Pharmacogenetics
Privacy and confidentiality (continued)
3.38 Allowing broad consent may be of significant benefit to researchers and to society’s interest in the acquisition of knowledge about health and disease. Researchers may not be able to predict at the start of a study whether the information gathered may subsequently be useful in additional research. If this proves to be the case, the practical difficulties of contacting participants and obtaining new consent for the use of their data in a different project perhaps a number of years later, may be prohibitive.
3.39 Current guidance regarding obtaining broad consent in research has been provided by the Medical Research Council (MRC). The MRC proposes that where broad consent is desired, a two-phase process is used which enables participants to agree to a specific research project but to opt out of allowing their sample to be used for other purposes. The guidance states that: ‘unless the sample is to be anonymised and unlinked prior to storage… it is not acceptable to seek unconditional blanket consent, for example using terms such as ‘all biological or medical research’. If samples may be stored or used in a form that allows them to be linked to individuals, possible future research should be explained in terms of the types of studies that may be done, the types of diseases that could be investigated, and the possible impact of the research on them personally. The benefits of enabling more efficient use of valuable samples should be explained to donors.’29 Having obtained broad consent, all future projects must be approved by a competent Local Research Ethics Committee. We consider that it is permissible to request broad consent to the use of samples which are anonymous or anonymised. Where samples collected for a particular study are coded or identified, broad consent to future research may also be permissible, but should be sought separately from consent to the initial study. This separate consent may be obtained when the samples are originally taken, or at a later date. In general, the further removed the future research is from the original study, the more likely it is that separate broad consent should be obtained. An indication of the type or nature of the research likely to be carried out and its implications for the individual should be given where possible.
3.40 A further question is whether data protection laws are compatible with the anonymisation of pharmacogenetic samples. Countries vary in their regulations regarding data protection. In the UK, the Data Protection Act 1998 (DPA) is the primary means by which the storage and processing of personal data is regulated. The DPA defines a special class of ‘sensitive personal data’ which includes health data and information about racial origin but does not specifically mention genetic information. Research using anonymous or anonymised samples is not subject to the Data Protection Act. Under the DPA, those who collect personal data are responsible for ensuring that the patient has explicitly consented to the processing of the data. However, there is a specific provision that permits the processing of sensitive data by health professionals, or others subject to an equivalent duty of confidentiality, without consent.30 Nonetheless, organisations storing DNA samples are likely to be obliged to obtain explicit consent to comply with other laws, such as the common law of confidence. A patient has the right to request access to his or her personal data at any time, unless this is judged likely to cause serious harm to the physical or mental health of the patient or any other person.31
3.41 In 2002, the Information Commissioner published guidance to clarify the application of the DPA in the case of health records.32 In the context of clinical trials, this states that:
Uses and disclosures of the information should be explained, including that this use of personal data is optional.
Consent to processing is required to meet common law obligations, and should be ‘explicit’ to conform to the requirements of the DPA. (This will generally mean written consent must be obtained.)
Privacy-enhancing technologies should be used to protect the identity of patients.
Patients must be told about secondary use of the data that is anticipated when the data are first collected. The exemption provided for in section 33 of the DPA, which allows research to be carried out without notice being given to the individual, is unlikely to apply. It applies only where, inter alia, the data are only processed for research and are not processed to support decisions about the individual, such as their treatment.
3.42 In addition to the rights of patients to have access to their data, the DPA also provides that holders of data have a positive obligation to inform individuals if they hold information about them. In the context of genetic information, this has given rise to concern about the possibility that health professionals might be obliged to inform relatives about genetic test results, if those results may also apply to other family members. The Human Genetics Commission has said that:
‘It is not clear how the DPA deals with information relating to a subject which also contains information about a relative. It could be that relatives could prevent such information being processed, or that the DPA might require data controllers to pass on such information to the relatives.’33
‘We believe that there may be a need for secondary legislation to ensure that the holders of information about genetic relatives in a clinical context are specifically exempted from their normal obligations of notification and provision of information to such relatives under the DPA.’34
However, it has also been argued that unless the holders of personal data also have, or are likely to obtain, additional information that identifies the relative in question, the DPA does not require the data to be disclosed.
3.43 There is a considerable literature on the obligation to disclose information to relatives, both in genetics and in the case of infectious disease. In difficult cases raised by genetic testing, decisions should be driven by clinical judgement and by awareness of the particular features of the case, not by legislation. In the case of pharmacogenetic information, the likelihood that test results would be of immediate relevance to a family member is low compared to other genetic tests such as those for monogenic disorders (see paragraphs 5.34 – 5.35). We received conflicting views as to whether the Data Protection Act (DPA) imposed an obligation on health professionals to disclose information to relatives. We recommend that even if secondary legislation is not required, clarification should be provided by the Information Commissioner to ensure that the DPA is not interpreted so as to require health information to be passed to relatives.
Footnotes29 Medical Research Council (2001) Human Tissue and Biological Samples for Use in Research – Operational and Ethical Guidelines (London: MRC).
30 Data Protection Act 1998, schedule 3, para. 8.
31 The right of access is subject to a number of other exceptions. For example, it is also sometimes possible to refuse to release information in response to repeat requests.
32 Information Commissioner (2002) Use and Disclosure of Health Data: Guidance on the Application of the Data Protection Act 1998. Available: http://www.dataprotection.gov.uk/dpr/dpdoc.nsf/ed1e7ff5aa6def30802566360045bf4d/ 7b7d02d29c28e76d80256bb5005d7bb3/$FILE/HealthGU.doc. Accessed on: 5 Mar 2003..
33 Human Genetics Commission (2002) Inside Information: Balancing interests in the use of personal genetic data (London: Department of Health), para. 3.37.
34 Human Genetics Commission (2002) Inside Information: Balancing interests in the use of personal genetic data (London: Department of Health), para. 4.7.