Identifiability, genomics and UK data protection law

European Journal of Health Law

Volumn 17, Issue 4, 2010, Pages 329-344

  Curren, Liam ^a   Boddington, Paula ^b   Gowans, Heather ^a   Hawkins, Naomi ^a   Kanellopoulou, Nadja ^a   Kaye, Jane ^a   Melham, Karen ^a  

^a UNIVERSITY OF OXFORD   (United Kingdom)

^b UNIVERSITY OF OXFORD   (United Kingdom)

Author keywords

Data Protection Act 1998; DNA; Genomic research; Personal data

Indexed keywords

ARTICLE; ETHICS; GENETIC PRIVACY; GENETICS; HUMAN; HUMAN GENOME; LEGAL ASPECT; UNITED KINGDOM;

GENETIC PRIVACY; GENETIC RESEARCH; GENOME, HUMAN; GREAT BRITAIN; HUMANS;

EID: 77955155561     PISSN: 09290273     EISSN: 15718093     Source Type: Journal    
DOI: 10.1163/157180910X516943     Document Type: Article

References (66)

1. T.A. Pearson and T.A. Manolio, "How to Interpret a Genome-wide Association Study", 299 11 Journal of the American Medical Association (2008) 1335-1344.
2. P.R. Burton, M.D. Tobin and J.L. Hopper, "Key concepts in genetic epidemiology", 360 The Lancet September 10 2005 (2005) 941-951.
3. J.P. Ioannidis, "Personalized genetic prediction: too limited, too expensive, or too soon?", 15(2) Annals of Internal Medicine (2009) 139-41.4)
4. L.J. Palmer and L.R. Cardon, "Shaking the tree: mapping complex disease genes with linkage disequilibrium", 366 The Lancet October 1 2005 (2005) 1223-1234.
5. Pearson and Manolio supra note 1.
6. S.C. Schuster, "Next-generation sequencing transforms today's biology", 5(1)Nat Meth (2008) 16-18.
7. W.Y.S. Wang, B.J. Barratt, D.G. Clayton and J.A. Todd, "Genome-wide association studies: theoretical and practical concerns", 6 Nature Reviews Genetics (2005) 109-118.
8. K.M. Channon and H. Watkins, "Coronary artery disease genetics: bigger is better", European Heart Journal 25 (2004) 900-901.
9. M. Slatkin, "Linkage disequilibrium - understanding the evolutionary past and mapping the medical future", 9Nature Reviews Genetics (2008) 477-485.
10. A.L. Price, N.J. Patterson, R.M. Plenge, M.E. Weinblatt, N.A. Shadick and D. Reich, "Principal components analysis corrects for stratification in genomewide association studies", 38(8) Nature Genetics (2006) 904-909.
11. D. Botstein and N. Risch, "Discovering genotypes underlying human phenotypes: past successes for mendelian disease, future approaches for complex disease", 33 Nature Genetics Supplement (2003) 228-237.
12. R.S. Cooper, B. Tayo and X. Zhu, "Genome-wide association studies: implications for multiethnic samples", Human Molecular 17(R2) Genetics (2008) R151-5.
13. Y.Y. Teo, K.S. Small, and D.P. Kwiatkowski, "Methodological challenges of genome-wide association analysis in Africa", 11Nature Reviews Genetics (2010) 149-160.
14. C. Tian, P.K. Gregersen and M.F. Seldin, "Accounting for ancestry: population substructure and genome-wide association studies", 17 Human Molecular Genetics (2008) R143.
15. Pearson and Manolio supra note 1.
16. A.T. Hattersley and M.I. McCarthy, "What makes a good genetic association study?", 366 The Lancet October 8 2005 (2005) 1315-1323.
17. The International HapMap Consortium, "A second generation human haplotype map of over 3.1 million SNPs", 449Nature 18 October 2007 (2007) 851-861.
18. J. Kaiser, "A plan to capture human diversity in 1000 genomes", 319 Science 25 January (2008) 395.
19. J.P.A. Ioannidis, P. Boffetta, J. Little, T.R. O'Brien, A.G. Uitterlinden, P. Vineis, D.J. Balding, A. Chokkalingam, S. Dolan, W.D. Flanders, J.P.T. Higgins, M.I. McCarthy, D.H. McDermott, G.P. Page, T.R. Rebbeck, D. Seminara and M.J. Khoury, "Assessment of cumulative evidence on genetic associations: interim guidelines", 37 International Journal of Epidemiology (2007) 120-132.
