Inquiry’s views

22.59 The collection of family medical history information from registrants is essential to the operation of genetic registers. The Inquiry has concluded that privacy legislation may inappropriately constrain established practices for the collection of family medical history from registrants and that this should be remedied.^[76]

22.60 A more difficult question is whether verification of such information should occur only with the consent of the genetic relative or next of kin (where the genetic relative is deceased). For example, as noted above, the NHMRC Guidelines for Genetic Registers state that confirmation of diagnosis may be obtained without consent where approaching the individual would be ‘intrusive or potentially upsetting’. This guidance is not consistent with the requirements of the Privacy Act.^[77]

22.61 The most obvious reform option at federal level would be the making of a new PID by the federal Privacy Commissioner to permit the operators of genetic registers to collect certain family medical information in ways that might otherwise breach the NPPs of the Privacy Act. A PID dealing with the operation of genetic registers may need to deal not only with the collection of genetic information, but also aspects of its use, disclosure or de-identification.

22.62 There was support in submissions for the development of a PID relating to the operation of genetic registers, at least to the extent that the Privacy Act applies to existing genetic registers.^[78] However, submissions also expressed concern that the scope and content of such a PID be appropriately circumscribed.^[79] The Cancer Council Victoria Cancer Genetics Advisory Committee stated:

[W]e would advocate that organisations applying for such a PID should first establish their credentials with the proposed [Human Genetics Commission of Australia]. The proposed HGCA would take into account the reasons why the organisation wishes to verify diagnoses (eg gene specific disease registers), the penetrance and seriousness (morbidity and/or mortality of the disease) and its treatability. … the proposed HGCA would weigh the importance of such access to the organisation, alongside the potential benefit to the family and perhaps the community, on a disease by disease basis.^[80]

22.63 The Commonwealth Department of Health and Ageing suggested that

the privacy implications of extending a public interest determination to cover information on a genetic register (and prevent any breaching of the Privacy Act) should be further considered, provided it does not compromise the right not to know.^[81]

22.64 The Androgen Insensitivity Syndrome Support Group Australia submitted that genetic registers

should be exempt from privacy principles only where they relate to medical conditions that pose a serious risk to the health or life of genetic relative … or only where specific permission has been given for the information to be obtained or disclosed.^[82]

22.65 The Inquiry recommends that organisations operating genetic registers should seek a PID under the Privacy Act. The primary intention of this recommendation is to ensure that, in appropriate circumstances, organisations can continue to collect and retain family medical history information from the registrants on genetic registers without the consent of the genetic relatives.

22.66 On the basis of the submissions received, the Inquiry has not been able to form a view on whether the PID should also permit genetic registers to collect health information from health professionals without the consent of their patients, for the purpose of verifying information provided by registrants. However, this issue should be examined as part of the PID process.

22.67 There may also be aspects of the use or disclosure of this information that require review in the context of a PID process.^[83] For example, one issue that might be dealt with is disclosure of pedigrees by medical practitioners to genetic registers, in order to assist in identifying individuals at risk. Another is that disclosing information about genetic relatives on a genetic register, even in ‘de-identified’ form, could breach NPP 2 of the Privacy Act. As noted above, information on a genetic register may not be truly de-identified, even where identifiers, such as name and date of birth, have been removed.

22.68 In practice, the Privacy Act has limited coverage of genetic registers in Australia. The Inquiry understands that, with few exceptions, genetic registers are generally public hospital based. These registers will be governed by state or territory privacy legislation, where it exists. As noted above, and in accordance with Recommendations 7–1 and 7–2, state and territory legislatures and privacy regulators should consider amending their privacy regulation in accordance with Recommendation 22–1. The form and mechanism of such amendment will differ depending on the jurisdiction.^[84]