The body as data? Biobank regulation via the ‘back door’ of data protection law

Law, Innovation and Technology

Volumn 2, Issue 1, 2010, Pages 1-25

  Bygrave, Lee A ^a,b  

^a UNIVERSITY OF OSLO   (Norway)

^b UNIVERSITY OF NEW SOUTH WALES   (Australia)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84873967011     PISSN: 17579961     EISSN: 1757997X     Source Type: Journal    
DOI: 10.5235/175799610791935443     Document Type: Article

References (148)

1. The term ‘data protection’ is used here in its primarily European sense to denote a set of norms that specifically regulate the processing of data relating to persons (ie, personal data) in order to safeguard, at least partly, the privacy and related interests of those persons. Outside Europe, such norms tend rather to be described in terms of protecting ‘privacy’, ‘data privacy’ or ‘information privacy’.
2. See eg Lee A Bygrave, Data Protection Law: Approaching its Rationale, Logic and Limits (Kluwer Law International, 2002) ch 6 and references cited therein.
3. See eg Lee A Bygrave, Data Protection Law: Approaching its Rationale, Logic and Limits (Kluwer Law International, 2002), 128-30 and references cited therein.
4. Samuel D Warren and Louis D Brandeis, ‘The Right to PrivacyM’ (1890) 4 Harvard Law Review 193, 195.
5. Thomas M Cooley, A Treatise on the Law of Torts, or, the Wrongs which Arise Independent of Contract (Callaghan & Co, 2nd edn 1888) 29.
6. See too Tom Gerety, ‘Redefining PrivacyM’ (1977) 12 Harvard Civil Rights-Civil Liberties Law Review 266.
7. See eg A Pollack, ‘Firm Brings Gene Tests to the Masses’ New York Times, 28 January 2010, www.nytimes.com/2010/01/29/business/29gene.html
8. Francis S Collins, The Language of Life: DNA and the Revolution in Personalized Medicine (HarperCollins, 2010) 84-96, app E.
9. Collins, The Language of Life: DNA and the Revolution in Personalized Medicine (HarperCollins, 2010) xxiv.
10. See further, eg, Linda Kharaboyan, Denise Avard and Bartha Maria Knoppers, ‘Storing Newborn Bloodspots: Modern Controversies’ (2004) 32 Journal of Law, Medicine & Ethics 741.
11. Anne Cambon-Thomsen et al, ‘An Empirical Survey on Biobanking of Human Genetic Material and Data in Six EU Countries’ in Bartha Maria Knoppers (ed), Populations and Genetics: Legal and Socio-Ethical Perspectives (Martinus Nijhoff, 2003) 141-68;
12. Nicole Parmour, ‘A Survey of the Variability of DNA Banks Worldwide’ in Populations and Genetics: Legal and Socio-Ethical Perspectives (Martinus Nijhoff, 2003) 123-40.
13. For discussion of the catalysts for the proliferation of biobanks see eg Herbert Gottweis, ‘Biobanks in Action: New Strategies in the Governance of Life’ in Herbert Gottweis and Alan Petersen (eds), Biobanks: Governance in Comparative Perspective (Routledge, 2008) ch 2.
14. Most notably the Icelandic Health Sector Database run by deCODE genetics, Inc. See further Hilary Rose, ‘From Hype to Mothballs in Four Years: Troubles in the Development of Large-scale DNA Biobanks in Europe’ (2006) 6 Community Genetics 184.
15. As exemplified by the UK Biobank initiative: see www.ukbiobank.ac.uk.
16. See further, eg, Anil K Jain and Arun Ross, ‘Introduction to Biometrics’ in Anil K Jain, Patrick Flynn and Arun A Ross (eds), Handbook of Biometrics (Springer, 2008) ch 1.
17. The use of human characteristics to recognise people has always been an integral part of human interaction.
18. See further Simon A Cole, Suspect Identities: A History of Fingerprinting and Criminal Identification (Harvard University Press, 2001) chs 2-3.
19. see eg Louise Amoor, ‘Biometric Borders: Governing Mobilities in the War on Terror’ (2006) 25 Political Geography 336;
20. Patrick H O’Neil, ‘Complexity and Counterterrorism: Thinking about BiometricsM’ (2005) 28 Studies in Conflict and Terrorism 547.
21. See further, eg, Jain and Ross (n 15) 12-14.
22. The case particularly with genetic information which may relate to the biological kin of the person from whom the information is directly derived.
23. David Lyon, Surveillance Society: Monitoring Everyday Life (Open University Press, 2001) 2.
24. With respect to biometrics, see eg European Union, Article 29 Working Party on the Protection of Individuals with regard to the Processing of Personal Data (hereinafter ‘Article 29 Working Party’), ‘Working Document on Biometrics’ (1 August 2003) WP 80, http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2003/wp80_en.pdf;
25. Council of Europe, Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (T-PD), ‘Progress report on the application of the principles of Convention 108 to the collection and processing of biometric data’ (February 2005), www.coe.int/t/e/legal_affairs/legal_co-operation/data_protection/documents/reports_and_studies_of_data_protection_committees/2Biometrics_2005_en.pdf;
26. Yue Liu, ‘Rational Concerns about Biometric Technology: Security and Privacy’ in Ramesh Subramanian (ed), Computer Security, Privacy and Politics: Current Issues, Challenges and Solutions (IGI Global, 2008) 94-134.
27. With respect to genetic information, see eg United Kingdom, Human Genetics Commission, Inside Information: Balancing Interests 4
28. Law, Innovation and Technology in the Use of Personal Genetic Data (May 2002);
29. Australian Law Reform Commission (ALRC) and Australian Health Ethics Committee (AHEC), Essentially Yours: The Protection of Human Genetic Information in Australia, Report No 96 (ALRC/AHEC, Sydney 2003);
30. Article 29 Working Party, ‘Working Document on Genetic Data’ (17 March 2004) WP 91, http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2004/wp91_en.pdf;
31. Mark A Rothstein (ed), Genetic Secrets: Protecting Privacy and Confidentiality in the Genetic Era (Yale University Press, 1997);
32. Graeme Laurie, Genetic Privacy (Cambridge University Press, 2002).
33. Anthony Giddens, The Consequences of Modernity (Stanford University Press, 1990) 14, 17ff.
34. Lyon (n 20) 15.
35. David Lyon, ‘Biometrics, Identification and SurveillanceM’ (2008) 22 Bioethics 507. Lyon is here referring specifically to an effect of biometrics but his characterisation is also pertinent to surveillance systems more generally.
36. See eg Nuffield Council on Bioethics, The Forensic Use of Bioinformation: Ethical Issues (September 2007) xiv, xv, 6-7, 54;
37. Norwegian Supreme Court decision of 1 February 2006, reported in Norsk Retstidende (Norwegian Law Reports; abbreviated as ‘Rt’) 2006 90 [29].
38. See further, eg, Mark A Rothstein, ‘Genetic Exceptionalism and Legislative PragmatismM’ (2007) 35 Journal of Law, Medicine & Ethics 59;
39. ALRC and AHEC (n 21) [3.41]-[3.63] and references cited therein.
40. Irma van der Ploeg, ‘Biometrics and the Body as Information: Normative Issues of the Socio-Technical Coding of the Body’ in David Lyon (ed), Surveillance as Social Sorting: Privacy, Risk, and Automated Discrimination (Routledge, 2002) ch 3;
41. Irma van der Ploeg, The Machine-Readable Body: Essays on Biometrics and the Informatization of the Body (Shaker, 2005) ch 4.
42. See eg Matt Ridley, Genome: The Autobiography of a Species in 23 Chapters (Fourth Estate, 1999) 7-8.
43. See further Matt Ridley, Genome: The Autobiography of a Species in 23 Chapters (Fourth Estate, 1999) 7-8 13ff.
44. See too Irma van der Ploeg, ‘Genetics, Biometrics and the Informatization of the BodyM’ (2007) 43 Annali dell’ Istituto Superiore di Sanità 47.
45. S and Marper v United Kingdom (App no 30562/04 and 30566/04) ECtHR, 4 December 2008.
46. Convention for the Protection of Human Rights and Fundamental Freedoms (opened for signature 4 November 1950; in force 3 September 1953) European Treaty Series (ETS) 5.
47. Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (opened for signature 28 January 1981; in force 1 October 1985) ETS 108 (hereinafter ‘Data Protection Convention’).
48. Marper (n 30) [68].
49. See too [68] and [73] where samples are treated as ‘containing’ personal information-ie, they are regarded, in effect, as vessels of such information and, as such, constitute ‘personal data’. The Court uses the terms ‘data’ and ‘information’ interchangeably: see eg [75].
50. See too [68] and [73] where samples are treated as ‘containing’ personal information-ie, they are regarded, in effect, as vessels of such information and, as such, constitute ‘personal data’. The Court uses the terms ‘data’ and ‘information’ interchangeably. See too [63].
51. LS, R (on application of) v South Yorkshire Police (Consolidated Appeals) [2004] UKHL 39; [2004] 1 WLR 2196, [70].
52. Marper, R v Chief Constable of South Yorkshire [2002] EWCA Civ 1275; [2002] 1 WLR 3223, [72] (‘Bodily samples are also a source of identifying data’) [74] (‘DNA samples in themselves have no forensic or diagnostic value. Their value lies in the … data they yield’).
53. David H Harris et al, Law of the European Convention on Human Rights (Oxford University Press, 2nd edn 2009) 17.
54. Explanatory Report on the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Council of Europe, 1981).
55. Note, though, that the report does not provide ‘an authoritative interpretation of the text of the Convention, although it might be of such nature as to facilitate the understanding of the provisions contained therein’: Law of the European Convention on Human Rights [II].
56. Law of the European Convention on Human Rights, [28].
57. See Recommendation R (92) 1 on the Use of Analysis of Deoxyribonucleic Acid (DNA) within the Framework of the Criminal Justice System (adopted 10 February 1992) (distinguishing generally between ‘samples’ and ‘information derived from them’);
58. Recommendation R (92) 3 on Genetic Testing and Screening for Health Care Purposes (adopted 10 February 1992) (also distinguishing between ‘substances’ and ‘samples’ on the one hand and, on the other, ‘information derived therefrom’);
59. Recommendation Rec(2006)4 on Research on Biological Materials of Human Origin (adopted 15 March 2006) (distinguishing generally between ‘biological materials’ and ‘associated (personal) data’). See too Explanatory Memorandum to Recommendation R (97) 5 on the Protection of Medical Data (adopted 13 February 1997) [41] distinguishing ‘genetic data’ from ‘blood, tissue, hair, sperm, and so forth’;
60. see too [42], [47], [52] and [55]. Cf Elisabeth Rynning, ‘Biobankerna-hög tid för bankinspektion?' [The Biobanks-High Time for Bank Inspection?] (1998) Förvaltningsrättslig Tidskrift
61. principle 8 of Recommendation R (92) 1 is headed ‘storage of samples and data’;
62. while principle 10 of Recommendation R (92) 3 deals only with ‘genetic data’ under the heading ‘separate storage of genetic information’.
63. See further Harris et al (n 37) 800-1.
64. Paul de Hert and Serge Gutwirth, ‘Data Protection in the Case Law of Strasbourg and Luxembourg: Constitutionalisation in Action’ in Serge Gutwirth et al (eds), Reinventing Data Protection? (Springer Science, 2009) 14-29;
65. Lee A Bygrave, ‘Data Protection Pursuant to the Right to Privacy in Human Rights TreatiesM’ (1998) 6 International Journal of Law and Information Technology 254-84.
66. Convention between the Kingdom of Belgium, the Federal Republic of Germany, the Kingdom of Spain, the French Republic, the Grand Duchy of Luxembourg, the Kingdom of the Netherlands and the Republic of Austria on the stepping up of cross-border cooperation, particularly in combating terrorism, cross-border crime and illegal migration opened for signature 27 May 2005;
67. United Kingdom, Keeping the Right People on the DNA Database: Science and Public Protection (Home Office, May 2009).
68. ICO, ‘The Information Commissioner’s response to the Home Office consultation paper on the retention, use and destruction of DNA data and fingerprints’ (7 August 2009; version 1.0; final) 5 (emphasis added; see too 3), www.ico.gov.uk/upload/documents/library/data_protection/notices/response_to_ho_consultation_may09.pdf.
