23.07.2010
8.30 The Inquiry has identified gaps in the existing framework for protecting the privacy of the individuals from whom genetic samples are taken or derived, including gaps that might be remedied if information privacy principles were to be applied to bodily samples.[32] Examples of these gaps are outlined below, with particular reference to the NPPs.
8.31 Information privacy principles, such as the NPPs, ensure that organisations handle personal information responsibly and give people some control over the way in which it is handled.[33] In the context of health services, the NPPs promote greater openness between health service providers and consumers regarding the handling of health information.[34] The Inquiry has concluded that a similar set of principles should apply to the handling of identifiable bodily samples. Samples, as well as the information derived from them, should be handled fairly, responsibly and with adequate recognition of the expectations of the individuals concerned.
8.32 In many circumstances, genetic samples and the information derived from them travel in tandem—the samples are used, transferred, and stored for the same purposes as the information derived from them. Therefore, it might reasonably be expected that consistent rules should apply to both, unless there is some compelling reason for divergence.
8.33 For example, if personal information derived from the analysis of a bodily sample may not be used for a particular purpose, then it might be expected that the transfer of the sample itself to an organisation that intends to use it for that purpose should not be permitted. However, as discussed below, this is not always the case.
Collection of genetic samples
8.34 The core obligations contained in the NPPs relating to collection of genetic information[35] include obligations to collect this information only with consent (except in specified circumstances) and to inform individuals, at the time of collection, about how their information is to be handled.[36]
8.35 At present, no similar obligations apply to the collection of genetic samples. While aspects of these obligations sometimes arise under other laws, protection is not comprehensive. In particular, existing laws do not require the individual to be fully informed about the purposes for which the samples are being collected or the organisations or persons to whom they are transferred. For example, the general law relating to battery and consent to medical treatment requires consent to the physical taking of samples. However, this does not require the consent to be informed by information about the purposes for which the sample may be used, or the persons to whom the samples may be transferred. While health service providers may in practice inform patients about these matters,[37] there is no legal obligation to do so.
8.36 Where the samples are taken primarily for research, the Human Tissue Acts[38] require that consent be given to that use. However, these requirements do not apply where the samples are taken in the course of medical treatment[39] and in any case relate only to consent to the removal of the tissue, rather than to its future storage, use or transfer. The Human Tissue Acts do not require the donor to be informed about what will be done with the sample.
8.37 The Centre for Law and Genetics, in supporting the extension of the Privacy Act to genetic samples, stated:
It is appropriate that the sample collector should be under an obligation to explain the purpose of collection, primary and related secondary uses, the persons to whom the samples are usually transferred, access rights etc at the time of collection of the sample. This is consistent with the obligations of researchers to explain future uses of genetic information when conducting human genetic research. If these matters are properly explained to sample providers, growing concerns about the use of samples may well be alleviated. … In the existing climate, with increasing concerns about personal privacy and increasing capacity to extract personal information from genetic samples, it makes good sense that sample providers should be told about what happens to their samples after removal. In many instances, all that may be required is for the sample provider to be notified that their sample will be stored for a particular period and then destroyed.[40]
Example A. A private hospital collects blood samples from its patients for clinical purposes. Part of the sample is sent to the pathology laboratory for analysis. Without the knowledge or consent of the patients, part of the sample, labelled only with the name of the patient from whom the blood has been taken, is sent to the hospital’s research institute for storage in a tissue bank.
The current law does not proscribe the collection of samples in these circumstances. The Privacy Act does not apply to the collection of the sample, although it does apply to the collection of any information associated with the sample.
The hospital has no obligation under NPP 1 to inform the patient about the purposes for which the sample is collected or the fact that the hospital transfers samples to the research institute. Further, because the sample is collected in the course of medical treatment, the consent requirements of the Human Tissue Acts do not apply.[41] This gap in privacy protection is remedied only once the research institute analyses the sample (collecting health information) and uses this information.
Transfer of genetic samples
8.38 The core obligation contained in NPP 2 is that organisations can disclose personal information only for the primary purpose for which it was collected or for directly related secondary purposes. At present, no similar obligation applies to the disclosure (that is, ‘transfer’)[42] of genetic samples.
