Regulation of human genetic research databases

18.25 The collection, storage, use and disclosure of genetic samples and information held in human genetic research databases are regulated by a mixture of legislation, guidelines and standards. These include:

• the legislative framework for the protection of information and health privacy based on the Privacy Act and similar state and territory legislation (see Chapters 7 and 8);

• state and territory Human Tissue Acts, which require consent for donation of human tissues for research;

• ethical guidelines contained in the National Statement^[22] (see Chapters 13–15); and

• the Human Genetics Society of Australasia Guidelines for Human DNA Banking (the HGSA Guidelines).^[23]

Information and health privacy legislation

18.26 Chapter 7 summarised the legislative framework for the protection of information and health privacy based on the Privacy Act and similar state and territory legislation.^[24] Chapter 8 discussed the application of this legislation to genetic samples.

18.27 The Privacy Act, and similar state and territory legislation, is intended to protect the personal information of individuals and to give them control over how that information is collected, used and disclosed. This legislation sets out safeguards that organisations must observe in collecting, storing, using and disclosing personal information. It also gives individuals rights to access and correct their personal information.

18.28 The protection provided by information and health privacy legislation extends to genetic information and is an important element in regulating the operation of human genetic research databases. An organisation covered by information or health privacy legislation must handle genetic information (including that in a human genetic research database) in accordance with legislative privacy principles. A range of issues relevant to the privacy of genetic samples and information held in human genetic research databases is discussed below.

Harmonisation of health privacy law

18.29 Chapter 7 highlighted problems that arise from the absence of a comprehensive framework for the regulation of health information across the public and private sectors, at the federal, state and territory level. There, the Inquiry recommended that the Commonwealth, States and Territories should pursue the harmonisation of information and health privacy legislation as it relates to human genetic information (Recommendation 7–1). The absence of uniform laws has particular implications for the regulation of human genetic research databases, which constitute an additional reason for Commonwealth, state and territory governments to pursue harmonisation.

18.30 The Privacy Act applies to genetic information in databases maintained by federal and Australian Capital Territory government agencies and private sector organisations,^[25] including private hospitals. In general, commercial organisations are covered by the Privacy Act unless they are established for a public purpose by state or territory law (other than as incorporated companies).^[26]

18.31 Major human genetic research databases are generally maintained by public hospitals, universities or research institutes. In most cases, as state or territory authorities,^[27] they are covered by state or territory information and health privacy legislation, where it exists.^[28]

18.32 Some human genetic research databases are not covered by any information or health privacy legislation. For example, the database held by the Menzies Centre for Population Research, as an organisation within the University of Tasmania, is not subject to privacy legislation, because Tasmania has not enacted such legislation.

18.33 It may not be clear which privacy legislation, if any, will apply where researchers affiliated with hospitals or universities are funded by an external source or work in collaboration with private sector organisations. In such instances, the application of legislation may need to be considered on a case-by-case basis taking into account factors like the nature of the contract, if any, between the researcher and funding body, and the impact of the funding on the relationship between the university or hospital and the researcher.^[29]

18.34 For example, the Murdoch Children’s Research Institute carries out genetic research using samples and information obtained from the Royal Children’s Hospital and is affiliated with the University of Melbourne. Researchers are employed by the Institute, which is an incorporated body covered by the Privacy Act. However, the hospital and university are covered by the Victorian legislation.

18.35 Concerns about the lack of uniform principles for storage, use and disclosure of genetic information were expressed in submissions.^[30] In relation to databases, the Centre for Law and Genetics commented that:

The lack of uniform privacy legislation throughout the country remains a major issue in this area. Were the states and territories to introduce complimentary privacy legislation to the Commonwealth legislation there would be an improved framework for the protection of human genetic databases.^[31]

Coverage of genetic samples

18.36 In Chapter 8, the Inquiry recommended that the Privacy Act be amended to cover genetic samples, as well as the genetic information derived from them (Recommendation 8–2). This recommendation addresses the gap in the existing framework for protecting the privacy of genetic samples. Genetic samples are closely analogous to genetic information and the Privacy Act appears capable of extending appropriate privacy protection to them.

18.37 Human genetic research databases often include genetic samples, information derived from the analysis of the samples, as well as other health information. The samples and information are used in close association to facilitate research. Similar privacy principles should be applied to the handling of genetic samples and the information derived from them. The exclusion of samples from the coverage of privacy legislation poses a problem because, as discussed in Chapter 8, individual privacy rights in respect of samples may not be asserted by the individuals from whom the samples were taken.