69. ICO, ‘Data Protection Technical Guidance: Determining what is personal data’ (21 August 2007, version 1.0);
70. ICO, ‘Data Protection Technical Guidance: Determining what information is “data”
71. for the purposes of the DPA’ (28 January 2009; version 1.0). Both guidance notes are available at www.ico.gov.uk/what_we_cover/data_protection/guidance/technical_guidance_notes.aspx.
72. See Deryck Beyleveld et al, ‘The UK’s Implementation of Directive 95/46/EC’ in Deryck Beyleveld et al (eds), Implementation of the Data Protection Directive in Relation to Medical Research in Europe (Ashgate, 2004) 428
73. William W Lowrance, Learning from Experience: Privacy and the Secondary Use of Data in Health Research (Nuffield Trust, 2002) 35
74. Cf Medical Research Council, ‘Human Tissue and Biological Samples for Use in Research: Operational and Ethical Guidelines’ (2001) [5.1]
75. Deryck Beyleveld, ‘Data Protection and Genetics: Medical Research and the Public GoodM’ (2007) 18 King’s Law Journal 279, where, against the grain, it is argued that samples as such do constitute data.
76. Writing in 2004, Beyleveld et al (n 51) 428 state that ‘[t]he official view from the IC [Information Commissioner] is that samples themselves are not treated as personal data, because it is physical material’.
77. See eg Data Protection Convention, Art 2(a);
78. UK Data Protection Act 1998, s 1(1);
79. Australia’s federal Privacy Act 1988, s 6(1).
80. For further analysis of these and like definitions, see eg Bygrave (n 2) 41-50, 210-15, 315-19.
81. See eg Paolo Atzeni et al, Database Systems: Concepts, Languages and Architectures (McGraw-Hill, 1999) 2;
82. Chrisanthi Avgerou and Tony Cornford, Developing Information Systems: Concepts, Issues and Practice (Macmillan, 2nd edn 1998) 115.
83. Council Directive (EC) 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L281/31 (hereinafter ‘Data Protection Directive’).
84. See eg Paolo Atzeni et al, Database Systems: Concepts, Languages and Architectures (McGraw-Hill, 1999) 2;
85. Chrisanthi Avgerou and Tony Cornford, Developing Information Systems: Concepts, Issues and Practice (Macmillan, 2nd edn 1998) 115.
86. Council Directive (EC) 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L281/31 (hereinafter ‘Data Protection Directive’).
87. See the Commission’s commentary with respect to its amended proposal for a data protection Directive of 15 October 1992: COM (92) 422 final-SYN 287, 9. See also its commentary with respect to the original Directive proposal of 24 September 1990: COM (90) 314 final-SYN 287, 15.
88. COM (92) 422 final-SYN 287, 9. See also 3 (‘the principles of protection laid down by the Directive are not dependent on a particular technology or form of organization’).
89. Article 29 Working Party, ‘Working Document on Genetic Data’ (17 March 2004) WP 91, 5 (noting that the applicability of Directive 95/46/EC to ‘samples’ of DNA is uncertain, but that ‘such samples may constitute a source of personal data’ and that, accordingly, ‘in regulating genetic data, consideration should also be given to the legal status of DNA samples’).
90. For more on the leeway accorded member states in their implementation of the Directive, see eg Bygrave (n 2) 34.
91. See generally Deryck Beyleveld et al (eds), Implementation of the Data Protection Directive in Relation to Medical Research in Europe (Ashgate, 2004).
92. Ants Nõmper, ‘Personal Data Protection Regulation in Estonia and Directive 95/46/EC’ in Beyleveld et al, Implementation of the Data Protection Directive in Relation to Medical Research in Europe 75-76.
93. See the following chapters of Beyleveld et al (n 66): Sylvia Tomova, ‘Implementation of Directive 95/46/EC in Relation to Medical Research in Bulgaria’ 46;
94. Inga Cabe, ‘The Implementation of Directive 95/46/EC into National Legislation with Regard to Medical Research in Latvia’ 218;
95. Liana Ples, ‘The Implementation in Domestic Law of Directive 95/46/EC in Romania’ 346;
96. Alenka Selih, ‘Implementation of Directive 95/46/EC in Slovenia’ 355.
97. Herman Nys, ‘Report on the Implementation of Directive 95/46/EC in Belgian Law’ in Beyleveld et al (n 66)
98. In support of his claim, Nys refers to S Callens, Goed geregeld? Het gebruik van medische gegevens voor onderzoek (Maklu, 1995) 40.
