Human Research Ethics Committees

Role of HRECs

65.99 Institutions that undertake research ‘with or about people, their data or tissue’^[108] are responsible for ensuring that research they conduct, or for which they are responsible, is ethically reviewed in accordance with the National Statement.^[109] Institutions may establish their own processes for ethical review or use those of another institution.^[110]

65.100 The National Statement provides that ethical review can be undertaken at various levels depending on the degree of risk involved in the research. Research involving ‘negligible risk’ and the use of existing collections of data or records that contain only non-identifiable information may be exempt from review.^[111] Research involving ‘no more than a low level of risk’ may be reviewed by a non-HREC ethical review body,^[112] such as a departmental committee, or a subcommittee of an HREC.^[113] Research involving more than a low level of risk must be reviewed by an HREC. The National Statement expressly provides that research proposing to use personal information in medical research without consent and research using health information without consent must be reviewed by an HREC.^[114] These provisions reflect the existing exceptions for research under the IPPs and NPPs.

65.101 HRECs must be composed and function in accordance with the National Statement.^[115] The minimum membership of an HREC is eight: a chairperson; at least two lay people (one man and one woman) who have no affiliation with the institution; at least one person with knowledge of, and experience, in the professional care, counselling or treatment of people; at least one person who performs a pastoral care role in the community; at least one lawyer; and at least two people with current research experience.^[116] The primary responsibility of HREC members is to decide whether a proposal meets the requirements of the National Statement and is ethically acceptable.^[117]

65.102 Both the Section 95 and 95A Guidelines provide a detailed framework within which HRECs must consider the privacy implications of research proposals involving the use of individuals’ personal or health information. In particular, HRECs must consider, and may approve, research proposals seeking to use personal or health information without consent, on the basis that the public interest in the research substantially outweighs the public interest in maintaining the level of privacy protection provided by the IPPs and the NPPs.

65.103 The Guidelines require that, before making a decision, an HREC must assess whether it has sufficient information, expertise and understanding of privacy issues, either among the members of the HREC or otherwise available to it, to make a decision that takes proper account of privacy.^[118] The Section 95A Guidelines note that it may be necessary to appoint additional members with specific expertise in some circumstances. It is important to note that, although an HREC may give approval for a research proposal to proceed, the final decision to release personal information to researchers is not made by an HREC, but by the relevant data custodian.

Discussion Paper proposals

65.104 In IP 31, the ALRC asked whether HRECs are the most appropriate bodies to make decisions about the collection, use and disclosure of personal information without consent in the context of health and medical research.^[119] In DP 72, the ALRC reported that there was widespread support for the role of HRECs in this area and expressed the view that HRECs remain the most appropriate bodies to make decisions about the collection, use and disclosure of personal information without consent in the research context. The ALRC proposed that, as review and approval by HRECs was an important safeguard around the use of personal information in research, the role of HRECs should be set out expressly in the research exceptions to the UPPs.^[120] In addition, the ALRC proposed that the National Statement should be amended to require that, where a research proposal seeks to rely on the research exceptions in the Privacy Act, it must be reviewed and approved by an HREC.^[121]

Submissions and consultations

65.105 In its submission to IP 31, the NHMRC originally urged

the ALRC to reconsider the role of HRECs in decisions about the privacy implications of the collection, use or disclosure of health information in research. The NHMRC is of the view that these considerations could be managed without intervention by an HREC although we have not identified a replacement mechanism at this stage.^[122]

65.106 Having asked the ALRC to reconsider the issue, however, the NHMRC also submitted that HRECs are, in general, appropriately constituted to enable them to perform the role assigned to them under the Privacy Act and Section 95 and 95A Guidelines. In its submission to DP 72, the NHMRC supported the ALRC’s proposals in this area, stating that:

We support the proposed continuing role of Human Research Ethics Committees (HRECs) in reviewing and approving research proposals that seek to rely on the research exceptions in the Privacy Act, but note that resource and capacity implications for HRECs will need to be evaluated.^[123]

65.107 On the other hand, Professor Thomson was strongly of the view that the function of HRECs is to assess whether research projects are ethically acceptable, not whether research projects conform with legal requirements:

