De-identification of family information on genetic registers

22.40 The NSW and ACT Hereditary Bowel Cancer Register expressed a related concern about the application of the NHMRC Guidelines for Genetic Registers.^[49] This concern relates to requirements to de-identify information where register staff have not been able to obtain consent to retain identified information provided by a registrant about a relative.

22.41 The NHMRC Guidelines for Genetic Registers provide that, where consent is not obtained, register staff should remove identifiers from the information. The information that remains in the register, usually represented by a symbol in the pedigree, will be the position of the individual in the pedigree, the individual’s gender, whether or not the individual was considered to have the genetic disorder and whether the individual is alive or dead.^[50] The Guidelines also state:

At the time of constructing the pedigree there will be relatives of the registrant in whom register staff have no professional interest other than to confirm that the diagnosis provided by the registrant is correct. If the relative is deceased or if there are circumstances in which it would be intrusive or potentially upsetting to approach a living relative for consent, confirmation of diagnosis may be obtained without consent provided that identifiers are removed once the confirmed diagnosis has been recorded in the register.^[51]

22.42 The Hereditary Bowel Cancer Register submitted that retention of identified information may be important in order to link affected families.

One of the unique functions of a central repository of genetic information is that information from families thought to be separate units may be linked so they are shown to be part of a single extended family … The aggregation of families is an important role of the Hereditary Bowel Cancer Register because it:

• assists with identifying those at risk;

• provides information about disorder severity and manifestations in that family;

• prevents unnecessary genetic testing if another family member has already been tested;

• helps validate genetic test results;

• facilitates research.^[52]

22.43 The Hereditary Bowel Cancer Register stated that, because of the large number of families on genetic registers, linking is now done initially by computer searches of names. It submitted that de-identification of information about individuals who have not consented to be on a register ‘would make it extremely difficult to link families’.^[53]

22.44 At least for the purposes of the Privacy Act, information on a genetic register may not be truly de-identified even where identifiers, such as name and date of birth have been removed. The information remains ‘personal information’^[54] because it is about an individual whose identity can reasonably be ascertained from the surrounding information—the fact that the person is, for example, the father, mother, or sibling of another individual whose full details are on the register.^[55]

22.45 In DP 66, the Inquiry asked for comments on the de-identification requirements contained in the NHMRC Guidelines for Genetic Registers and whether any modifications were necessary.^[56] In response, the Cancer Council Victoria Cancer Genetics Advisory Committee submitted that

[d]e‑identification of pedigrees (where there is no consent to registration) substantially restricts the effective functioning of registers, such as the FAP register. It is precisely these family members who potentially would benefit most from timely intervention as a result of informed counselling through and by the register. Those registered are usually already within the health care system.^[57]

22.46 The Cancer Genetics Advisory Committee proposed that a PID for genetic registers should permit the collection and retention of information about identified individuals unless consent has been denied, in which case it should be de-identified.^[58] Similarly, the Walter and Eliza Hall Institute of Medical Research observed that:

The new privacy laws can be cumbersome, as permission has to be obtained to record identifying features for every individual who is included in a pedigree. If permission is not obtained, the individual has to be deidentified. Sometimes this is absurd, as one could identify an anonymised individual on the basis of where they sit in a pedigree. The [PID] should be less prescriptive and allow for minimal identifying data to be placed on pedigrees, with the caveat that the pedigrees be only used for the purposes for which they were initially approved …^[59]

22.47 The HGSA agreed that the requirements for the de-identification of information on genetic registers contained in the NHMRC Guidelines for Genetic Registers may cause problems and submitted that:

A distinction needs to be made between the situation in which consent has been refused and the situation in which there has been no response to a request for consent. The existing NHMRC guidelines remain appropriate in the former situation.^[60]