99. CM Romeo Casabona and Pilar Nicolás, ‘The Implementation of Directive 95/46/EC in Spain’ in Beyleveld et al (n 66) 379.
100. See Helena Moniz and Catarina Sarmento e Castro, ‘Report on the Implementation of Directive 95/46/EC in Relation to Medical Research in Portugal’ 340;
101. Herman Christoph Kühn, ‘The Implementation of the Data Protection Directive 95/46/EC in Germany’ 138, both in Beyleveld et al (n 66).
102. Elisabeth Rynning, ‘Processing of Personal Data in Swedish Health Care and Biomedical Research’ in Beyleveld et al (n 66) 396-7 and references cited therein.
103. See too Datainspektionen [Data Inspectorate], Biobanker och personuppgiftslagen [Biobanks and the Personal Data Act] (Stockholm 2004) 8, www.datainspektionen.se/Documents/rapport-biobanker.pdf.
104. Rynning, Biobanker och personuppgiftslagen, 397-8.
105. Elisabeth Rynning, ‘Public Law Aspects on the Use of Biobank Samples-Privacy versus the Interests of Research’ in Mats G Hansson and Marianne Levin (eds), Biobanks as Resources for Health (Uppsala University, 2003) 91;
106. Elisabeth Rynning, ‘Offentligrättslig reglering av biobankerna-en utmaning för lagstiftaren’ [Public law regulation of biobanks-a challenge for the legislator] in Sanna Wolk (ed), Biobanksrätt [Biobank Law] (Studentlitteratur, 2003) 49;
107. Rynning (n 43) 303.
108. Mette Hartlev, ‘The Implementation of Data Protection Directive 95/46/EC in Denmark’ in Beyleveld et al (n 66) 60, 69.
109. See eg Peter Blume, Personregistrering (Akademisk, 3rd rev edn 1996) 151 regarding the Public Authorities’ Registers Act of 1978 (Lov nr 294 af 8 juni 1978 om offentlig myndigheders register) (repealed).
110. See too Peter Blume, Vurdering af personvernnemndas praksis 2001-2008 [Assessment of the Data Protection Tribunal’s Case Decisions] CompLex 3/09 (Senter for rettsinformatikk/Unipub, 2009) 17-18.
111. ALRC and AHEC (n 21).
112. ALRC and AHEC, Protection of Human Genetic Information, Discussion Paper 66 (ALRC, 2002).
113. ALRC and AHEC (n 21) [8.7]-[8.9];
114. ALRC and AHEC (n 79) [7.54].
115. Australian Government Attorney-General’s Department, ‘Government Response to Australian Law Reform Commission and Australian Health Ethics Committee Report: Essentially Yours: The Protection of Human Genetic Information in Australia’ (9 December 2005), www.alrc.gov.au/inquiries/title/alrc96/agd.htm. The definition of ‘sensitive information’ in the Act was amended, though, to expressly cover ‘genetic information about an individual’ (s 6(1)).
116. See Et bedre personvern [A Better Protection of Privacy], NOU [Norwegian Official Reports] 1997 no 19, 29 (describing ‘a sample of physical/biological material’ (‘en forekomst av et fysisk/biologisk materiale’)-exemplified in the form of a strand of hair (‘hårstrå')-as (i) ‘data that have not been subjected to a strong degree of formalisation’ (‘data som … ikke er undergitt noen sterk grad av formalisering’), (ii) an ‘information data carrier’ (‘informasjonsdatabærer’), and (iii) ‘data material’ (‘datamateriale’)).
117. See appeal decision in case 8/2002, www.personvernnemnda.no/vedtak/2002_8.htm.
118. The decision is also reproduced in Blume (n 77) 74.
119. ALRC and AHEC (n 21) [8.32].
120. Indeed, this would seem to be the approach taken in Germany: see Simitis (n 72).
121. Referenced at n 43.
122. Organization for Economic Cooperation and Development (OECD), Recommendation on Human Biobanks and Genetic Research Databases (adopted 22 October 2009) with accompanying guidelines, www.oecd.org/dataoecd/41/47/44054609.pdf.