The proposal to maintain reliance on HRECs as agents in the application of part of the statutory privacy regime will continue a role and responsibility that has proved foreign and burdensome.^[124]

65.108 He noted, for example, that the Section 95A Guidelines impose responsibility on HRECs to decide whether a particular research proposal is consistent with the NPPs, including whether it is ‘impracticable to seek consent’. He noted that often it is organisations that hold personal information—rather than individual researchers—that are responsible for seeking consent and that, as HRECs do not have a direct relationship with such organisations, they are not in a strong position to evaluate whether it is impracticable for the organisation to do so.^[125]

65.109 A number of others raised concerns about the role of HRECs under the Privacy Act. The University of Newcastle stated that data custodians and the Privacy Commissioner should take more responsibility for determining when it is appropriate to collect, use and disclose personal information without consent for research. The University also noted that the National Statement provides that ‘compliance with legal obligations (statutory or otherwise) … is not within the scope of the National Statement’. The University commented that, if HRECs are to have a continuing role under the Privacy Act, the National Statement will need to address those legal requirements.^[126]

65.110 There was strong support, however, from other stakeholders for the role of HRECs in reviewing research proposals under the Privacy Act.^[127] The Centre for Law and Genetics stated that:

We are strongly of the view that Human Research Ethics Committees are the most appropriate bodies to make decisions about the collection, use and disclosure, without consent, of health information in the context of health and medical research. This model of ethical review, based on the collective wisdom of an interdisciplinary group, has proved in general to be very effective in practice.^[128]

65.111 The Centre for Law and Genetics also expressed support for the recommendations relating to HRECs in ALRC 96.^[129] The Caroline Chisholm Centre for Health Ethics noted the need for adequate funding, training and education of HRECs and their members.^[130]

65.112 The OPC submitted that HRECs are the most appropriate bodies to make decisions about the collection, use and disclosure of health information without consent in the health and medical research context.^[131] The OPC agreed that the National Statement should be amended to specify that, where a research proposal seeks to rely on the research exceptions in the Act, it must be reviewed and approved by an HREC.^[132] A number of other major stakeholders expressed similar views.^[133]

ALRC’s view

65.113 The ALRC has considered the role of HRECs in the privacy regime and notes that, while some concerns have been expressed, there was significant support for the role HRECs currently play under the Privacy Act. HREC review provides a valuable safeguard by considering on a case-by-case basis research proposing to collect, use or disclose identified or reasonably identifiable personal information without consent. Research involving the use of personal information without consent raises ethical as well as privacy issues, and the vast majority of stakeholders commenting on this issue in this Inquiry considered that HRECs are well placed to consider these issues.

65.114 The role and responsibilities of HRECs and other parties involved in human research under the Privacy Act and the Section 95 and 95A Guidelines, however, have become somewhat confused. The research exceptions to the model UPPs, recommended below, will go some way to clarifying the role of HRECs in this process. HRECs should not be responsible for ensuring that research proposals meet all the legal requirements in the Privacy Act. Organisations and agencies that collect, use or disclose personal information without consent for the purposes of research are responsible for ensuring that those activities are conducted in a way that complies with the Act and with any rules issued by the Privacy Commissioner under the research exceptions.

65.115 The research exceptions set out below require HRECs to review such activities and decide whether the public interest in the proposed activity outweighs the public interest in maintaining the level of privacy protection provided by the Privacy Act. In considering this balance, the ALRC anticipates that HRECs will focus on factors such as the value and public importance of the research; the risk of harm to individuals; the standards of conduct that are to be observed in the research; and the extent of any possible breach of privacy.

65.116 Although other elements of the research exceptions—for example, that it must be unreasonable or impracticable to seek consent—are distinct from HREC review of the public interest, it may be necessary for HRECs to consider how these elements impact on the public interest balance. For example, an HREC may need to consider the extent to which seeking consent would impact on the scientific value and integrity of the research. If there is unlikely to be a significant impact on the value and integrity of the research then the public interest may well dictate that the agency or organisation be required to seek consent for the collection, use or disclosure of the information. It is not the responsibility of HRECs, however, to certify that it is unreasonable or impracticable to seek consent in any particular case.

