in the Terms of Reference, was whether the existing regulatory framework is adequate to protect the privacy interests of Australians in relation to human genetic information (and the tissue samples from which such information readily may be derived)—and if not, what changes are needed. Consequently, the Inquiry examined the operation of the Privacy Act 1988 (Cth), as amended (including the private sector provisions), in this area, as well as the parallel statutory provisions in the States and Territories.
6. While human genetic information has some special characteristics that distinguish it from most other forms of personal information,[4] genetic privacy issues are usually similar in nature to those applicable to information privacy generally—and, in particular, to the privacy of medical records and other sensitive health information. The ALRC-AHEC Inquiry concluded that, while some weaknesses in the existing legislative privacy framework can be identified, they are best addressed through changes to general information and health privacy laws (in particular the Privacy Act) and practices, rather than through the development of a new regulatory framework dedicated specifically to the protection of genetic information. Indeed, after some considerable deliberation, the Inquiry generally rejected ‘genetic exceptionalism’ as an organising principle for reform in this area.[5]
Relevant recommendations
7. Essentially Yours recommends a number of amendments to the Privacy Act aimed at improving the protection of human genetic samples and information. These include (and are discussed in further detail below):
-
amendment of the definitions of ‘health information’ and ‘sensitive information’, expressly to include human genetic information about an individual (Recs 7–4, 7–5);
-
extension of the definition of ‘health information’ to include information about an individual who has been dead for 30 years or less (Rec 7–6);
-
extension of the coverage of the Privacy Act to all small business operators that hold genetic information or samples (Rec 7–7);
-
extension of the Privacy Act to cover identifiable genetic samples (Recs 8–1, 8–2);
-
creation of a right of an individual to access his or her own body samples for the purpose of medical testing, diagnosis or treatment (8–3);
-
creation of a right of an individual to access genetic information or body samples of his or her first-degree genetic relatives, where such access is necessary to lessen or prevent a serious threat to his or her life, health or safety (Recs 8–4, 21–3);
-
permission for a medical professional to disclose genetic information about his or her patient to a genetic relative, where this disclosure is necessary to lessen or prevent a serious threat to an individual’s life, health or safety (Rec 21–1); and
-
amendments to ensure that employee records containing genetic information are subject to the protections of the Privacy Act (Recs 34–1, 34–2).
Definitions of ‘health information’ and ‘sensitive information’
8. The joint Inquiry was of the view that genetic information should receive the heightened protection afforded to health and other sensitive information under the Privacy Act, but that the existing definitions of health information and sensitive information do not provide the desired level of protection for all genetic information. There are circumstances in which genetic information may not amount to ‘health information’—either because the information is not about health, disability or the provision of a health service (as in the case of parentage or forensic testing, where the focus is on identification), or because it is not about the health or disability of an existing individual (as sometimes may be the case with genetic carrier testing, where the information is primarily about the health of future children). There is also a range of non-health genetic information that falls outside of the definitions of sensitive information, in particular parentage testing done by commercial laboratories. Submissions to the Inquiry generally supported proposals to amend the Privacy Act to ensure that all genetic information is treated as health information or other sensitive information under the Act.
9. After considering definitions of health information in other health information privacy legislation, the Inquiry’s recommendation was to amend the definition of ‘health information’ to include ‘genetic information about an individual in a form which is or could be predictive of the health of the individual or any of his or her genetic relatives’ whether or not it was collected in relation to the health of, or the provision of a health service to, the individual or a genetic relative.[6]
10. The word ‘predictive’ was not intended to bear the technical meaning used in some clinical contexts, but was chosen for the purpose of consistency with existing Australian statutory definitions. The term ‘genetic relative’ was considered more appropriate than the term ‘descendants’ used in some other formulations, in order to encompass genetic information about an individual’s siblings, parents and forebears.
11. It was also considered necessary to amend the definition of ‘sensitive information’ to include human genetic test information, in order to cover genetic information derived from parentage, forensic and other identification testing that is not predictive of health.[7]
Deceased individuals
12. The Privacy Act does not presently cover genetic information about deceased persons. This may be contrasted with the position under Victorian and New South Wales health privacy laws and the Australian Health Minister’s Advisory Council (AHMAC) Draft National Health Privacy Code, which extend to personal information about individuals who have been dead for not more than 30 years. The Inquiry considered it desirable to amend the Privacy Act to cover genetic information about deceased individuals because of the implications that the collection, use or disclosure of this information may have for living genetic relatives, and adopted the 30 year period to ensure consistency with the position in Victoria and New South Wales .[8]
13. Privacy NSW submitted that the Privacy Act also should include provisions for decision making, either by a next-of-kin or an authorised person, regarding health information of deceased individuals. The Inquiry agreed with this submission and recommended that such amendments be made.