123. Susan MC Gibbons and Jane Kaye, ‘Governing Genetic Databases: Collection, Storage and UseM’ (2007) 18 King’s Law Journal 203.
124. With respect to the Italian regime, see Elisa Stefanini, ‘The Need for Italian Biobank Regulation’ (2010) 7 SCRIPTed 71, www.law.ed.ac.uk/ahrc/script-ed/vol7-1/stefanini.asp.
125. Marit Halvorsen, Norsk biobankrett: Rettslig behandling av humant biologisk materiale [Norwegian Biobank Law: Legal Treatment of Human Biological Material] (Fagbokforlaget, 2006).
126. With respect to the Swedish regime, see eg Wolk (n 74);
127. Sweden, Ministry of Health and Social Affairs, 'Översyn av lagen (2002:297) om biobanker i hälso- och sjukvården mm’ [Study of Act (2002:297) on biobanks in health and medical treatment] (29 May 2008) Dir 2008:71, www.sou.gov.se/kommittedirektiv/2008/dir2008_71.pdf.
128. With respect to the Australian regime, see ALRC and AHEC (n 21);
129. Mark Stranger et al, ‘Human Genetic Databanks in Australia: Indications of Inconsistency and Confusion (2008) 27 New Genetics and Society 311.
130. See eg European Commission, First Report on the implementation of the Data Protection Directive (95/46/EC) (15 May 2003) COM (2003) 265 final, Brussels, http://ec.europa.eu/justice_home/fsj/privacy/lawreport/report_en.htm;
131. EU Agency for Fundamental Rights, Data Protection in the European Union: The Role of National Data Protection Authorities (Publications Office of the EU, 2010);
132. LRDP KANTOR Ltd and Centre for Public Reform, Comparative Study on Different Approaches to New Privacy Challenges, in Particular in the Light of Technological Developments: Final Report (20 January 2010), http://ec.europa.eu/justice_home/fsj/privacy/studies/index_en.htm;
133. Dag Wiese Schartum, ‘Designing and Formulating Data Protection LawsM’ (2010) 18 International Journal of Law and Information Technology 2 and references cited therein.
134. See eg Norway’s Personal Data Act § 28(5) (stating that ‘[i]f the document which contained the erased data gives a clearly misleading picture after the erasure, the entire document shall be erased’ (‘[h]vis dokumentet som inneholdt de slettede opplysningene gir et åpenbart misvisende bilde etter slettingen, skal hele dokumentet slettes’)).
135. See eg Directive 95/46/EC, Art 6(1)(d).
136. See eg ALRC and AHEC (n 21) [8.48]-[8.54] (particularly recommendation 8-4 advancing a qualified right of access in this context-a recommendation later rejected by the government).
137. See too Mette Hartlev, ‘Biobanker-Mellem Krop og Data’ [Biobanks-Between Body and Data] (2004) 14 Lov & Ret 11-13.
138. Alastair V Campbell, ‘The Ethical Challenges of Genetic Databases: Safeguarding Altruism and TrustM’ (2007) 18 King’s Law Journal 227, 229.
139. Lee A Bygrave and Dag Wiese Schartum, ‘Consent, Proportionality and Collective Power’ in Gutwirth et al (n 46) 157.
140. See eg Data Protection Directive, Art 8 (listing health data as a type of sensitive data subject to a more stringent consent regime than is the case for ordinary personal data).
141. See further Hartlev (n 75) 69-70;
142. Hartlev (n 95) 11-12;
143. Datatilsynets årsberetning 2002 [Annual Report 2002] (November 2003) 20-21.
144. For further general discussion of these sorts of challenges in structuring data protection law, see eg Schartum (n 91) 12ff;
145. Peter Blume, Databeskyttelsesret [Data Protection Law] (Jurist- og Økonomforbundets, 3rd rev edn 2008) 72-80.
146. Gibbons and Kaye (n 89) 204.
147. See too Stranger et al (n 90) (attributing part of the weakness in Australian biobank regulation to confusion and inconsistencies regarding terminology).
148. See further Lee A Bygrave, ‘Information Concepts in Law: Generic Dreams and Definitional Daylight’ (2011) 19 International Journal of Law and Information Technology (forthcoming).