Application of existing Australian law

12.16 Given that the conduct of non-consensual genetic testing has a clear potential to cause harm, it is necessary to ask to what extent existing Australian law offers protection from such harms.

12.17 The legal position in the United Kingdom has been considered by the Human Genetics Commission (HGC). In its May 2002 report, the HGC concluded that there are scenarios where current legal remedies may not offer sufficient protection against breach of an individual’s genetic privacy. For example:

• X takes Y’s beer glass and obtains an analysis of his DNA. He or she then sells to a newspaper the information that Y has a particular genetic condition.

• X de-encrypts anonymised genetic information about Y from a research study for some wrongful purpose.

• X obtains a sample from Child A, for whom he has no parental responsibility, in order to ascertain whether he is the father of the child.^[11]

12.18 In Australia, some legal protection against the non-consensual collection and use of bodily samples exists under current law, for example, through the common law tort of trespass to the person, the criminal law of assault, property law, and privacy legislation. However, this protection is limited.

12.19 Any touching of a person’s body without consent may constitute a trespass. In theory, the person may seek a civil remedy through the courts against the trespasser. In practice, civil remedies in tort are costly to obtain. Non-consensual touching may also constitute an assault in criminal law. However, where the assault is minor or seen as little more than a technical breach of the law, police and prosecutors may be reluctant to take action.

12.20 In any case, battery and assault are not relevant to the collection of ‘discarded’ genetic material, such as hair from combs, saliva from a glass, cheek cells from a toothbrush, or mucus from a tissue.

12.21 The taking of such genetic samples is unlikely to constitute theft. While current law recognises possessory rights and limited ownership interests in preserved samples of tissue, no proprietary rights are vested in the individual from whom samples are taken, such as might enable that individual to bring an action against others who deal with the samples.^[12]

12.22 The Privacy Act 1988 (Cth) (Privacy Act) and similar state and territory legislation provide only limited protection against the collection and testing of genetic samples without consent in the kinds of circumstances identified by the HGC. This is for several reasons. First, except in New South Wales,^[13] information and health privacy legislation does not currently apply to genetic samples, as opposed to the genetic information derived from them. The collection of a genetic sample without consent (for example, from a beer glass) does not breach the federal Privacy Act^[14]—although it might do so if the Inquiry’s recommendations in relation to extending the Privacy Act to cover genetic samples are implemented.^[15]

12.23 Second, leaving aside the distinction between a genetic sample and genetic information derived from it, the coverage of the Privacy Act is limited because acts done, or practices engaged in, by individuals are exempt if done or engaged in ‘other than in the course of a business carried on by the individual’.^[16] Further, the National Privacy Principles (NPPs) do not apply to the collection, use or disclosure of personal information by an individual ‘only for the purposes of, or in connection with, his or her personal, family or household affairs’.^[17] Arguably, many of the circumstances in which genetic testing might take place surreptitiously will have purposes that relate to an individual’s personal, family or household affairs. These might include purposes relating to family health, personal identity, or ‘peace of mind’ parentage testing.

12.24 In the circumstances identified by the HGC in the three examples above, the acts of person X generally will not be regulated by the Privacy Act, unless done in the course of a business. Even then, if X is a journalist and the collection and testing of the sample is done in the course of journalism (for example, for the purpose of a news story relating to a celebrity paternity dispute), the acts may be exempt under other provisions of the Privacy Act dealing specifically with media organisations and journalism.^[18]

12.25 In order to derive information from a genetic sample, an individual would ordinarily need to submit the genetic sample to a laboratory for testing. It is relevant, therefore, to consider the obligations of the laboratory under privacy legislation. At least in the case of a private sector organisation, the collection, use and disclosure of personal information by the laboratory will be subject to the NPPs. However, the laboratory may not know the identity of the individual from whom the sample was derived. If so, the laboratory will not be dealing with ‘personal information’ covered by the Privacy Act, even though the individual who submitted the sample for testing knows from whom it came.^[19] Even assuming the laboratory, by analysing and reporting the results of testing, is collecting and disclosing personal information in terms of the Privacy Act and the NPPs, the legal protection extended to the individual from whom the sample was derived appears limited.^[20]

12.26 The Inquiry has concluded that the current law is inadequate to meet the harms arising from non-consensual genetic testing and that a legislative response is required to address this situation.