20. The GAIN Collaborative Research Group, "New models of collaboration in genome-wide association studies: the Genetic Association Information Network", 39Nature Genetics (2007) 1045-1051.
21. M.D. Mailman, M. Feolo, Y. Jin, M. Kimura, K. Tryka, R. Bagoutdinov, L. Hao, A. Kiang, J. Paschall, L. Phan, N. Popova, S. Pretel, L. Ziyabari, M. Lee, Y. Shao, Z.Y. Wang, K. Sirotkin, M. Ward, M. Kholodov, K. Zbicz, J. Beck, M. Kimelman, S. Shevelev, D. Preuss, E. Yaschenko, A. Graeff, J. Ostell and S.T. Sherry, "The NCBI dbGaP database of genotypes and phenotypes", 39 Nat Genet 10 (2007) 1181-1186.
22. P. Flicek and E. Birney, "The European Genotype Archive: Background and Implementation" (2007) Retrieved 5 May 2010, http://www.ebi.ac.uk/ega/ bcms/ega/Documents/EGA-whitepaper.pdf.
23. Wellcome Trust Case Control Consortium, "Genome-wide association study of 14,000 cases of seven common diseases and 3,000 shared controls", Nature 447 (2007) 661-678.
24. Z. Lin, A.B. Owen and R.B. Altman, "Genomic research and human subject privacy", 305 Science (2004) 183.
25. Pearson and Manolio supra note 1.
26. N. Homer, S. Szelinger, M. Redman, D. Duggan, W. Tembe, J. Muehling, J.V. Pearson, D.A. Stephan, S.F. Nelson and D.W. Craig, "Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays", 4(8) PLoS Genet (2008) e1000167.
27. C.A. Cassa, B. Schmidt, I.S. Kohane and K.D. Mandl, "My sister's keeper?: genomic research and the identifiability of siblings", 1BMC Med Genomics (2008) 32.
28. J. Gitschier, "Inferential genotyping of Y chromosomes in Latter-Day Saints founders and comparison to Utah samples in the HapMap project", 84(2) American Journal of Human Genetics (2009) 251-258.
29. P3G Consortium, G. Church, C. Heeney, N. Hawkins, J. de Vries, P. Boddington, J. Kaye, M. Bobrow and B. Weir, "Public Access to Genome-Wide Data: Five Views on Balancing Research with Privacy and Protection", PLoS Genet 2009 5 10 e1000665.
30. C. Heeney, N. Hawkins, J. de Vries, P. Boddington and J. Kaye, "Assessing the Privacy Risks of Data Sharing in Genomics", Public Health Genomics 2010 DOI: 10.1159/000294150
31. J. Kaye, C. Heeney, N. Hawkins, J. de Vries and P. Boddington, "Data sharing in genomics: re-shaping scientific practice", 10(5) Nature Reviews Genetics (2009) 331-335.
32. The principles derive from the Council of Europe's 1981 Convention for the protection of individuals with regard to automatic processing of personal data (ETS No. 108) and the 1980 OECD Guidelines on trans-border data flow.
33. This represents a marked departure from the European Data Directive, where recital 26 states that "to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the [data] controller or by any other person".
34. Durant v. Financial Services Authority [2003] EWCA Civ 1746.
35. Supra at [28].
36. The ICO "Data Protection Technical Guidance Determining what is personal data" states that 'It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data are personal data.' (v1.0 21 August 2007) at p. 12.
37. Article 29 Working Party, "Opinion 4/2007 on the concept of personal data" (WP 136, 2007).
38. P. Ohm, "Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization." University of Colorado Law Legal Studies Research Paper No. 09-12, available at http://ssrn.com/ abstract=1450006.