8.39 This has significant consequences. While the Privacy Act prohibits organisations from disclosing health information derived from a genetic sample without the individual’s consent (other than for the primary purpose of collection), no similar privacy protection attaches to the sample itself. There may be professional, regulatory, contractual or other consequences for the organisation transferring the samples,[43] but there is no general legal obligation not to transfer possession (or sell) a sample without the consent of the individual from whom the sample comes.
Example B. A public health authority holds newborn screening cards. An officer of the authority is approached by a private investigator who wishes to obtain a sample in order to establish paternity in a family dispute. The officer punches out a section of the blood spot and provides it to the private investigator.
Newborn screening cards are clearly covered by the Privacy Act because they are ‘personal information’—the cards contain identifying information, such as date of birth, as well as the blood sample, and the card is a ‘record’ for the purposes of the Act.[44] Disclosure of the card itself in these circumstances would breach the Act. However, once a section of the blood spot is punched out and physically detached from the personal information and the record on which it was stored, the Privacy Act no longer governs how the genetic sample is dealt with and it may be transferred without breaching the Act.
8.40 The Privacy Act sets out specific obligations that apply when an organisation transfers personal information outside Australia. Briefly, NPP 9 prohibits the transfer of personal information unless the recipient of the information is subject to a law, binding scheme or contract that upholds principles substantially similar to the NPPs, or the organisation has taken reasonable steps to ensure that the information will not be dealt with inconsistently with the NPPs.
8.41 It is common for Australian pharmaceutical companies to send genetic samples overseas for analysis in conducting clinical trials. Research groups also conduct collaborative projects and transfer samples to scientists overseas. Applying NPP 9 to this situation would permit the export of genetic samples to continue, but subject to safeguards.[45] This would be consistent with the National Statement, which requires that research conducted overseas under the aegis of an Australian institution must comply with the provisions of the National Statement.[46]
8.42 The Commonwealth Department of Health and Ageing supported a nationally consistent approach to regulating the export of genetic samples and agreed that NPP 9 was an appropriate model.[47] Other submissions supported the use of NPP 9, as the starting point for regulating the export of genetic samples[48]—although some submissions suggested that the provisions of NPP 9 may need strengthening to provide adequate protection for genetic samples.[49]
Example C. Without the consent of the individuals concerned, an Australian pharmaceutical company (C Ltd) conducting a clinical trial sends genetic samples for analysis by D Ltd in an overseas jurisdiction (E). C Ltd also sends associated personal information about the individuals from whom the samples come. Country E has no law restraining the secondary use or transfer of the personal information or genetic samples. There are no contractual terms dealing with this matter in the contract between C Ltd and D Ltd.
At present the Privacy Act would prohibit the transfer of the information but not the transfer of the samples themselves, even if the samples were identifiable to the individuals concerned. Applying NPP 9 to samples would mean that similar protection applies to the transborder transfer of both information and samples.
Access to genetic samples
8.43 NPP 6 of the Privacy Act states that, subject to some exceptions, if an organisation holds personal information about an individual, it must provide the individual with access to the information on request. There is no similar right to obtain access to a genetic sample.
8.44 It may be argued that extending rights of access to genetic samples serves no useful purpose because an individual always has access to a new sample because a new sample may always be taken from their body. However, some genetic samples, such as samples of cancerous tissue, may not be substitutable by new samples.
8.45 Individuals may have a legitimate need to obtain access to their own genetic samples or those of a genetic relative (see below). The reasons for such a request might include an intention to transfer the samples to a new medical practitioner for re-testing or to arrange new testing of the samples for health care purposes.
Example D. An oncologist holds medical records concerning the diagnosis and treatment of patient D. The oncologist also holds a sample of cancerous tissue surgically excised from D in the course of her treatment. D requests access to her medical records and to the excised tissue in order to transfer them to her new specialist so that the tissue can be re-tested.
NPP 6 of the Privacy Act provides a legally enforceable right for patients to obtain access to their medical records held by private medical practitioners. In this example, the oncologist is required to provide access to the medical records and, if D requests a copy of the original records, these will ordinarily have to be provided by the oncologist.[50] However, there is no similar right of access to the tissue itself.