65.117 HRECs may also have to consider the extent to which the proposed collection, use or disclosure complies with the Research Rules to be issued by the Privacy Commissioner, in order to decide where the public interest balance lies. But the Research Rules should target agencies and organisations that collect, use or disclose personal information in the course of research, rather than HRECs. It is these agencies and organisations that have responsibility to ensure that their conduct complies with the Privacy Act.

65.118 The National Statement and its oversight mechanisms, including review by HRECs, is not limited to health and medical research, but is intended to cover all research involving humans. The ALRC recommends, above, extending the existing arrangements relating to the collection, use and disclosure of personal information in health and medical research to include the collection, use or disclosure of personal information in research involving humans more generally. HRECs should be required to review and approve all such activities.

65.119 The National Statement currently provides that only an HREC may approve research that proposes to use personal information without consent in medical research, or personal health information without consent.^[134] In addition, the National Statement provides that only an HREC may approve research that involves more than a low level of risk.^[135] In the context of extending the arrangements for research under the Privacy Act,the National Statement may also require amendment. Any research that requires:

• the collection of identified or reasonably identifiable sensitive information without consent;

• the use or disclosure of such information without consent for a purpose that is not directly related to the purpose of collection and within the reasonable expectations of the individual; or

• the use or disclosure of identified or reasonably identifiable non-sensitive information without consent for a purpose that is not related to the purpose of collection and within the reasonable expectations of the individual,

is likely to involve more than a low level of risk for individuals and always should be reviewed by an HREC. In these circumstances, researchers and data custodians will be relying on the research exceptions in the ‘Collection’ principle and the ‘Use and Disclosure’ principle, discussed further below. The ALRC recommends, therefore, that the National Statement be amended to require that, where a research proposal seeks to rely on the research exceptions in the Privacy Act, it must be reviewed and approved by an HREC.

Accountability of HRECs

65.120 The Section 95 and 95A Guidelines also require HRECs to record their decisions, including details of the agency or organisation from which information will be sought, the information sought, the number of records involved, and the IPP or NPP likely to be infringed.^[136] The Australian Health Ethics Committee (AHEC) is, in turn, required to report annually to the NHMRC in relation to HRECs generally, and to provide a compliance report setting out decisions taken by HRECs under the Guidelines.^[137] AHEC is also required to provide the compliance report to the Privacy Commissioner^[138] and to report where there has been a breach of the Guidelines.^[139]

65.121 Submissions to the OPC Review suggested that the reporting obligations imposed on HRECs by the guidelines are unnecessarily onerous—for example, the requirement to list those IPPs and NPPs that may be breached by the research proposal.^[140] The OPC Review considered this issue and made the following recommendation:

The Office will work with the National Health and Medical Research Council to simplify the reporting process for human research ethics committees under the section 95A guidelines.^[141]

65.122 In IP 31, the ALRC asked whether the requirements imposed on HRECs by the Section 95 and 95A Guidelines were appropriate and effective.^[142] In response, the NHMRC expressed concern about the reporting requirements. The NHMRC noted that the complexity of the regulatory regime and the detailed reporting requirements have resulted in an excessive administrative burden. The NHMRC suggested a reporting framework that involved less detailed, commentary-based reporting on privacy issues that arise during a reporting period, and an exception-based reporting framework for specific privacy concerns that come to the attention of HRECs during a reporting period.^[143]

65.123 In DP 72, the ALRC agreed with the OPC Review that the Privacy Commissioner, in consultation with relevant stakeholders, should review the reporting requirements imposed on AHEC and HRECs. The ALRC proposed that any new reporting mechanism should aim to promote the objects of the Privacy Act, have clear goals and impose the minimum possible administrative burden to achieve those goals.^[144]

Submissions and consultations

Reporting

65.124 The Alfred Hospital Ethics Committee noted difficulties in meeting the current reporting requirements and strongly supported the ALRC’s proposal^[145] that there should be a review.^[146] Other stakeholders also expressed support for a review and for the ALRC’s proposed framework for any new reporting mechanism.^[147]

65.125 The OPC agreed that a review was appropriate and reiterated that it would work with the NHMRC to simplify the reporting requirements under the Section 95 and 95A Guidelines.

