Privacy law & genetic research
As of May 2017, and surprisingly not sooner, Canadians’ genetic information is finally protected. Prior to that, any information gleaned about a person through genetic testing wasn’t protected under Canadian privacy laws. We were the only G7 country in which genetic discrimination wasn’t prohibited by law; a prime example of legislation falling far behind technology.
Out still-new Genetic Non-Discrimination Act prohibits an individual from being forced to undergo genetic testing in order to obtain insurance, whether health or commercial policies/renewals (e.g. mortgage insurance). It also prohibits insurance & other firms from requiring a person to disclose the results of any genetic testing that they’d already undergone. Read Genetic discrimination no longer legal for more information regarding this legislation.
In contrast, the United States has had the Health Insurance Portability and Accountability Act (HIPAA) since 1996. So it came as quite a surprise to read the following comments in The American Journal of Human Genetics(1) yesterday:
“Discourse about HIPAA access sometimes conveys a tone of shocked indignation, as if the access right burst out of nowhere and took everybody by surprise. In fact, HIPAA access codifies long-standing ethical principles enunciated in analyses that Congress commissioned at the dawn of the information age in the 1970s and again in the late 1990s.
In both cases, legislators were grappling with how to protect people’s rights in an age when storing, sharing, and using personal data offered important societal benefits, and both studies converged on two ethical principles.
- First, people cannot grant valid informed consent for their data to be used in research if they do not know what their records contain, so individual access facilitates socially beneficial data access
- Second, there is sometimes ethical justification for using people’s data without consent, but unconsented access implies the need for an individual access right so that people can at least understand and mitigate the resulting risks to their civil rights
The Privacy Protection Study Commission’s 1977 report specifically examined access to research data and concluded that if research records cannot be ‘totally protected against the possibility that individually identifiable information in them will be disclosed for any other purpose, the individual’s concern is obvious and his access right highly relevant’.”
That final paragraph refers to research data in the US, so I thought it would be interesting to see what Canada’s long-standing reference for research ethics says about genetic information. The Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (2), referred to as ‘TCPS 2’ includes an entire chapter entitled Human Genetic Research.
TCPS 2 notes in Chapter 13 that:
- The implications of genetic information affect more than the individual directly involved, as it may reveal information that’s also applicable to biological relatives and to those who share genetic ancestry with them
- An individual’s participation in genetic research may thus have ramifications on those other individuals, groups, or even communities
- This is particularly true of any genetic research which specifically targets families, groups, or communities
- This type of group-targeted genetic research may require special considerations as to the recruitment of participants, the consent process, and data/privacy protection
- All genetic research and testing carries the potential to stigmatize the individuals, groups, and communities involved, “who may experience discrimination or other harms because of their genetic status, or may be treated unfairly or inequitably”(2)
It seems, from the final point above, that TCPS 2 has not yet been updated to reflect Canada’s 2017 Genetic Non-Discrimination Act. Article 13.2 nevertheless provides a useful reminder that researchers conducting genetic research in Canada must:
- Include in their protocol a plan to manage any data/information that may be brought to light during the course of the genetic research (including not only disease markers, but also information about family relationships such as adoptions and paternity)
- Obtain research ethics board (REB) approval of this plan
- Advise prospective research participants, in advance, of this plan for managing information brought to light by the genetic research project (which may include genetic counselling, referral to specialist clinicians for certain disease markers, etc. for the individual as well as for biological relatives)
And, similar in nature to the ‘right to be forgotten’ legislation in the European Union, “the right to privacy includes a right not to know”(2; Article 13.3). This entails a requirement that researchers provide options to genetic research participants to be made aware of certain findings – or not. And this can, in turn, have a bearing on the type of group-targeted genetic research discussed above. Some family members may choose not to know, while other chose to be informed of, markers for such conditions as Huntington’s Disease.
This is an example of why much consideration has to be given to the consent process for genetic research. It must include all of these variables, at both an individual and group level; whether the group consists of biological relatives or an entire community.
And in this, the Canadian TCPS 2 is in line with yesterday’s article in The American Journal of Human Genetics, on HIPAA:
“People cannot grant valid informed consent for their data to be used in research if they do not know what” these records could contain”. (1)
(1) Evans, Barbara J. HIPAA’s Individual Right of Access to Genomic Data: Reconciling Safety and Civil Rights. The American Journal of Human Genetics: Volume 102, Issue 1, 5-10. 04 Jan 2018. Web:
Canadian Institutes of Health Research, Natural Sciences and Engineering Research Council of Canada, and Social Sciences and Humanities Research Council of Canada. Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans, December 2014. Web: