Collection of information on genetic registers

22.25 Issues concerning the collection of information for inclusion on genetic registers were raised in several submissions.^[31] For example, the HGSA referred to the collection of information needed to construct pedigrees and stated that

it is essential there be clarification on the use of family data by medical practitioners and other involved health professionals. The gathering of family information to construct a family tree, without the consent of the other family members, is essential to the diagnosis and risk assessment in families. The use of these data by registers is of great value in the management of other family members. The HGSA believes it should be made clear that obtaining family information in this context is considered an exception to the Privacy Act.^[32]

22.26 The Peter MacCallum Cancer Institute (PMCI) also expressed concerns that the Privacy Act could make the collection of pedigree information difficult.

It seems that a pedigree constructed from information provided by an individual will become part of his/her medical records, but cannot be verified or used during consultation with another family member. Does this mean a fresh pedigree must be drawn for every family member who attends a genetic clinic? Will the genetic risk of an individual be assessed only on the basis of the information provided by that individual rather than, as now, on a fully verified family history drawn from many sources? How are fully verified pedigrees to be obtained under the Act? Will there be a need to tag the sources of the information used to construct the pedigree so as to minimise the chances that information volunteered by one family member would be transmitted to another? This seems unworkable. At the very least there is a need for a clearer definition in the Paper of the genetic information that blood relatives and other family members should be able to supply and the character of the access to that information by clinicians and genetic clinics that is appropriate.^[33]

Collection of information and the NHMRC Guidelines

22.27 The NHMRC Guidelines for Genetic Registers note that potential registrants may be identified in different ways. They may contact the register themselves on the advice of health professionals or community based support groups. However, they may also be identified by register staff from the information provided by another registrant who identifies other family members.^[34]

22.28 The NHMRC Guidelines for Genetic Registers recognise that the collection and recording of family genetic information in a genetic register may involve a breach of the privacy of those family members who have not consented to be registrants. They state that registers should distinguish information that identifies people who are not registrants and not disclose it in identifiable form without the consent of the identified person. In general, the persons identified should be approached, in due course, so that their consent can be sought for inclusion of their information in the register.^[35]

22.29 However, in some circumstances it appears that collection of information for genetic registers, in ways that would comply with the NHMRC Guidelines for Genetic Registers, may nevertheless breach the Privacy Act or similar state and territory privacy legislation, as discussed below.^[36]

Application of privacy legislation to collection

22.30 National Privacy Principle (NPP) 1 of the Privacy Act provides that, in general, an organisation must collect personal information about an individual only from that individual, rather than from any third party, unless it is not ‘reasonable and practicable’ to do so.^[37] Further, under NPP 10, an organisation generally must not collect sensitive information (including genetic and other health information) unless the individual has consented.

22.31 The federal Privacy Commissioner’s Guidelines on Privacy in the Private Health Sector imply that in some circumstances consent may be obtained on an ‘opt out’ basis:

Where consent is required from individuals for the collection and use of data in relation to the establishment and maintenance of a disease register, it may sometimes be appropriate to give individuals the opportunity to opt out of being included on the register. The use of this approach by a health service provider would only be appropriate where individuals are clearly informed about the option to opt out and this is prominently presented and easy to adopt.^[38]

Collection from registrants

22.32 In some circumstances it may not be ‘reasonable and practicable’ to collect family medical history information directly from the genetic relatives, for example, because they are not contactable or are dead. However, in other circumstances the collection of family medical history information without the consent of those family members, for the purposes of a genetic register, might breach the Privacy Act because it is reasonable and practicable to obtain consent. The fact that consent may later be sought from these family members, whether by the registrant or staff of the genetic register, does not appear to alter this position.

22.33 As discussed in Chapter 21, Public Interest Determinations (PIDs) have been issued by the federal Privacy Commissioner to ensure that organisations can continue to collect family medical history information without breaching NPP 10.1 where the collection is

• necessary for the organisation to provide a health service directly to the consumer; and

• the third party is a member of the consumer’s family or household, or the third party’s information is otherwise relevant to the consumer’s family, medical or social history.^[39]

22.34 The PIDs apply only to situations where a health service is being provided directly to the individual (the patient) from whom family history information is sought.^[40] This criterion is likely to be satisfied where the information is being collected, for example, by the patient’s treating doctor for the patient’s own medical records.

22.35 However, where information is collected in order to facilitate the diagnosis or treatment of other, sometimes unknown, people and to ensure that genetic relatives have the opportunity to become aware of their genetic risk, or to access genetic counselling and medical advice, the PIDs may not apply. This has important implications for the collection of third party information for inclusion on genetic registers.

Collection from other health professionals

22.36 Another issue concerning the collection of information for genetic registers relates to the verification of information provided by registrants. The NHMRC Guidelines for Genetic Registers state that confirmation of diagnosis may sometimes be obtained without consent where the relative is deceased or if there are circumstances in which it would be intrusive or potentially upsetting to seek consent.^[41]

22.37 The Cancer Council Victoria Cancer Genetics Advisory Committee stated that where it is necessary to verify diagnoses to provide adequate risk assessment and screening recommendations, there needs to be a mechanism ‘where public health genetic registers can undertake this verification process without fear of litigation’.^[42] However, privacy law may create problems for genetic registries where there is a need to verify diagnoses without consent.^[43] The collection of information in this way may breach the Privacy Act and may not be authorised by existing PIDs.^[44]

22.38 Verification of diagnosis is vital to the operation of a genetic register.^[45] However, some submissions had reservations about whether any genetic register should be permitted to verify health information with other health professionals without the consent of the individual involved.^[46]

22.39 The Cancer Genetics Advisory Committee noted that the legal position with regard to the disclosure of verifying information by statutory cancer registers, such as the Victorian Cancer Registry, may also need to be considered.^[47] Such registers are not necessarily authorised to disclose verifying information to genetic registers.^[48]