Options for reform

18.71 The Inquiry has considered a number of options for regulating human genetic research databases, including:

• the inclusion of new provisions in the National Statement;
• a licensing or registration scheme; and
• the use of a gene trustee system to protect the privacy of samples and information stored in databases.^[74]

18.72 These options are not mutually exclusive, and could be adopted as a regulatory ‘package’ if this would most effectively address the privacy and ethical concerns about the operation of human genetic research databases.

New provisions in the National Statement

18.73 The National Statement lays down ethical guidelines that help to regulate the operation of human genetic research databases. However, some specific issues that arise from the establishment and operation of large-scale research databases should be addressed by new provisions in the National Statement.

18.74 In DP 66 the Inquiry proposed the inclusion of a new chapter in the National Statement to provide further ethical guidance on the operation of human genetic research databases, notably in relation to consent to unspecified future research.^[75] However, there is a range of other matters relating to the operation and governance of human genetic research databases that might usefully be dealt with in the National Statement, such as ethics review where external researchers are seeking access to samples and information stored on the database; guidance on the use of independent intermediaries to hold codes linking genetic samples or information with identifiers; and governance structures.

18.75 Submissions expressed support for the proposed expansion of the National Statement to include a new chapter covering human genetic research databases.^[76] The Androgen Insensitivity Syndrome Support Group Australia stated that:

Amending the NHMRC national statement to provide ethical standards for the operation of human genetic research databases would provide a valuable ethical base-line against which the operation of human research genetic databases could be measured. Already used by HRECs in such a way, the national statement would then encompass all steps of the research process.^[77]

18.76 The Department of Human Services South Australia noted that because of the sensitivity of samples and information held in research databases, ‘it is important that ethical guidance on their operation is formalised’. The Department suggested that ‘[t]his will ensure that each database follows protocol and abides by the guidelines set down by the National Statement with regard to privacy and data access’.^[78]

18.77 The Centre for Law and Genetics emphasised that a new chapter of the National Statement was ‘particularly desirable to provide guidance on the issue of consent to future research using samples and information stored in human genetic research databases’.^[79]

18.78 Another submission made the point that new provisions in the National Statement would avoid the need to develop legislative measures to regulate human genetic research databases.^[80] Others explicitly rejected the imposition of legislative controls on the operation of databases.^[81]Genetic Health Services Victoria cautioned that ‘the potential benefit to the community from such research must be encouraged and not hampered by unrealistic and even unethical requirements for consent’.^[82]

Licensing or registration of research databases

18.79 In DP 66, the Inquiry asked whether human genetic research databases should be subject to a licensing or registration scheme.^[83] A licensing scheme would require all human genetic research databases maintained in Australia to obtain a licence to operate. Organisations maintaining databases would be subject both to the general rules applying to licence-holders, as well as any specific conditions of the licence itself. Licence conditions could be used to impose specific limitations on how databases are maintained, and could be adapted for different types of databases.

18.80 An alternative, ‘light touch’ approach would be to implement a system of registration. A registration scheme could be modelled on the existing processes for the registration of HRECs with the Australian Health Ethics Committee (AHEC). Operators of human genetic research databases (or their HREC) could be required to report to AHEC on their activities, including on their consent procedures and on the nature of research undertaken using the database during the reporting period. AHEC could have authority to audit the activities of research databases to ensure compliance with the National Statement. In addition, the National Statement might be amended to state that an HREC should not approve research using unregistered genetic databases.

