Forstjóri Persónuverndar í viðtali við GenomeWeb

9.10.2018

Blaðamaður á vegum bandarísku vefsíðunnar GenomeWeb tók nýverið viðtal við Helgu Þórisdóttur, forstjóra Persónuverndar, en GenomeWeb er fréttavefur þar sem áhersla er lögð á vísindi og erfðafræði. Viðtalið er birt í frétt sem fjallar um vinnslu Íslenskrar erfðagreiningar ehf. á upplýsingum um þá sem bera BRCA2-erfðabreytuna, en hún hefur í för með sér aukna hættu á krabbameini.

Grein GenomeWeb er birt hér í heild sinni, með leyfi höfundar.

DeCode Begins BRCA2 Mutation Service in Iceland as Society Debates 'Right to Not Know'

Jul 09, 2018 | Justin Petrone

NEW YORK (GenomeWeb) – DeCode Genetics recently introduced a new service in Iceland that informs individuals whether or not they carry mutations in the BRCA2 gene that are known to increase cancer risk.

The company began offering the genotype data to Icelanders this spring, and recently began reporting back their results via an encrypted server, along with recommendations to those carrying harmful mutations to obtain genetic counseling.

DeCode's new offering is the latest turn in an ongoing controversy over whether or not people in the island country have a right to know if they are at increased risk for disease – without asking for that information. According to CEO Kári Stefánsson, the decision to make the data available to Icelanders stemmed from the company's to-date fruitless efforts to use its biorepository to reach people at risk.

In 2013, the firm, which is wholly owned by Amgen, together with partners submitted a proposal to the Icelandic Data Protection Authority (DPA), to process personal data for research purposes, with the aim of using the data to inform health services at Landspítali, the National University Hospital of Iceland. DeCode also aimed to impute the genotypes of the roughly 280,000 Icelanders who had not yet been genotyped by the company and link the data to their electronic health records.

The DPA declined that request, arguing that the people in question had never consented to having their data imputed. Later, DeCode obtained permission from the DPA to run the imputations internally in a way that the data would not be stored or accessible. More recently, the Icelandic  Ministry of Health organized a committee that would review DeCode's original concept of linking imputed genotypes with EHRs.

Ultimately, the committee issued an opinion against such a process on the basis that individuals had a right not to know if they were carrying a disease-causing mutation or not. But prior to issuing its opinion, Stefánsson resigned from the committee and decided on another approach.

"The day the committee issued its opinion, we put up a website," said Stefánsson during a recent site visit to DeCode's headquarters in Reykjavik. "Those who want to get the information and do it by their own initiative, can at least get the information on themselves."

DeCode's service reports back data related to the BRCA2 mutation. Agnar Helgason, head of anthropology at the firm, provided a demonstration of the online service. Icelanders interested in obtaining their BRCA mutation carrier status must use their personal identification number, called a kennitala in Icelandic, to register and access the service. Then they have to digitally sign an additional form to see their genotype.

"Everything we do is encrypted," noted Helgason. "It all goes through pseudo-anonymization, and we have two independent genotypes for each individual." If people who log in do not have a genotype in the system, they are invited to provide one to DeCode for free. "Ultimately, they get their result back and learn whether they are positive or negative, a carrier or a noncarrier," said Helgason. Those who are positive for the mutations are referred to genetic counselors at Landspítali.

Within the first 24 hours of offering the service, about 20,000 people signed up. Since then, roughly 5,000 have registered to receive their status. "My prediction was always that we would have relatively few people sign up on this website, and I am turning out to be right," said Stefánsson.

Iceland currently has a population of about 350,000 people, nearly half of whom are female. Stefánsson noted that women carrying the BRCA2 mutation have an 86 percent lifetime risk of developing a lethal cancer, but underscored that the mutation "confers very nasty diseases" to men as well. "Male carriers of this mutation have about 72 percent lifetime risk of a serious cancer, a 36 percent risk of prostate cancer, and they have a life expectancy that is on average seven years shorter than non-carriers," Stefánsson said.

