23.07.2010
8.99 Modern data protection or information privacy legislation (of the kind enacted in Australia, New Zealand, Canada, the United Kingdom and most western European countries) was a response to concerns that arose in the 1970s about the privacy implications of computerised data processing. The 1980 OECD guidelines,[112] which formed the template for legislative privacy principles, recognised that the advent of computer technology was creating powerful new capabilities to collect and use information. In a similar way, the new capabilities of genetic technology to collect information now need to be recognised.[113]
8.100 Bodily samples constitute such an immediate source of personal information (a ‘virtual medical record’) that they demand similar comprehensive privacy protection. While a dearth of legislative precedent may suggest a need for care, the Inquiry considers that this is not in itself a reason not to proceed.
8.101 The Inquiry has concluded that legally enforceable privacy standards for the handling of genetic samples (including their collection, storage, use and transfer) are needed. The options for implementing such standards include amendments to information and health privacy legislation, amendments to the Human Tissue Acts or new stand-alone legislation. For the reasons discussed above,[114] the Inquiry has concluded that the best way to proceed is through amendment of existing information and health privacy legislation. The standards should be consistent with those that apply to the handling of genetic information derived from the analysis of genetic samples under existing information and health privacy legislation such as the Privacy Act.
Recommendation 8–1 The Commonwealth, States and Territories should enact legislation to provide legally enforceable privacy standards for handling genetic samples, including in relation to the collection, storage, use and transfer of samples. The standards should be consistent with those that apply to the handling of genetic information derived from the analysis of genetic samples under existing information and health privacy legislation such as the Privacy Act 1988 (Cth) (Privacy Act).
Recommendation 8–2 The Commonwealth should amend the Privacy Act to extend the coverage of the Information Privacy Principles and National Privacy Principles (or similar privacy principles) to identifiable genetic samples. This may be done by:
(a) defining ‘personal information’ and ‘health information’ to include bodily samples from an individual whose identity is apparent or can reasonably be ascertained from the sample; and
(b) defining a ‘record’ to include a bodily sample.
Recommendation 8–3 The Commonwealth should amend the Privacy Act to provide that an individual has a right to access his or her own bodily samples, through a nominated medical practitioner, for the purpose of medical testing, diagnosis or treatment. The right of access should be limited to a right to obtain access to part of the sample. Access may be refused where:
(a) it is not physically possible to provide part of a sample;
(b) providing part of a sample means that the remaining portion is insufficient for the purposes of the organisation retaining it; or
(c) releasing a sample to an individual raises public health concerns.
Recommendation 8–4 The Commonwealth should amend the Privacy Act to provide that an individual has a right to access bodily samples of his or her first-degree genetic relatives, through a nominated medical practitioner, where access is necessary to lessen or prevent a serious threat to his or her life, health, or safety, even where the threat is not imminent. The right of access should be limited to a right to obtain access to part of the sample. Where an organisation subject to the Privacy Act receives a request for access, the organisation should be obliged to seek consent from the genetic relative, where practicable, before determining whether to provide access. Access may be refused where:
(a) it is not physically possible to provide part of a sample;
(b) providing part of a sample means that the remaining portion is insufficient for the purposes of the organisation retaining it;
(c) releasing a sample to an individual raises public health concerns; or
(d) providing access would have an unreasonable impact upon the privacy of the individual from whom the sample comes.
[112] Organisation for Economic Co-operation and Development, Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (1980).
[113] See eg T Lemmens and L Austin, Of Volume, Depth and Speed: the Challenges of Genetic Information (2001), Report prepared for the Canadian Biotechnology Advisory Committee.
[114] See also Ch 20 in relation to reform of the Human Tissue Acts.