The Office recognises the importance of ensuring that reporting requirements are not burdensome, do not hinder the operation of HRECs or impose unreasonable compliance costs. In the Office’s view … these reporting requirements should include only as much information as is necessary to ensure that there is transparency in how the research exceptions are being used. Such transparency, in turn, will help promote community trust and confidence in non-consensual handling of personal information for research.^[148]

65.126 The OPC submitted that, in order to promote transparency and community confidence, reports on HREC consideration of research proposing to proceed under the research exceptions should be made public.^[149]

Review of decisions?

65.127 A further issue raised by stakeholders in relation to the accountability of HRECs, was whether the decisions of HRECs under the research exceptions in the Privacy Act should be subject to some form of review. National Legal Aid stated that:

If research ethics committees are to continue to serve as the primary mechanism for approving research where it is impracticable to obtain subject consent, there should be greater accountability in the way decisions are reached. This would be assisted by better thought out and more detailed reporting requirements for ethics committees. Accountability could also take the form of affected people having the ability to seek Privacy Commissioner review of ethics determinations.^[150]

65.128 The Law Society of New South Wales also suggested that decisions of HRECs on the balance of public interest should be subject to appropriate review mechanisms.^[151] The New South Wales Council for Civil Liberties expressed the view that where information was to be used without consent, this should be approved by the Privacy Commissioner and an HREC.^[152]

65.129 The OPC supported elevating the requirement for HREC review from the Section 95 and 95A Guidelines into the Privacy Act.^[153] Professor Thomson, however, was concerned that this may have undesirable consequences, such as increasing concern among HREC members about the legal consequences of their decisions, leading to more conservative decision making. He also asked whether this would result in HREC decisions becoming subject to judicial review.^[154]

ALRC’s view

Reporting

65.130 The ALRC notes that the Privacy Commissioner is committed to reviewing the reporting requirements currently imposed on HRECs and on AHEC by the Section 95 and 95A Guidelines. Any reporting requirements should have clear goals and should impose the minimum possible administrative burden to achieve those goals. This might be achieved, for example, by minimal first tier reporting of the number of proposals considered and the number approved and rejected, while allowing for follow-up by the Privacy Commissioner if these reports raised concerns or indicated undesirable trends.

65.131 The ALRC supports initiatives by the Privacy Commissioner and the NHMRC to review reporting requirements under the existing arrangements. If the Privacy Act is amended as recommended in this Report, it will be necessary to consider whether to impose a formal reporting requirement on HRECs. The ALRC sees merit in a simplified reporting regime and the publication of periodic report results in order to encourage transparency and public awareness. A regime under which periodic reports are made to the Privacy Commissioner will allow the Commissioner to assess the extent of the use of personal information without consent for research and will allow the Commissioner to intervene, for example, by conducting an investigation, if undesirable trends become apparent.

65.132 These reports should be made public, and the ALRC notes that some past reports have been published by the NHMRC.^[155] In addition, the National Statement provides that research institutions should publish descriptions of all research projects in which an HREC has approved the use of personal information without consent.^[156]

Review

65.133 The accountability of the HREC system was considered in detail in ALRC 96,^[157] prompted in part by the House of Representatives Standing Committee on Legal and Constitutional Affairs inquiry into human cloning and stem cell research.^[158] In ALRC 96, the ALRC and AHEC recommended that there be independent auditing of HREC processes and standardised record keeping and reporting arrangements.^[159] The ALRC remains of the view that periodic, well structured, transparent reporting is one way of providing effective oversight of HREC decision making under the Privacy Act.

65.134 The ALRC considered the concern that elevating the requirement for review by an HREC from the Section 95 and 95A Guidelines into the Privacy Act may mean that those decisions become subject to judicial review.^[160] In the ALRC’s view, this change alone is unlikely to mean that members of HRECs will be characterised as ‘officers of the Commonwealth’—unless they already happen to be ‘officers of the Commonwealth’ in some other capacity—so as to give rise to a right of judicial review under s 75(v) of the Australian Constitution, or s 39B of the Judiciary Act 1903 (Cth).