8.46 It is problematic to apply NPP 6 to genetic samples held by medical practitioners or pathology laboratories. The content of the right of access would have to make it clear that it involves only a right to obtain access to part of the sample. It should not imply a right to require that a sample be re-analysed, de-identified or destroyed. Further exceptions to the right of access would need to be developed so that access may be refused where:
- it is not physically possible to provide part of a sample;
- providing part of a sample means that the remaining portion is insufficient for the purposes of the organisation retaining it; or
- releasing a to an individual raises public health concerns.[51]
8.47 The Inquiry’s view is that the right of access to genetic samples should be exercisable only where the samples are needed in connection with the present or future provision of medical testing, diagnosis or treatment to the individual seeking access. It is reasonable to expect that, in most cases, individuals seeking access will do so for such purposes. In the Inquiry’s view, no other purposes for seeking access are sufficiently compelling to justify a right of access under the Privacy Act.
Rights of genetic relatives
8.48 The Inquiry also recommends that the right of access to an individual’s bodily samples should extend to his or her ‘genetic relatives’. This term will require further definition, limiting it to siblings, parents or children (first-degree genetic relatives).[52] The Inquiry understands that there are cases in which access to samples taken from genetic relatives may be important, especially in relation to the detection and diagnosis of familial cancers.[53] In most of these cases, the individual from whom the sample is derived is deceased.[54]
8.49 First-degree genetic relatives’ rights of access should also be limited to access for medical testing, diagnosis or treatment purposes,[55] and to circumstances where access is necessary to lessen or prevent a serious threat to their life, health, or safety, even where the threat is not imminent.[56]
8.50 When an organisation receives a request from a first-degree genetic relative for access to an individual’s bodily sample, the organisation should be obliged, unless it is impracticable, to first ask the individual from whom the sample comes whether he or she consents to the organisation providing access. Granting access without the consent of a living individual from whom the sample has been taken should only occur in exceptional circumstances.
8.51 When seeking consent for access, the organisation should tell the individual from whom the sample comes that the sample will be handled only by health professionals and that, in most cases, the only information given to genetic relatives will be familial genetic information. In general, no details of the individual’s own genetic status will be given to genetic relatives without the individual’s consent.[57]
8.52 Where the individual does not give consent, the organisation should be able to refuse access if providing access would have an unreasonable impact upon the privacy of the individual from whom the sample comes.
8.53 The Inquiry has recommended that the Privacy Act should protect information about (and samples from) deceased individuals (see Recommendation 7–6). However, an important factor in determining whether providing access would have an unreasonable impact upon the privacy of any individual is whether or not the individual from whom the sample comes is deceased. Where the sample is from a deceased individual, the privacy impact of providing access is likely to be minor.
8.54 Access to the sample should be available only through a nominated medical practitioner who is in a position to arrange testing of the samples for health care purposes and to handle the sample in an appropriate way.
[32] For a more detailed examination of these gaps in privacy regulation and the possible benefits of new regulation see Australian Law Reform Commission, Working Paper: Applying Privacy Principles to Genetic Samples (2002) ALRC.
[33] Office of the Federal Privacy Commissioner, Guidelines to the National Privacy Principles (2001), OFPC, Sydney, 2.
[34] For example, by providing a general right of access for consumers to their own health records, and requiring health service providers to have available documentation that clearly sets out their policies for the management of personal information: Office of the Federal Privacy Commissioner, Guidelines on Privacy in the Private Health Sector (2001), OFPC, Sydney, Foreword.
[35] That is, health information as defined in Privacy Act 1988 (Cth) s 6(1).
[36] Ibid, NPP 1, NPP 10.
[37] The Inquiry understands that most hospital consent forms include advice that bodily samples taken during treatment are retained by the hospital and may be used in research.
[38]Human Tissue Act 1983 (NSW); Transplantation and Anatomy Act 1979 (Qld); Transplantation and Anatomy Act 1983 (SA); Human Tissue Act 1985 (Tas); Human Tissue Act 1982 (Vic); Human Tissue and Transplant Act 1982 (WA); Transplantation and Anatomy Act 1978 (ACT); Human Tissue Transplant Act 1979 (NT).
[39] That is, the obligation to obtain consent to the use of the sample for ‘medical purposes or scientific purposes’. See eg Human Tissue Act 1983 (NSW) ss 7, 34.
