Questionnaire concerning the Revised Outline of the International Declaration on Human Genetic Data

Re: Questionnaire concerning the Revised Outline of the International Declaration on Human Genetic Data

On 25 February 2003, The Privacy and Data Protection Authority in Iceland (PDPA) received a letter, dated January 31, from the International Bioethics Committee (UNESCO), wherein the PDPA was asked to answer a questionnaire on the Revised Outline of the International Declaration on Human Genetic Data.

Please find below, for your convenience, the questionnaire, with the Authority's relevant answers interjected after each question.

I. Aims and Scope of the International Declaration on Human Genetic Data

I.1 In your opinion, what should be the aims of a declaration on human genetic data at the level of international law? Do such aims correspond to those put forward in the Revised Outline?

As with any legal instrument that deals with human rights at an international level, the aims of this declaration should primarily be to present a consensus on what the minimum requirements should be for the processing of this type of personal data. Furthermore, the aim of the declaration should be to establish a baseline from which guidance can be drawn, when the processing of human genetic data will be regulated at the national level. In addition, the declaration should aim to further the debate on such processing, by presenting its provisions in a clear and conscious manner. Finally yet importantly, an international declaration on human genetic data should serve to strengthen the rights of the data subject, while facilitating acceptable use of such data for the betterment of humankind.
The Authority finds that the Revised Outline, in conjunction with the founding Universal Declaration on the Human Genome and Human Rights, sufficiently meets these aims.

I.2 Are the fields of application of the international declaration explicit in the Revised Outline? If not, should mention be made, for example, that the declaration also covers proteomic data that are generated by genetic data?

Although neither the Préamble nor the Operative part of the Revised Outline contain explicit references to the Declaration's fields of application, the Authority finds that when read with the supplementary Brief Presentation, the Revised Outline can be said to contain adequate outlining of the Declaration's fields of application.
No natural correlation exists between proteomic data derived from genetic data and the possibility of identification of natural persons from that particular type of proteomic data. In other words, proteomic data can be 'generated' by genetic data and still prove inherently unusable for personal identification, and other types of proteomic data can qualify as personal data without being 'generated' by genetic data. Therefore, the Authority is unconvinced that a statement, to the effect that proteomic data "that are generated by genetic data" are covered by the declaration, would have any merit. The Authority finds this purpose already being served with the addition of the phrase "as well as to data that are derived there from" at the end of Article 1.

I.3 Should the declaration be accompanied by an explanatory memorandum with an article-by-article commentary?

Explanatory memorandum of international legal instruments can arguably complicate the interpretation of specific provisions in some instances, e.g. when the memorandum presents an interpretation upon which consensus has not been reached. In addition, the compilation of such a document can be a cause of contention, especially where difficult compromises have been struck in the construction of the legal instrument in question. However, the Authority is of the opinion that any such extra material, serving to enrich the understanding of the Declaration, is both welcome and preferred. It would therefore like to voice its opinion in favor of the composition, and inclusion, of an explanatory memorandum.

II. Préamble

II.1 In your opinion, does the Preamble define the specificity of human genetic data?

The Authority finds that the Préamble illustrates sufficiently the specificity of human genetic data.

II.2 Should there be other elements of assessment to highlight the importance of human genetic data?
The importance of human genetic data is, in the opinion of the Authority, sufficiently highlighted in the Préamble of the current version of the Outline (SHS/EST/02/CIB-9/3 (Rev.1)), as amended from the version of 28 October 2002 (SHS/EST/02/CIB-9/3). In this respect, the Authority especially welcomes the changes made to the 7th paragraph of the Préamble, stating clearly that the collection, processing, use and storage of human genetic data not only may hold, but do have potential risks for the exercise and observance of human rights and fundamental freedoms, and respect for human dignity.

III. General Provisions (Articles 1 to 6)

III.1 Is the definition of "human genetic data" satisfactory to you?