18.81 Most submissions agreed upon the need for more scrutiny and oversight of the operation and use of human genetic research databases. Some were satisfied with either scheme—licensing or registration—whichever would most effectively promote the protection of privacy.^[84] Of the remaining submissions in favour of an oversight scheme, registration was preferred to licensing^[85] because it was seen as a less onerous and costly method of regulation.^[86]

18.82 Some submissions did not support either licensing or registration and expressed concern about the practical implications of such a reform for medical research. The Children’s Cancer Institute Australia asserted that

the requirement to register any database which contains “gene information” would be costly and in-effective. Moreover, such a regulatory system would be unworkable in the research setting.^[87]

18.83 QIMR strongly opposed any idea that research databases should be subject to a licensing or registration scheme.^[88] In relation to its own database, QIMR stated that:

The nature of research is … a fluid and rapidly permuting process. To require documentation of the [database] resource, and the activities using it would require almost as many staff again and would impose an unsupportable burden on our research. The academics would simply move to theoretical work and simulation studies, away from real diseases, and staff supporting the databases would lose their jobs.

Our belief is that the use of genetic databases in a research setting is perfectly well regulated by the existing HRECs, to which we have to submit requests for any new use, or variation in existing use. Approval from our HREC, at least, is far from a pushover, since we frequently have to submit amendments in response to critiques from them. While we strongly believe that HRECs should have national accreditation, we also believe that monitoring use of genetic databases should remain the responsibility of local HRECs who are familiar with the context of research, and not be devolved to a remote regulator.^[89]

18.84 The Inquiry asked what conditions should attach to licensing or registration of human genetic research databases if such a system were introduced.^[90] Annual reporting of database activities and regular audits were suggested in some submissions.^[91] Transparency and accountability were regarded as necessary to promote best practice.^[92] Jennifer Fleming made the point that regulatory controls should also respect the confidentiality of researchers and their intellectual property.^[93] The Centre for Law and Genetics recommended that minimum registration requirements be imposed. These could include

undertakings to be bound by the NPPs or IPPs and to restrict access to the database to projects approved by properly constituted HRECs in compliance with the National Statement.^[94]

18.85 The use of sanctions and the revocation of licences or registration were regarded by a number of submissions as an appropriate means of ensuring compliance with prescribed operational requirements.^[95]

18.86 A particular issue noted in submissions was the need to define clearly what constitutes a ‘human genetic research database’ for the purposes of a registration or licensing scheme.^[96] For example, the Centre for Genetics Education noted that it is sometimes unclear when a clinical genetic database that is used for research becomes a research database.^[97]

Oversight of human genetic research database regulation

18.87 A licensing or registration scheme would require administration and oversight by an appropriate body. Oversight functions could be undertaken by the NHMRC, through AHEC, or be left entirely to HRECs.

18.88 Submissions expressed differing views on the appropriate body to oversee a licensing or registration scheme. Some submissions saw AHEC as the appropriate body to which database operators should report, or proposed that AHEC should have a role in auditing the operation of databases.^[98] Other submissions suggested that the primary responsibility for monitoring the operation of research databases should rest with HRECs.^[99] The NHMRC Research Committee reasoned that

it is likely that the most effective regulatory bodies will be those established in close proximity to databases, with the capacity to interact regularly with the database coordinators on matters of importance.^[100]

18.89 The NHMRC Research Committee expressed the view that

supervision of ethics practised through reporting mechanisms that allow scrutiny, would be more likely to achieve the outcome desired than those involving onerous barriers to achieving registration, or barriers that interfered with sample data collection.^[101]

18.90 Some submissions considered that it would be appropriate for the Human Genetics Commission of Australia (HGCA) to have some regulatory role with regard to databases.^[102] For example, the Cancer Council of Victoria stated that:

All research collections of human DNA samples should be registered with a national authority with oversight by the proposed HGCA. National regulation is preferable to a State based approach because of issues relating to privacy legislation variations in some States. Also genetic research databases have the potential to be forced to deal with new technology leading to issues not considered at the establishment of these databases. Further, a national approach is preferable because families often extend across multiple states and consistency is essential for proper handling of all databases, and for making it easier for families to understand conditions under which data is held. In theory, one national body should handle such issues more efficiently.^[103]

18.91 Others made the point that the HGCA, as described in Chapter 5, is intended to be an advisory body, not a regulator. Consequently, a number of submissions doubted that it would be appropriate for the HGCA to have a role in directly regulating databases,^[104] while accepting that the HGCA might, for example, ‘be responsible for monitoring issues common to all databases and to report accordingly’.^[105]

Inquiry’s views

18.92 In the Inquiry’s view, further regulation is required to protect the privacy of genetic samples and information held in human genetic research databases. The Inquiry has concluded that reform in keeping with the present framework for the ethical conduct of research, centred on the National Statement and on review of research proposals by HRECs, is preferable to the introduction of new legislative constraints on the operation of research databases.