[40] Centre for Law and Genetics, Submission G255, 21 December 2002.
[41] That is, the obligation to obtain consent to the use of the sample for ‘medical purposes or scientific purposes’. See eg Human Tissue Act 1983 (NSW) ss 7, 34.
[42]Privacy Act 1988 (Cth) NPP 2 refers to the ‘disclosure’ of personal information. While it may be possible to interpret the passing of possession of genetic samples from one organisation to another as a ‘disclosure’, the term ‘transfer’ seems more apt.
[43] For example, for a pathology laboratory, these consequences could include liability for breach of a contractual undertaking or fiduciary duty, loss of National Association of Testing Authorities Australia accreditation and eligibility to obtain Medicare fees for medical services, penalties for sale of human tissue under the Human Tissue Acts, and disciplinary action by health registration authorities.
[44]Privacy Act 1988 (Cth) s 6(1).
[45] And subject to other relevant legislation—eg the import or export of a ‘human embryo clone’ is an offence under s 11 of the Prohibition of Human Cloning Act 2002 (Cth).
[46] National Health and Medical Research Council, National Statement on Ethical Conduct in Research Involving Humans (1999), NHMRC, Canberra [1.21].
[47] Commonwealth Department of Health and Ageing, Submission G313, 6 February 2003.
[48] Centre for Genetics Education, Submission G232, 18 December 2002; Australian Privacy Charter Council, Submission G304, 21 January 2003; Office of the Privacy Commissioner (NSW), Submission G257, 20 December 2002; Australian Biospecimen Network, Submission G238, 19 December 2002; Peter MacCallum Cancer Institute Tissue Bank, Submission G263, 20 December 2002; Department of Human Services Victoria – Metropolitan Health & Aged Care Services Division, Submission G289, 24 December 2002.
[49] Australian Privacy Charter Council, Submission G304, 21 January 2003; Office of the Privacy Commissioner (NSW), Submission G257, 20 December 2002; Department of Human Services Victoria — Metropolitan Health & Aged Care Services Division, Submission G289, 24 December 2002. Privacy NSW recommended that it should be a precautionary practice to de-identify genetic samples and genetic information intended for export for research or other purposes: Office of the Privacy Commissioner (NSW), Submission G257, 20 December 2002.
[50] See eg Office of the Federal Privacy Commissioner, Guidelines on Privacy in the Private Health Sector (2001), OFPC, Sydney, 32.
[51] Some bodily samples may be infected or be likely to decompose if improperly stored. Therefore, the right to access may need to be drafted to ensure samples must be transferred to an appropriate intermediary such as a pathology laboratory, medical practitioner or hospital, rather than to the individual who has sought access. As is the case with information under NPP 6, an access principle relating to samples should allow for release to a mutually agreed intermediary. Generally access to a sample will be sought because the individual wishes to have the sample analysed or tested. Therefore, release of the sample to an intermediary should in most circumstances meet the needs of the individual seeking access.
[52] Professor Bob Williamson has noted that ‘Only blood relatives have a direct interest. The further you go, the lower the “yield”. First degree relatives (parent, child, sib) have a 50% chance of sharing genes. As you move to grand-children, or first cousins, this goes down to 25% or less. Once you are at second cousins or more removed, the chances are really little different from those in the general population for many diseases. But of course for high penetrance dominant disorders, the key thing is that a test can often be offered to anyone on a linear path to the person affected, but it is only of value if the “intermediate” person has the mutation’: B Williamson, Correspondence, 27 September 2002.
[53] One estimate is that there would be around 100 cases each year in Victoria where access to familial samples might be clinically required: Ibid. Where a disease is caused by a known mutation such as Huntington’s disease and cystic fibrosis there is no need for access to samples from genetic relatives. The DNA of the person who is being diagnosed is sufficient.
[54] B Williamson, Correspondence, 28 February 2003.
[55] For example, where access is ‘likely to give relevant information of his or her risk of a disease, assuming that risk is raised significantly above that of the general population, or if the age of onset is earlier, or the course of the disease is more severe’: B Williamson, Correspondence, 27 September 2002.
[56] This formulation is consistent with the Inquiry’s recommendations in relation to access to genetic information by first-degree genetic relatives: See Ch 21.
[57] Although in some cases, this status may be able to inferred.