Applying the Privacy Act to genetic information

7.12 The Inquiry has highlighted the privacy problems that arise in the practical application of the Privacy Act and the National Privacy Principles (NPPs) to genetic information.^[7] In particular, special issues may be raised by the familial nature of genetic information and by its predictive power, especially in relation to an individual’s ‘right not to know’ about his or her long-term health prognosis.

7.13 These issues are examined in various contexts throughout this Report. More generally, submissions referred to possible problems in applying the NPPs in relation to consent requirements, the collection of clinical family history information, the disclosure of genetic information to genetic relatives of a patient or to genetic registers, and the de-identification of genetic information.^[8]

7.14 Privacy NSW expressed a general concern that the NPPs are too widely drawn for the purposes of genetic information privacy. It also expressed specific concerns about consent to the use of genetic information in research.^[9] Similarly, the Australian Privacy Charter Council submitted generally that the NPPs contain too many exemptions and exceptions. The Council also raised specific concerns about the definition of ‘health information’, the exceptions in relation to collection and use and disclosure principles, and the application of the access principles to familial genetic information.^[10]

The familial nature of genetic information

7.15 Many submissions referred to privacy issues arising from the fact that genetic information is familial, that is, details are shared between living and deceased relatives and the information revealed may have implications for all of them.^[11] As the New South Wales Health Department observed:

Privacy principles have been designed with the individual’s right to privacy paramount. Handling genetic information requires a different view concerning ownership of shared information. Information about a deceased relative may be of value to one individual but it may also reveal information about another relative whose identity could be ascertained, thereby conflicting with their right to privacy.^[12]

7.16 Submissions confirmed that the familial or collective nature of genetic information is a characteristic that needs to be given special attention in considering the application of information privacy principles to genetic information.^[13] For example, Dr Graeme Suthers noted that privacy conflicts in the clinical use of genetic information

usually have to do with the familial nature of the disorder or information rather than its ‘genetic’ nature per se. It is not the DNA basis of the diagnosis that is of concern. Similar conflicts could arise in relation to familial disorders that are diagnosed by non-DNA means. In a society that places such a premium on individual autonomy, the fact that we are irrevocably linked to other people can cause difficulties.^[14]

7.17 The Royal College of Pathologists of Australasia observed that privacy principles that apply to individuals present practical difficulties to health service providers who deal with genetic information that is, by its nature, shared.^[15] Similarly, Dr Ian Turnbull expressed concern that:

Given that genetic information obtained from one or more individuals immediately provides information, within defined probability limits, about other individuals, are the privacy and other rights of those other individuals (third parties) properly protected …?^[16]

7.18 One means of balancing the interests of individuals in the privacy of their genetic information with the interests of family members in genetic information that they need for their own health care, is to differentiate between two aspects of genetic information. This approach is advocated by Professor Loane Skene. In her view, many misunderstandings about genetic information can be avoided if people understand that some information is familial and should be shared between genetic relatives, while some is personal to individuals and should be protected by the same privacy principles as any other personal information.^[17] The familial aspect of the information is that a mutation exists in a family. This will sometimes be known by family members in any event because earlier members will have died or suffered from the mutation.

7.19 However, family members may not keep in touch with one another or may not know family medical history. Also mutations can occur spontaneously so it is possible that a person might be the first in the family to have an inheritable mutation. If that occurs, it may be very important for other family members to have access to information about the affected relative, or even to test that person’s tissue, to look after their own health. Professor Skene states that access to information or tissue for such purposes should be allowed. However, the person’s own genetic status (namely, whether he or she is positive or negative for the family mutation) is personal information and should not be revealed to other family members without the person’s consent.

7.20 Professor Skene has argued that a ‘medical model’ of regulation should apply to genetic testing, rather than a regulatory approach like the Privacy Act, which focuses solely on protecting an individual’s right to privacy. The medical model is based primarily on what doctors consider to be best practice in providing medical care for patients and their families.^[18] Control of genetic samples and information, in so far as they are familial and not personal, would be shared among genetic relatives.

On this model, people would not have the ultimate right to ‘control’ their information and the use of their tissue taken for genetic testing (though the nature and use of the information and tissue will be fully discussed at the outset before testing is undertaken); and doctors will have a special role in providing and imparting genetic information that may appear contrary to their traditional obligation to maintain patient confidentiality.^[19]

7.21 The Office of the Federal Privacy Commissioner (OFPC) responded that, while this approach had merit, it failed to take into account a number of other relevant factors, including the fundamental nature of an individual’s right to maintain a degree of control over the handling of their health information, the need for individual rights to be balanced with the legitimate interests of third parties and of the community in general, and the rights of individuals ‘not to know’.^[20]

7.22 However, Professor Skene’s approach to the two aspects of genetic information meets these concerns to a considerable degree. Individuals would retain the right to have their own genetic status kept private, although they could be compelled to reveal the familial aspect of the information where other family members have a legitimate need to know this for their own health care. Where the information can provide a clear clinical benefit for family members, it can usually be assumed that those members would want to know the information and their right not to know is somewhat rhetorical (see below).

7.23 The familial nature of genetic information is also discussed in the context of the Inquiry’s recommendations concerning how health professionals collect and deal with genetic information about genetic relatives and in relation to first-degree genetic relatives’ rights of access to genetic information (Chapters 21–22).

The right not to know

7.24 The right not to know has been stated as the right people should have to be protected from information that their own bodies can yield, based on the ethical principle of respect for autonomy. This principle may be seen as having particular application to genetic testing because of the predictive power, or perceived predictive power, of genetic information in relation to a person’s long-term health prognosis and other physical and behavioural characteristics.^[21]

7.25 This right was a common topic in submissions that considered the application of information privacy principles to genetic samples and information.^[22] The Centre for Law and Genetics submitted that the right not to know should be recognised under privacy legislation. They submitted that, at present

[n]ot only is there no specific recognition or protection of the right not to know, there are provisions contained in the Act (in particular, NPP 1.5) which may encourage information to be inappropriately disclosed to the individual about whom it is collected in an over zealous attempt to comply with the requirements of the legislation.^[23]

7.26 Under the Privacy Act the right not to know is protected to some extent by the requirement that, in most circumstances, genetic testing will not be permitted without the consent of the individual concerned, given after appropriate information has been provided to them.^[24]

7.27 The specific concern raised by the Centre for Law and Genetics related to NPP 1.5, which provides that, if an organisation collects personal information about an individual from someone else, it must take reasonable steps to ensure that the person is or has been made aware of the collection. The concern is that if genetic information is collected from one individual then, in some circumstances, there may be an obligation to notify genetic relatives about this information, thereby revealing information about their own genetic status.

7.28 DP 66 noted that a Temporary Public Interest Determination (PID) had been issued by the federal Privacy Commissioner and that, at least where a health service is being provided, the Temporary PID may be sufficient to ease concerns that information will be inappropriately disclosed as part of a notification under NPP 1.5.^[25]

7.29 However, the final PIDs, issued on 15 October 2002, do not exempt organisations from their obligations to adhere to NPP 1.5.^[26] Therefore, organisations remain obliged to take reasonable steps to ensure that third parties are informed about the collection of information. This is a matter that requires more consideration in the context of the development of a new PID dealing with the operation of genetic registers (see Chapter 22).

7.30 The right not to know is also examined in the context of the Inquiry’s recommendations concerning the disclosure by health professionals of genetic information to genetic relatives without the consent of their patients (see Chapter 21).