Small business operators
14. Under the existing small business exemption in the Privacy Act , some small business operators are excluded from the definition of ‘organisation’, and are therefore entirely exempt from the operation of the Act. The exceptions to this exemption include an organisation providing a health service, which holds health information. However, the Inquiry noted that a small business that is not a health service provider nevertheless can remain exempt from the Act, even though it may hold health information—such as where a business stores genetic samples or acts as a genetic data repository, but does provide a health service.[9].
15. The ALRC is concerned that this loophole poses a potential risk to the privacy of both the individual concerned and his or her genetic relatives. Essentially Yours recommended that all small business operators that hold genetic information should be subject to the provisions of the Privacy Act , whether or not they provide a health service.[10]
16. This proposal was generally supported by submissions. The Office of the Federal Privacy Commissioner supported the removal of the exemption for small businesses holding health information, but was concerned that limiting the reform to ‘genetic information’ would introduce ‘unnecessary complexity into the regulatory framework applying to small businesses’. The Inquiry was, of course, limited in the breadth of its recommendation by the Terms of Reference. However, if the definition of ‘health information’ was amended specifically to include genetic information (as outlined above), the ALRC considers that expanding the exception to cover small businesses holding health information would achieve the underlying aims of our Recommendation.
Genetic samples
17. The Inquiry’s Terms of Reference specifically referred to the privacy of ‘human genetic samples and information’. A distinction is made between the genetic ‘sample’ (the biological sample—blood, tissue, saliva and so on) and genetic information that may be derived from the sample by PCR technology[11] and DNA analysis.
18. The Inquiry concluded that the Privacy Act does not currently cover genetic samples, even where these are identifiable to an individual (eg, the container has a name or identifier attached). With the exception of New South Wales , no other Australian jurisdiction applies information privacy principles explicitly to body samples. However, a number of overseas jurisdictions are considering this issue. There was broad support for extension of the Privacy Act to cover identifiable genetic samples in the submissions and in the extensive national consultations conducted by the Inquiry partners.
19. Essentially Yours identified a number of reasons why protection for genetic samples should be covered by privacy legislation:
-
genetic samples are closely analogous to other sources of personal information that are covered by the Privacy Act and should be protected by rules that are consistent with those applying to the genetic information derived from samples;
-
there are gaps in the existing framework for protecting the privacy of individuals from whom genetic samples are taken or derived;
-
these gaps may be remedied if the National Privacy Principles (NPPs) or a set of similar privacy principles were to apply to genetic samples; and
-
no circumstances have been identified in which applying the Privacy Act to genetic samples would lead to adverse consequences for existing practices involving the collection and handling of genetic samples.[12]
20. The Inquiry made a number of recommendations in relation to extending coverage of the Privacy Act to provide enforceable privacy standards for handling genetic samples, including:
-
amending the definition of ‘personal information’ and ‘health information’ to include bodily samples from an individual whose identity is apparent or reasonably can be ascertained from the sample;[13]
-
amending the definition of ‘record’ to include a bodily sample;[14]
-
making provision for an individual’s right to access his or her own bodily samples, through a nominated practitioner, for the purpose of medical testing, diagnosis or treatment;[15] and
-
making provision for an individual’s right to access bodily samples of his or her first-degree relatives, through a nominated practitioner, where access is necessary to lessen or prevent serious threat to his or her life, health or safety, even where the threat is not imminent.[16]
21. Chapter 8 of ALRC 96 covers in detail all of the arguments for and against the inclusion of genetic samples in the Privacy Act . The ALRC notes that the Office for the Privacy Commissioner expressed some preliminary concerns about the proposal in submissions made during the Inquiry, but urges consideration of the issue based upon the completed research and consultation as set out in ALRC 96.