65.135 HRECs are institutional, rather than statutory committees, established on an administrative basis in accordance with the National Statement. Members are generally volunteers, drawn from a range of community sectors. At least one third of the members of an HREC are required to be from outside the institution for which the HREC is reviewing research, including two lay people who have no affiliation with the institution.^[161] Even where an HREC is established by a public sector agency, therefore, the committee is not composed entirely of officers of that agency. Members are asked to make decisions on the basis of their own judgement.^[162]

65.136 The ALRC also considered whether decisions of HRECs under the Privacy Act could be characterised as decisions ‘of an administrative character made, proposed to be made, or required to be made (whether in the exercise of a discretion or not…) … under an enactment’ for the purposes of the Administrative Decisions (Judicial Review) Act 1977 (Cth) (ADJR Act).^[163] The ADJR Act provides a right to apply to the Federal Court of Australia or the Federal Magistrates Court for judicial review of such decisions.^[164]

65.137 This issue would arise whether the requirement for HREC review was included in the provisions of the Privacy Act, or in the Research Rules to be issued by the Privacy Commissioner. The ALRC intends that the Research Rules, and any other rules issues by the Privacy Commissioner, should be legislative instruments for the purposes of the Legislative Instruments Act 2003 (Cth).^[165] An ‘enactment’ for the purposes of the ADJR Act includes ‘an instrument (including rules, regulations or by-laws) made under such an Act’. Thus, a decision under the Privacy Act or a decision under the Research Rules is likely to amount to a decision ‘under an enactment’.

65.138 In any event, it is appropriate to include the requirement for HREC review in the Act itself. HREC review is a fundamental element of the research exceptions and should be included in the Act for reasons of transparency.

65.139 Traditionally, the principles of administrative law—including judicial review of administrative decisions—applied only to government decision makers. As noted by Justice Michael Kirby in a paper delivered in 2006, however, both the public sector and government service delivery in Australia have fundamentally changed in the past 30 years.

The lines between the public and private sectors are becoming increasingly blurred. Such changes have highlighted significant tensions and gaps in administrative law, in Australia and elsewhere. They have raised important questions as to the development of the law in this area … To what extent should administrative law be applied to private or hybrid bodies, when those bodies are exercising responsibilities of a public nature?^[166]

65.140 Justice Kirby is of the view that where a private body is exercising public power—where decisions are ‘being made on behalf of the people’—public accountability, including before the courts, is entirely appropriate.^[167] The state of the law in this area, however, is not settled. In Neat Domestic Trading Pty Ltd v AWB Ltd,^[168] the majority (McHugh, Hayne and Callinan JJ) declined to answer the question whether public law remedies can be granted against private bodies in circumstances of this kind. The majority confined their decision to the legislative features of the case, holding that public law remedies did not lie against the respondent decision maker because of the particular structure of the relevant statutory provisions, the ‘private’ character of the respondent as a company incorporated under companies legislation with a profit-making objective, and the incompatibility of the respondent’s private interests and public law obligations.

65.141 Kirby J, in dissent, argued that the fact the decision maker was a private company was of no immediate legal consequence.^[169] The statutory scheme under consideration had entrusted decisions of a public, regulatory character to a private company, involving that body in the exercise of public power. In Kirby J’s view, these decisions were of an administrative character made under an enactment and, in the circumstances of the case, amenable to review under the ADJR Act. Gleeson CJ held that it was unnecessary to decide whether the decisions of the company were of ‘an administrative character made under an enactment’, but indicated a preference for the view that they were—with the result that they would be subject to review under the ADJR Act.

65.142 The case is not authority for the proposition that the decisions of private bodies cannot be subject to public law remedies, but it does show that the law in this area is uncertain and its growth incremental. The case indicates that a majority of the High Court is cautious about extending public law remedies to the decisions of private bodies, notwithstanding that the decisions have a public aspect.