Prospective application

18.38 The National Privacy Principles concerning the collection, use and disclosure of information apply only to information collected after 21 December 2001.^[32] The Privacy Act does not constrain the use or disclosure of existing information stored in human genetic research databases by private sector organisations, even where fully informed consent has not been obtained. Privacy NSW stated:

This is a very serious concern with respect to information contained in human genetic databases, including human tissue samples, collected before the commencement of the Privacy Act’s private sector amendments. The use of such information for purposes other than which it was collected should be strictly regulated and consent should generally be required for such use.^[33]

18.39 Research organisations have emphasised the problems involved in complying with new regulation in relation to the samples collected in the past.^[34] For example, the Queensland Institute of Medical Research (QIMR) stated:

we feel we can comply with pretty well any new regulations as they are introduced, and these have grown more demanding over the last 15 years. What we are quite unable to cope with is the idea that use of samples or data collected in the past should have to comply with new regulations.^[35]

18.40 The cost, time and ethical tensions involved with obtaining subsequent consent from donors to unspecified future research was discussed in Chapter 15. There is clearly a tension between the interest of the research participant in privacy and the interest of researchers in gaining access to samples and information. In the long term, the problem is best addressed by allowing human genetic research databases to obtain broad consent to the use of the samples in future research.^[36] The use of mechanisms such a gene trustee can reduce significantly the tension between interests in privacy and research.

Human Tissue Acts

18.41 The Human Tissue Acts^[37] lay down consent provisions for the donation of three classes of tissue—blood, regenerative tissue and non-regenerative tissue.^[38] Regenerative tissue is any tissue that can be replaced by the body after removal, while non-regenerative tissue is any tissue other than regenerative tissue.^[39] Distinctions are also made between donations from living and deceased persons.

18.42 Living persons may donate blood for transfusion and use for therapeutic, medical or scientific purposes with verbal consent.^[40] It is not clear whether consent to one use constitutes consent to the other uses, but the Acts appear to require specific consent to each use. For example, consent to transfusion would not necessarily entail consent to use for research purposes (which the Acts call ‘scientific’ purposes). Similar provisions apply to living donations of regenerative tissue; however, consent must be in writing and may require either certification from a doctor or witnessing by a family member.^[41]

18.43 Any tissue from a deceased person may be donated for transplantation or therapeutic uses, or for other medical or scientific purposes where consent to do so was expressed during life. Tissue also may be donated if the donor expressed no objections during life and the senior available next of kin gives consent. Only the Western Australian Act explicitly requires that tissues be used only for the purpose for which they were removed,^[42] but this appears to be the meaning of the provisions in the remaining Acts.

18.44 The Human Tissue Acts do not comprehensively regulate the collection, storage and use of tissue samples as part of human genetic research databases. For example, they contain no provisions regulating the storage, use or transfer of samples. In relation to consent, the Acts require only that donors be informed of the nature and effect of the removal of tissue. They do not require donors to be informed that their tissue may be stored, disclosed to other researchers or linked with health information.

18.45 The Human Tissue Acts could be amended to include new provisions to cover collection, storage, use or transfer of samples (including those held in human genetic research databases). This option is discussed in Chapter 20 but is not supported by the Inquiry. The Inquiry has concluded that comprehensive reform of the law relating to the handling of genetic samples should build on existing information and health privacy legislation rather than the Human Tissue Acts (see Chapter 8).

National Statement

18.46 The National Statement^[43] contains no provisions dealing specifically with human genetic research databases.^[44] However, many of its general provisions are relevant to the operation of databases.

18.47 The National Statement requires researchers to ensure the confidentiality and privacy of stored genetic information, where identified or potentially identifiable.^[45] Research protocols must make clear whether information is to be stored and in what form—identified, potentially identifiable (coded), or de-identified (not identifiable, anonymous).^[46] Individuals should be informed of any intention to store genetic samples or information.^[47]

18.48 Where research involves linkage of data sets (as is common with research involving databases), the National Statement provides that an HREC may approve the use of identifiers to ensure that the linkage is accurate, but once the linkage has been completed the HREC should require that the resulting data be coded or de-identified.^[48]

18.49 In addition, the National Statement generally requires consent to the use of human tissue samples, genetic material and genetic information in medical research. As discussed in Chapter 15, these consent requirements can be waived by an HREC.

Guidelines for Human DNA Banking

18.50 The HGSA Guidelines use the term ‘DNA bank’ to refer to collections of genetic material maintained by both clinical service groups and researchers.^[49] The HGSA Guidelines set standards for banking of DNA and are directed, in part, at ensuring that possible future health service needs of families will be met where DNA is stored.

18.51 While the HGSA Guidelines mainly address storage of DNA in the context of clinical health services, they also consider situations where research into genetic disorders may later have implications for health service delivery. The HGSA Guidelines state that researchers have obligations to the families they are studying. Databases should be properly documented, and the records made available to whoever will be providing for the health service needs of the families. There should be clear policy about the use of DNA samples from an elderly subject with a reduced life expectancy, to allow some to be set aside for future needs. Proper consideration should be given to the later health service needs of families once research has been completed.^[50]

18.52 The HGSA Guidelines recommend the establishment of a central directory of DNA banks storing material for both clinical and research purposes, with the register to be maintained by one centre in each region. Any persons storing DNA would be under an obligation to notify the appropriate centre in their region, and any extraction and storage of DNA should be reported to the centre. It is recommended that the centre be a regional clinical genetics service.^[51] The Guidelines offer no recommendations specifically directed to the conduct of research, but state that research using DNA samples should be regulated by the NHMRC.^[52]