Access to genetic information of first-degree genetic relatives
22. Genetic information may allow inferences to be drawn about persons other than the individual to whom the information most directly relates—especially about genetic relatives. In some circumstances, the disclosure of genetic information ha the potential to prevent serious health consequences for genetic relatives by encouraging screening which allows for the early detection and treatment of inherited genetic disorders. While it is desirable that disclosure to genetic relatives normally is made by, or with the consent of, the patient—and while acknowledging that confidentiality is a cornerstone of the doctor-patient relationship in Western medicine—it became clear to the Inquiry that a range of circumstances exist in which this does not, or sometimes cannot, occur.
23. The Inquiry concluded there was a need to amend the Privacy Act to broaden the circumstances in which doctors and allied health professionals may use or disclose genetic information to prevent threats to life, health or safety. It was considered that the existing ‘serious or imminent threat’ test included in NPP 2.1(e)(i) is too restrictive in the context of shared genetic information. The Inquiry recommended that the Privacy Act be amended so that use or disclosure of genetic information by a health professional be permitted where the health professional believes that the use or disclosure is necessary to lessen or prevent a serious threat to an individual’s life, health or safety, even where such threat is not imminent—for example, where a genetic test indicates a familial predisposition to breast cancer or colon cancer. Essentially Yours notes that this amendment could be achieved either by:
-
amending NPP 2.1(e)(i) to change the ‘serious and imminent threat’ test to a more flexible formulation that accommodates predictive genetic health information; or
-
enacting a new NPP 2.1(e)(iii) to permit organisations to exercise a discretion, subject to guidelines issued by the NHMRC and approved by the Federal Privacy Commissioner, to disclose an individual’s genetic information to a genetic relative where such disclosure is reasonably believed to be necessary to lessen or prevent serious harm to any individual.[17]
24. Although Option 1 (amendment of NPP 2.1(e)(i)) may be more simple to articulate, there were some concerns that this would have implications beyond the context of genetic information—that is, by permitting disclosure of any personal information in the regulated circumstances. The Inquiry ultimately did not recommend one or other of the options, stating that further professional and community consultation should be conducted by the NHMRC to determine the preferred course of action.
25. Consistently with this position, the Inquiry recommended that genetic relatives should have limited right of access on their own initiative.[18] This right should be exercisable only in relation to familial genetic information about the siblings, parents or children of the individual (first-degree genetic relatives). Access should be provided by making the information available to the requester’s nominated medical practitioner or genetic counsellor, who can explain the clinical relevance of the information obtained for the individual. Where an organisation (such as a genetic register or tissue bank) receives a request for access to genetic information about an individual’s genetic relatives, it should be obliged to seek the consent, where practicable, before determining whether to provide access. Access should be refused where the provision of such genetic information would have an unreasonable impact upon the privacy of the individual. To assist with implementation of this recommendation, the Inquiry recommended that the NHMRC should develop guidelines for health professional in dealing with such requests.[19]
Employee Records
26. The Inquiry found the privacy protection afforded personal information—including health information—held in private sector employee records is very limited. The Inquiry recommended that the Privacy Act should be extended to cover employee records.[20] Again, due to the Inquiry’s Terms of Reference, this recommendation applies only to genetic information contained in employee records. However, the Inquiry identified a number of concerns about other forms of personal health and medical information contained in employee records, and the report contains another recommendation urging that this issue be given further consideration in a broader context.[21]
27. Previous inquiries into privacy protection had indicated concerns about the ‘employee record’ exemption from the private sector provisions of the Privacy Act.[22] While the Australian Government’s expressed preference has been to deal with the privacy of an employee’s personal information in workplace relations legislation, the ALRC believes that the current provisions of the Workplace Relations Act 1996 (Cth) do not provide the scope to protect adequately the privacy of employee records.
28. While there is no evidence that Australian employers currently are ordering genetic tests or seeking access to genetic test information, there is little doubt that the pressures to use such information will intensify as the reliability and availability of genetic tests increases, and as the cost of testing decreases in the next few years. (Dr Collins has predicted that within 10 years, and probably within five, a person will be able to provide a sample and shortly thereafter collect a CD-Rom spelling out his or her full, 3.2 billion letter, genetic sequence.) There certainly are incentives for employers to utilise genetic information when it becomes more cost-effective as an aid in reducing workers’ compensation and other insurance costs, minimising sick leave and engaging in OH&S and civil liability risk management strategies. A number of cases already have emerged internationally (although fewer in Australia ) in which employers have demanded genetic information or genetic testing, or have surreptitiously obtained such information.[23]
29. A number of submissions received by the Inquiry dealt specifically with privacy issues in the context of employee records, the majority of which expressed serious concern about the lack of privacy protection currently provided for sensitive information—particularly genetic information—held by private employers.[24] It is notable that the Australian Chamber of Commerce and Industry (ACCI), which has in the past strongly supported the existing employee records exemption, acknowledged in its submission that there is room for special provision to be made in respect of sensitive genetic information held by employers.
