on privacy aspects of recreational genomics, an emerging industry in which consumers gift or sell genomic data to find an association with ancestors or identify supposed susceptibility to genetic disorders. Salient privacy concerns include gifting of data that encompasses biological relatives and the use by law enforcement agencies of large-scale private sector genomic databases.The article reflects past work by Associate Professor Wendy Bonython and the author, for example 'Privacy, personhood, and property in the age of genomics' (2015) 4(3) Laws 377, 'Sharing the book of life: privacy, the new genomics and health sector managers' in (2015) 12(4) Privacy Law Bulletin 103, 'Australian reforms enabling disclosure of genetic information to genetic relatives by health practitioners' in (2014) 21(4) Journal of Law and Medicine 810, and 'Direct to consumer genetic testing and the libertarian right to test' in (2017) Journal of Medical Ethics.
It notes -
May 2018 saw practitioner and media coverage of the Australian Health Department’s belated announcement regarding arrangements for people to opt out of aspects of the national My Health Record (MyHR) medical data scheme. Outside of the tabloids, there was less coverage of an incident in the US involving what has been variously dubbed recreational genomics or direct-to-consumer genetic testing. In that incident, law enforcement personnel accessed a large-scale private sector genomic database in order to target the identity of a serial killer. This article offers an introduction to recreational genomics and highlights privacy issues for Australian legal practitioners and consumers. ...The article concludes
From a privacy perspective, the salience of recreational genomics lies in biological relationships. There is some commonality between biological relatives; your genetic profile for example has much of the same genomic data as that of your biological parents, siblings and offspring. You might accordingly be identified with varying degrees of precision using data that relates to those relatives. That identification might allow inferences about your appearance or your susceptibility to particular disorders, irrespective of whether those disorders have become manifest and irrespective of whether you wish to privately acknowledge or publicly disclose them.
Research over the past decade has accordingly highlighted a range of questions for legal practitioners, ethicists and policymakers. One question is the accuracy of the testing, with for example claims that the quality of processing in some Eastern European facilities is egregiously low and that some services verge on being fraudulent. There has not been significant action by consumer protection agencies at the national level or by disgruntled customers, perhaps because there wasn’t major reliance on the tests or because consumers were unaware that consumer law offered a meaningful remedy.
It is important to recognise that dominant service providers offer different tests and may well provide a specific consumer with somewhat different results. Regulators have expressed concern about what might be considered to be diagnostic services outside a conventional regulatory framework that encompass registration and supervision of health service providers alongside certification of clinicians and adherence to formal research codes. There is no global Genomic Data Right, unsurprising for example given the late establishment in the finance/utilities sector of the Consumer Data Right announced in Australia in May 2018. There is disagreement about genetic discrimination frameworks. Calls for a global Genomic Privacy Convention (akin to the European General Data Protection Regulation discussed in recent issues of this Bulletin) have gained little traction and are often opposed as contrary to the achievement of social goods through advancement of health research.
A convention is of interest because the Australian Constitution is silent about privacy and makes no mention of the genome. The Commonwealth under its external affairs, posts and customs heads of power has scope to shape consumption of recreational genomic services. Its emphasis for the moment appears to be investment in genomics research (notably the $500 million Australian Genomics Health Futures Mission announced in May this year, similar to larger initiatives in the UK and the US) and public education campaigns. The effectiveness of education is uncertain, given the respect we owe to life science researchers and the willingness of leading geneticists to share their genomic samples.
Education is significant because unconsidered sharing of genomic data is not caring but is not actionable. Put simply, there is no restriction on a relative gifting or selling a sample — a skin scraping, blood or saliva — from their own body to a genomic service provider. It is their property, not yours, even though it might offer a view of you, potentially a view contrary to your values about disclosure. It can be converted into data that is an asset of a corporation and over which neither the consumer nor you have much control outside the typically expansive terms and conditions used by the service provider to limit corporate liability and assert corporate rights.
Such unilateral sharing without your authorisation and indeed without your knowledge, given that there is no requirement to alert you that a biological relative has participated in a recreational genomic program, is potentially significant because recreational genomic services are currently based overseas. Australian consumers are perforce reliant on an understanding of contractual provisions regarding the sale/gifting of samples (inef- fective if your client was not the individual providing that sample), trust that the service will meet contractual obligations and remain in a position to meet obligations (are all bets off if the service is liquidated or its trove of data is acquired?), and hope that overseas regulators such as the US Food and Drug Administration or Federal Trade Commission have both the power and interest in policing inadequate practice. The increasing body of knowledge about the feasibility of re-identification of what was claimed to be adequately anonymised health data should pose cautions, as should controversy over initiatives such as the UK care.data program.
Locally it’s unclear whether the Office of the Australian Information Commissioner has the technical skills and the willingness to look beyond traditional stakeholders, in essence its regulatory capture by medical research- ers that is sufficient to offset indifference on the part of the Therapeutic Goods Administration and the impera- tives that drive the National Health and Medical Research Council.
There is value in the emergence of an Australian direct-to-consumer genomic service sector, one that is globally competitive on the basis that it both embodies technical best practice (in contrast for example to past services in the former Soviet bloc) and recognises concerns regarding genomic privacy. There is no simple solution that will effectively address tensions regarding access to bulk/individual data, meaningful consent by those people who sell/gift samples, and respect for the dignity in terms of autonomy of those people who will be tacitly mapped through the action of their relatives. It is difficult for example to conceptualise a right to genomic obscurity outside action by governments to require both de-identification of genomic data about yourself and family members and enforcement of stronger standards to significantly inhibit data breach.
A starting point for engagement by leading law firms with such questions and shaping of practice frameworks for the coming biotech century is a recognition that genomic data is special: the book of life is more valuable and less tractable than the book of telephone numbers or the electronic folders of bank account details that were apparently misplaced by the Commonwealth Bank two years ago.