39. D.R. Karp, S. Carlin, R. Cook-Deegan, D.E. Ford, C. Geller, D.N. Glass, H. Greely, J. Guthridge, J. Kahn, R. Kaslow, C. Kraft, K. McQueen, B. Malin, R.H. Scheurman and J. Sugarman, "Ethical and practical issues associated with aggregating databases", 5(9) PLoS Medicine (2008) e190 .
40. ICO "Data Protection Technical Guidance Determining what is personal data" (v1.0 21 August 2007) at p. 20.35) Data Protection Act, Sched 1, Part 1.
41. Data Protection Act, s4(4).
42. The term 'research purposes' is not defined in the Data Protection Act, however s.33 states that they include statistical or historical purposes.
43. This exempts the data from the second data protection principle: personal data may be obtained only for one or more specified lawful purposes.
44. This exempts the data from the fifth data protection principle: personal data may not be kept for longer than is necessary.
45. Data Protection Act, s.7.
46. See below for discussion on fair processing.
47. As per Data Protection Act, Sched 1, Part II, 1.
48. Information Commissioner's Office, "Use and Disclosure of Health Data: Guidance on the Application of the Data Protection Act 1998" (2002) at page 7.
49. The ICO guidance goes on to suggest that impersonal communications, such as a poster in a waiting room, would not alone be sufficient unless supplemented with other forms of information, such as discussions during face-to-face consultations, or separate specific invitations to would-be research participants.
50. The ICO has stated that where information about an individual is derived from the completion of a health questionnaire by a family member, the individual should be informed as to the identity of the data controller and the proposed purposes for which it is being processed. See Information Commissioner, "Response to Human Genetic Commission's 'Whose Hands on Your Genes' consultation" (2001) Retrieved on 5 May 2010 at http://www.hgc.gov.uk/ client/Content-wide.asp?ContentId=432.
51. ICO Data Protection Act 1998 Legal Guidance (2000) at 5.7.
52. Data Protection Act, Sched 1, Part II, para. 3(2)(a).
53. Data Protection (Conditions, etc.) Order 2000 SI 2000/185, para. 5(2).
54. Since April 2010, the ICO has the power to conduct audits of public authorities in order to assess whether organisations are processing personal information in line with the Data Protection Act (DPA) and to advise on best practice. Data Protection Act ss. 41A - C.
55. Google Inc., "Street View . . . allow[s] you to visually explore and navigate a neighbourhood through panoramic street-level photographs." (2009) Retrieved 5 May 2010 http://www.google.co.uk/press/ streetview/.
56. ICO, Letter to Privacy International, 30 March 2009 (2009).
57. The Article 29 Working Party "Opinion on More Harmonised Information Provisions" (WP 100, 25 November 2004).
58. Data Protection Act, s.43.
59. Data Protection Act, s.44.55) Data Protection Act, s.40.
60. Data Protection Act, ss.47(1)-(2).
61. Except for Crown Estate Commissioners or persons specified by s.63(3) Data Protection Act.
62. The ICO has produced statutory guidance about how it proposes to use this new power: "Information Commissioner's guidance about the issue of monetary penalties prepared and issued under section 55C (1) of the Data Protection Act 1998" (January 2010).
63. Data Protection Act, s.55.
64. Data Protection Act, s.55A & 55B.
65. That is, a contravention that meets the first two conditions.
66. ICO statutory guidance supra.63) For example, "NHS National Research Ethics Guidance on use of personal data." Retrieved on 6 May 2010 from: http://www.nres.npsa.nhs.uk/applications/guidance/research-guidance/#personal.