The Authority recognizes the difficulties of framing this concept. These difficulties arise mainly from the fact that a legal instrument, such as that which this draft declaration is to become, needs a clear scope and a well-defined subject. This particular Outline deals with a unique kind of personal data. One which can be extremely revealing, not only regarding the personal characteristics of the data subject, but also his future potential and that of his relatives.
Using the concept "human genetic data" to encompass this type of data is admittedly not a perfect solution. On the one hand, not all data derived from genes have the above-mentioned unique features that other genetic data possess. Genetic data can in some instances, e.g. genetic data relating only to a group of individuals, not even qualify as personal data, i.e. where it does not relate to a specific, personally identifiable individual, even if the data is formally "genetic" in nature. On the other hand, the concept "human genetic data" can in some instances prove too narrow to encompass data types that have all the distinguishing properties and potential risks associated with them. For example, various physiological data can yield indications of an individual's potential and limitations, as well as those of his relatives, without that data being comfortably categorized as "genetic" data, even in a broad sense.
Despite these shortcomings, which are related to the concept in itself, not to its definition in the Revised Outline, the alternatives for an encompassing concept of these data types are few and unattractive. Concepts such as "lineage data" may be broad enough capture one part of the data type's characteristics better, but is at the same time not specific enough to point the finger at the data source, i.e. the physical substance carrying inheritable attributes between generations. On top of that, the scope of the concept "lineage data" is generally thought of as being limited to data on the family relations between people. Another solution would be to define a new concept for the purposes of the declaration, for example "inheritance data". The main drawback to such an enterprise would be the overwhelming difficulties associated with gaining acceptance for the new concept, thus overshadowing the real purpose of the exercise.
Therefore, we are left with using the concept "human genetic data". It has, as mentioned before, several drawbacks for the stated purposes, which must be overcome by defining it in a specific manner, which does not necessarily conform with the concept's general use in the language, in natural sciences or in the field of genealogy. Therefore, this is the method used in Article 1 of the Revised outline. The definition there is short, but concise. The Authority finds this definition satisfactory.

III.2 Should the international declaration also deal with human biological samples that serve to produce human genetic data?

The treatment of human biological samples has an array of issues relating to it, which are of great importance to the preservation of human rights, dignity, and freedoms. Although being of the utmost importance, these issues should perhaps be dealt with elsewhere than in a declaration that aims to deal with the specific nature of human genetic data. Otherwise, the work may lose focus and the results become less than succinct, since the nature of the challenges posed by the processing of human genetic data, and the treatment of human biological samples, do not overlap except to a limited degree. Therefore, the Authority suggests that the declaration's scope be kept clearly on the type of personal data in question, and not be diluted by seeking to deal with issues relating to the physical source of the data, i.e. to human biological samples.

III.3 Does the international declaration sufficiently highlight the complexity of a person's identity which should not be reduced to his or her genetic characteristics?

The Authority finds that the Revised Outline, in particular the provisions of Article 3, illustrates sufficiently, to the extent necessary, the unique nature of the data type in question. Further, it finds that the Revised Outline as a whole manages to stress adequately the importance of not reducing an individual's identity to the components of his or her genetic makeup, or to the sum thereof.

III.4 Are the purposes for the collection, processing, use and storage of human genetic data sufficiently explained?

The Authority appreciates the challenging task of articulating what purposes can be considered acceptable for the processing, including collection, usage and storage, of human genetic data. However, the reference, in Article 4 in fine, to "any other purposes consistent with the Universal Declaration on the Human Genome and Human Rights and international human rights law" must be said to be quite vague and therefore ill suited as a guiding light for defining what purposes can be considered acceptable, and which can not. Therefore, the Authority suggests that further efforts be made to define what independent, acceptable purposes, if any, can be derived from the quoted international legal instrument, in addition to the purposes outlined in the first part of Article 4 of the Revised Outline.

IV. Collection (Articles 7 to 11)

IV.1 In this section, emphasis is placed on consent. Do you feel that this issue is adequately dealt with?

The Authority considers the issue of consent as being adequately dealt with in Chapter B, i.e. Articles 7 through 11, of the Revised Outline. However, it may be observed that requiring a fully informed consent may not be fully practical in various applications of human genetic data processing, especially where the proposed processing is complicated and deals with issues or utilizes technologies or methods which are foreign to the bulk of the data subjects. In such instances, an enlightened, but more open consent may yield a more plausible results than a consent which adheres fully to the stringent criteria of an informed consent, as they are put forth in the World Medical Association's Declaration of Helsinki, i.e. the Ethical Principles for Medical Research Involving Human Subjects from 1964, with subsequent amendments.
Regarding individual provisions of this chapter of the Revised Outline, the Authority finds that the qualifying "time limits", required under Article 8, should not be made into a requirements, especially since many types of human genetic data processing are not vulnerable to even a moderate exercise of the subjects' right to withdraw. Thus it is suggested that the curbing of this right, if necessary, be not made in such a broad manner, as by stipulating a mandatory expiration date of the data subject's right to withdraw his or her consent.

IV.2 Do you feel that genetic counseling is adequately taken into account in the Revised Outline?