65.143 Factors that might be taken into account by the courts include the nature of HREC membership and decision-making process. As noted above, members are generally volunteers, appointed in their personal capacity, and not as representatives of any organisation, group or opinion.^[170] The HREC review process is not intended to be adversarial, but rather an iterative process in which there is room for negotiation and ongoing amendment and refinement of research proposals.^[171] Notwithstanding that Neat Domestic Trading Pty Ltd v AWB Ltd does not say a great deal about the general availability of public law remedies, at least part of the majority’s reasoning is strongly supportive of an argument that the imposition of public law obligations on an HREC would be inconsistent with this kind of community-based, iterative process.

65.144 Given the three–two split in the court, it is possible that the law will develop in such a way that HREC decisions under the Privacy Act come to be characterised as decisions ‘of an administrative character made under an enactment’. It would then become necessary to consider options such as providing an exemption from judicial review for HREC decisions by regulation,^[172] or substantially restructuring the decision-making process under the research exceptions to the Privacy Act.

HRECs: Composition and decision making

65.145 Other issues identified in the course of the OPC Review included the tendency of HRECs to make ‘conservative’ decisions, and the need to involve a number of HRECs in relation to some research proposals, particularly national proposals.^[173] Concern was expressed about inconsistencies in the way HRECs balance the public interests in research and privacy,^[174] and in relation to the membership of HRECs.^[175] Similar issues were raised in the course of the current Inquiry.^[176]

65.146 In ALRC 96, the role and function of HRECs in the context of genetic research were considered in detail, and a range of recommendations to improve HREC decision making and to support HRECs in their work were made. In particular, the ALRC and AHEC recommended that:

The National Health and Medical Research Council (NHMRC) should develop and implement procedures to promote consistency, efficiency, transparency and accountability in the review of human genetic research by Human Research Ethics Committees (HRECs). In developing such procedures, the NHMRC should initiate a systematic quality improvement program that addresses:

a. consolidation of ethical review by region or subject-matter;

b. the membership of HRECs and, in particular, the balance between institutional and non-institutional members;

c. the need for expertise of HRECs in considering proposals for human genetic research;

d. on-going monitoring of approved human genetic research projects;

e. the education and training of HREC members;

f. payment of HREC members for their work in reviewing research proposals;

g. independent audit of HREC processes; and

h. standardised record keeping and reporting to the NHMRC, including in relation to commercial arrangements.^[177]

65.147 The ALRC and AHEC also recommended that:

The NHMRC, in strengthening the level of training and other support provided to HRECs … should ensure that adequate attention is given to: (a) the interpretation of the waiver of consent provisions of the National Statement; and (b) HREC decision making in relation to such waiver.^[178]

65.148 A number of initiatives are under way to address these issues. First, the National Statement has been revised extensively and redrafted.^[179] In addition, the Australian Government provided the NHMRC, in the 2007 federal budget, with $5.6 million over four years to replace multiple ethics review of research projects with a single national approach. The proposed system will streamline approval of cross-jurisdictional and multi-centre research by establishing national committees to conduct a single review of such research. These committees will be established in consultation with states and territories.^[180]

65.149 The New South Wales Department of Health has developed its own model of single ethical review of multi-centre research in the New South Wales public sector. The model was implemented on 1 July 2007.^[181] The Victorian Government Department of Human Services is also working on a project to implement a centralised system of ethical review for multi-centre research.^[182]

65.150 The CSIRO submitted that:

A key development in removing impediments to such multi-centre research has been the National Ethics Application Form (NEAF)13, available for public use since May 2006. This Application Form is an electronic, web based form for use by researchers in any research discipline when submitting research proposals to one or more Human Research Ethics Committee (HREC) for review.^[183]

65.151 Given these recent comprehensive reviews and developments, the ALRC does not propose to reconsider the HREC decision-making process in detail in this Report. The ALRC notes developments in relation to the harmonisation and simplification of ethical review and the development of a National Ethics Application Form. The ALRC recommends, above, that the Section 95 and 95A Guidelines should be replaced by a single set of Research Rules issued by the Privacy Commissioner.^[184] The adoption of a single set of UPPs and a single set of rules relating to research, to be developed in consultation with stakeholders, will have a significant impact on reducing regulatory complexity and the regulatory burden on HRECs.