As such, DeCode's approach of making BRCA2 mutation status available as a service only upon request is not reaching as many people as Stefánsson would like to see. "Ideally 200,000 people should sign up," he said. "This is a mutation that confers a risk of a disease to relatively young people," Stefánsson noted. "Young people walk around with the illusion of immortality, with bad things happening to others but not to them."

It is that dynamic — of potentially being able to save people's lives but not being legally able to do so — that has encouraged Stefánsson to continue to press his case of making BRCA2 data available to Icelanders via their EHRs, even without expressed consent.

"Some in Iceland have taken the view that the right not to know transcends the importance that you could save someone's life," said Stefánsson. "This interpretation of the Constitution and the law collides with the tradition in Iceland," he said. "You can just imagine yourself how likely it is that you would be able to find a woman in Iceland who has breast cancer on the basis of the BRCA2 mutation and is waiting for death to come," he added. "How likely do you think you would find a woman who would not have wanted to know this?"

Stefánsson argued that people might be able to take preventive measures if provided with such information. "Preventive mastectomy prevents the likelihood of breast cancer from 72 percent down to 5 percent," he said. "I think it is a merciless view to come to a conclusion that we should not approach these women."

'Huge questions'

According to Helga Þórisdóttir, data protection commissioner at the DPA, much of the debate surrounding DeCode's proposals and activities stems from current Icelandic law covering the purposes of health sector databases. In 1998, the country's parliament passed the Act on the Health Sector Database, which enabled the government to grant DeCode a license to create its biorepository and store information for research purposes.

Under the act, people were supposed to inform the Ministry of Health if they wished that their data not be held in the database. All of the data was to remain encrypted and unidentifiable, and remain untraceable to individuals. However, according to a 2003 Supreme Court of Justice of Iceland ruling concerning the health sector database, the Act on the Health Sector Database was found in breach of the requirements of the Icelandic constitution, because it did not provide adequate protection for personal privacy, such as against the risk of the data being traced back to the relevant individuals. In 2014, the parliament passed a new Act on Scientific Research in the Health Sector. Both laws covered the use of data for research purposes, but not for reporting back health data to individuals.

"The goal of the legislation was to understand better knowledge of health for the whole of society in regards to the health sector and scientific research," said Þórisdóttir. "DeCode has taken this to the individual level," she said. "Then we come to the right to know and the right not to know," she added. "The setup has been for the greater good of all, but if we are at the individual level, that raises new questions, because the legal framework has been set for the group, the nation, not the individual."

In this context, Þórisdóttir said it is up to Icelandic lawmakers to create the legal framework for DeCode to inform individuals of their health risk, even without consent, because, based on current Icelandic law, this cannot happen without the consent of the individual. At the same time, since there are no laws addressing the delivery of such data to consenting individuals, DeCode is free to offer its services. In terms of the ongoing debate over whether or not individuals should, at some point, have genetic data entered into their EHRs, Þórisdóttir said that the DPA has been arguing that "the right and will of the individual" has to be respected, and that "special considerations should be taken to maintain people's autonomy."

"These are huge questions," said Þórisdóttir. "Researchers have traditionally been occupied with new knowledge of diseases, they are not concentrated on individuals as such, and by informing people that they are genetically at risk, they are undoubtedly moving into the field of health services," she said. "There is a change, and that change has to be met by the lawmakers of our country." An email seeking comment from the Icelandic Ministry of Health was not returned.

In Stefánsson's view, DeCode's new service is both "automatically building pressure on health authorities" and helping to change attitudes in society toward approaching individuals about their genetic health risk. He cited a recent survey carried out in Læknablaðið, the Icelandic medical journal, that found that 97 percent of women asked were "positive or very positive" toward using existing genetic information obtained through scientific work to inform individuals of their mutation status. According to the same paper, roughly half of the respondents, who were women attending a cancer prevention clinic in Reykjavik, did express concern that a positive result might affect their health insurance.

"It's changing gradually," said Stefánsson. He expressed hope that lawmakers would eventually "move to the view that we should be approaching these women."