Article 10 could, in the Authority's view, benefit from a short explanation or definition of what constitutes "genetic counseling". Does it entail a detailed explanation of all the choices involved for the data subject, and assistance in evaluating them? Or is such counseling limited to rudimentary information on how the data processing is to take place?

V. Processing (Articles 12 to 15)

V.1 In this section, emphasis is placed on the confidentiality of human genetic data with respect to third parties. Do you feel that the Revised Outline provides for adequate protection?

Chapter C, or other parts of the Revised Outline, can hardly be said to provide for any specific measures of protection, adequate or not, of the confidentiality of human genetic data with respect to third parties. Article 13, Paragraph a), merely dictates that confidentiality be guaranteed, without references to the methods of protection that are to be used to reach that goal. However, provisions stipulating specific methods to provide such "adequate protection" are arguably not appropriate in a high-level document, as the Revised Outline is. A requirement stating that necessary actions should be taken to provide such "adequate protection" would on the other hand, in the Authority's opinion, be fitting in such a document.

V.2 Should it be specified that confidentiality with respect to third parties concerns, in particular, employers, insurance companies and educational institutions? If so, do you feel that other bodies should be specified?

Due to how broad the potential application of genetic data is expected to become, the Authority is of the opinion, much on the same grounds as discussed in V.1, that putting special emphasis on a few types of data controllers, such as employers, insurance companies and educational institutions, would not serve the stated purpose of the Revised Outline. The Authority considers the text, as it stands, to be unambiguous and that it would not benefit from such anecdotal explanations.

VI. Use (Articles 16 to 20)

VI.1 In this section, the Revised Outline sets forth the principles that should guide free circulation of human genetic data under conditions guaranteeing the respect of human dignity and protection of human rights and freedom. Do you feel that this balance has been achieved?

The Authority hereby expresses its concerns regarding the latter provisions of Article 17. The unrestricted exemption from the requirement of a "free, informed and express" consent by the data subject, in cases where the data has "significance for medical and other scientific research or public health purposes", lacks sufficient justification.
First, the qualification of the data having "significance" for the declared purposes is, in the opinion of the Authority, unacceptably broad and vague.
Second, the Authority finds no reason not to insist that the data subject's consent be required, barring insurmountable difficulties in posing the request for such consent to the data subject. The draw of the qualities of a particular set of genetic data should never be allowed to override the duty to seek consent, of the person in question, for conducting the proposed processing.
Finally, the Authority finds the in fine provision of Article 17 to be too vague, and ripe for misinterpretation. Therefore, it is hereby suggested that the provision be changed in the following manner, for the sake of clarity and to avoid any misunderstanding: "Such data shall then be made irretrievably unlinked to an identifiable person, before being processed in any way."

VI.2 Do you believe that the Revised Outline adequately covers the issue of the sharing of benefits resulting from the use of human genetic data?

Yes.

VII. Storage (Articles 21 to 23)

VII.1 Do you think it is necessary for each country to set up a monitoring and management system of human genetic data?

The Authority remains unconvinced that a centralized monitoring and management system of human genetic data is likely to increase the privacy of the data subject, the security of genetic data, the exercise and observance of human rights and fundamental freedoms, or the respect for human dignity.

VII.2 Do you think that the Revised Outline adequately covers the dangers of inappropriate storage and cross-linking of human genetic data?

The provisions dealing with cross-linking, of already stored human genetic data, are found in Article 23 of the Revised Outline. These provisions cannot be said to cover what the dangers, of inappropriate storage and cross-linking, are. They merely set limits to the cross-linking of data that have been collected for different purposes. The Authority finds that neither the Revised Outline nor the accompanying Brief Presentation illustrates the types of dangers in question.
Moreover, the Authority's position on cross-linking of genetic data, whether collected for the same purpose or not, is that such processing should not be allowed to take place in cases where it is possible to seek the consent of the data subject for the cross-linking, but such consent has not been obtained.

VIII. Promotion and Implementation (Articles 24 to 27)

VIII.1 Do you feel that provisions other than those foreseen in the Revised Outline could contribute to the promotion and the implementation of the international declaration?

The Authority finds the provisions of Chapter F adequate for the purposes of promotion and implementation of the International Declaration on Human Genetic Data.

IX. Other comments
In conclusion, the Authority would like to thank the International Bioethics Committee, and in particular its Drafting Group, for the effort that has been put into this project, and to offer its congratulations on the preliminary results that are presented in the Revised Outline.

Yours sincerely
Sigrún Jóhannesdóttir
Data Protection Commissioner