18.93 However, as noted above, the ethical principles and existing guidance set out in the National Statement do not adequately deal with some of the distinct privacy and ethical issues raised by human genetic research databases. The inclusion of new provisions in the National Statement to deal specifically with the operation of human genetic research databases could address these issues. The National Statement already includes specific chapters on the use of human tissue samples and human genetic research.^[106] A new chapter, or new provisions in existing chapters, could also be developed to deal with human genetic research databases.

18.94 While it will be for the NHMRC to develop new provisions in the National Statement, the Inquiry recommends that these provisions include specific guidance on obtaining consent to unspecified future research. In drafting such provisions, the NHMRC should balance the needs of researchers with the need to protect the privacy of individuals’ genetic information and promote public trust in research.^[107] The forms and processes for seeking consent to unspecified future research used by the PMCI Tissue Bank, the Western Australia Research Tissue Network and the Children’s Hospital at Westmead Tumour Bank, discussed above, may provide useful models.

18.95 Under the new provisions of the National Statement recommended by the Inquiry, the NHMRC would have oversight of the ethical operation of human genetic research databases and would take advantage of existing regulatory structures and reporting mechanisms.

18.96 However, it is also the case that regulation of human genetic research databases under the National Statement would be subject to the existing limitations in relation to enforcing compliance. Given the existing and likely future extent of private sector research using human genetic research databases, new mechanisms may be required to achieve compliance with the National Statement. These issues are addressed in Chapter 14.

18.97 The Inquiry has concluded that a system for the registration of human genetic research databases is capable of providing greater transparency and accountability in the operation and use of such databases, without subjecting institutions to onerous compliance costs. Registration will oblige institutions to identify and regularise the research collections that they currently maintain and to ensure that the operation of these collections is subject to appropriate governance structures and proper institutional and HREC scrutiny.

18.98 Registration would mean that, for the first time, there will be comprehensive information available to AHEC, and possibly to the public, about the number and type of research databases, and the kinds of research being conducted using the samples and information they contain.^[108] Such transparency may become increasingly important in allaying public concerns about the privacy, ethical and other implications of the continuing development of research databases. Registration will also provide AHEC with information necessary to enable it to properly advise the NHMRC, and provide guidance to HRECs, on ethical issues relating to the operation of research databases.

18.99 For these reasons, the Inquiry recommends that the new provisions of the National Statement should incorporate a requirement for institutions to register their human genetic research databases with the NHMRC. In addition to the general registration requirement, the Inquiry considers that there should be requirements in relation to:

• the nomination of a database keeper/custodian^[109] who will have clear responsibility for the day-to-day operation of the database;
• compliance with standards for the collection, use, storage, disclosure and transfer of genetic samples and genetic information held by the database;
• annual reporting to the institutional HREC and AHEC on database operations; and
• provision for audit of the database and its operations, on request by the institutional HREC and/or AHEC.

18.100 In addition, guidance could be provided on a range of other matters relating to the operation of human genetic research databases including:

• governance structures, including guidance on the appropriate relationships between the institution, database custodian and the institutional HREC;
• ethical approval processes where external researchers seek access to samples and information stored on the database; and
• guidance on the appropriate use of independent intermediaries to hold codes linking genetic samples or information with identifiers (see also below).

18.101 The constraints of the Terms of Reference mean that the recommendations made in this Report are generally directed to the protection of human genetic information, rather than to other forms of personal information. However, the Inquiry recognises that there may be good reason to consider extending the reforms recommended below to all research databases that contain identifiable bodily samples or personal information.