Related issues
30. The ALRC notes that the Committee is particularly interested in the use of emerging technologies that have implications for privacy, including ‘smart cards’, biometric imaging and microchips. The use of genetic information as a biometric identifier is discussed in Essentially Yours in the contexts of immigration control (Chapter 37) and criminal investigations (Chapter 41), although there are no specific recommendations made on this subject.
31. Finally, it should be noted that the Inquiry expressed very serious concern about the potential for non-consensual collection and analysis of DNA samples—for example, by private investigators; employers; insurers; government agencies (except as authorised by statute, such as police officers conducting forensic procedures); journalists; or a parent with a doubt about the paternity of a child. Given the ubiquity of genetic samples (in blood, saliva, semen, tissue, hair and so on), the rapid advances in the science and technology, and the growing availability and decreasing costs for DNA analysis, there is greatly increased potential for activities which threaten the legitimate privacy interests of individuals. The Inquiry found, for example, that a significant level of non-consensual DNA paternity testing already exists in Australia , conducted outside the auspices of the Family Court, and often by laboratories which are not NATA-accredited for this purpose.[25]
32. The ALRC is appropriately cautious about suggesting the use of criminal sanctions in regulating a field of activity where civil penalties or administrative remedies (or ethics or education) may be enough to secure routine compliance. However, the Inquiry was sufficiently alarmed about the privacy implications of the widespread non-consensual collection, testing and analysis of DNA to take that bold step. Accordingly, Essentially Yours recommends that t he protection of the integrity of the individual warrants the creation of a new criminal offence, to prohibit an individual or a corporation from submitting another person’s sample for genetic testing, or conducting such testing, knowing (or recklessly indifferent to the fact) that this is done without the consent of the person concerned or without other lawful authority (such as a court order, or statuory authority, or institutional ethics committee approval for research).[26]
[1] These reports are available online at <www.alrc.gov.au>.
[2] In particular, see Australian Law Reform Commission, Privacy, ALRC 22 (1983) Vol 1, Part II: Developments Threatening Privacy.
[3] . Quoted in ALRC Media Release, ‘ALRC work praised at World Genetics Congress’, 14 July 2003 ; available online at < http://www.alrc.gov.au/media/2003/mr0714.htm>.
[4] See ALRC 96, Chapter 3 on ‘Is genetic information special?’.
[5] See ALRC 96, Chapter 3 on ‘Is genetic information truly exceptional?’.
[6] ALRC 96, Rec 7–4 and [7.82].
[7] Ibid, Rec 7–5
[8] Ibid, Rec 7–6, [7.84]–[7.91].
[9] T Smyth, ‘Protecting Human Genetic Information and Its Use’ (2002) 10(6) Health Law Bulletin 64, 66.
[10] , ALRC 96, Rec 7–7, [7.99]–[7.104].
[11] The p olymerase chain reaction method, which greatly amplifies DNA to enable analysis.
[12] Ibid, [8.3].
[13] Ibid, Rec 8–2.
[14] Ibid, Rec 8–2.
[15] Ibid, Rec 8–3.
[16] Ibid, Rec 8–4.
[17] Ibid, Rec 21–1, [21.88].
[18] Ibid, Rec 21–3.
[19] Ibid, Rec 21–4.
[20] Ibid, Rec 34–1.
[21] Ibid, Rec 34–2.
[22] Including the House of Representatives Standing Committee on Legal and Constitutional Affairs and the Senate Legal and Constitutional Legislation Committee in their respective considerations of the Privacy Amendment (Private Sector) Bill 2000.
[23] See ALRC 96, Part H: Employment, esp Chapters 29-30.
[24] Ibid, Chapter 34.
[25] Ibid, Chapter 35.
[26] Ibid, Recommendation 12–1; and see generally Chapter 12.