1. Ethical, legal and social aspects of public health genomics Mark Taylor, School of Law, University of Sheffield 7 th November 2014

2. Disclosure of Genetic Data for Public Health Purposes Focus on identifiable genetic data (not tissue) and disclosure of patient data for further public health (secondary/ indirect care) use. Key point: identifiable genetic data can be disclosed by HCP for public health purposes lawfully (and ethically) – but different safeguards/ conditions apply to alternate legal bases – need to be clear on which is the most appropriate basis: which are the appropriate safeguards – Consent – Public Interest – Statutory Basis e.g. Health Service (Control of Patient Information) Regulations 2002. Specific Points: 1.Identifiability needs to be understood in context 2.Limits of consent when data disclosed for public health purpose - Consultation as an alternative? 3.Importance of public confidence in alternative legal basis - if consent is not to be relied upon, then need to be clear on whether disclosure is “in the public interest” and/or e.g. on the basis of regulation 3 or 5 of the 2002 Regs.

3. 3

4. Identifiable Anonymous Safe Haven When is genetic data identifiable? “Personal data” means data which relate to a living individual who can be identified— (a)from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, … [DPA 98] Identifiability is a product of both data content and context XY

5. Identifiable Anonymous Safe Haven When is genetic data identifiable? “Personal data” means data which relate to a living individual who can be identified— (a)from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, … [DPA 98] To determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person [Recital 26, 95/46/EC] To determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person [Recital 26, 95/46/EC]

6. Identifiable Anonymous DEID4LA Safe Haven When is genetic data identifiable?

7. Identifiable Anonymous DEID4LA Safe Haven Disclosure of Genetic Data: DEID4LA Legal Basis? Controlled Query Data Stewardship & Contractual Arrangments Safe Haven

8. Identifiable Anonymous DEID4LA Safe Haven Disclosure of Genetic Data: Non identifiable Publication Controlled Query Data Stewardship & Contractual Arrangments Safe Haven

9. Identifiable Anonymous DEID4LA Disclosure of Genetic Data: Identifiable Legal Basis? Safe Haven Publication Controlled Query Data Stewardship & Contractual Arrangments Safe Haven

10. Disclosure of Genetic Data: Consent Identifiable Anonymous DEID4LA Consent Impracticability? Requirements of DPA 98 / EU Law Need for any consent to be specific Alt. under Sch. 2 & 3 Consultation as an alternative? “To be valid, consent must be specific. In other words, blanket consent without specifying the exact purpose of the processing is not acceptable.” (Art 29 WP, Opinion 15/2011 on Consent, WP187) "Specific" consent must relate to a well-defined, concrete situation in which the processing of medical data is envisaged. Therefore a "general agreement" of the data subject - e.g. to the collection of his medical data for an EHR and to any future transfers of these medical data to health professionals involved in treatment - would not constitute consent in the terms of Article 2(h) of the Directive” (Art 29 WP, Working Document, WP131) the data subject’s consent shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed [Directive 96/56/EC]

11. Disclosure of Genetic Data: Public Interest Identifiable Anonymous Public Interest DEID4LA Consent Public Interest is a lawful basis of disclosure under Sch.2 and Medical Purposes under Sch.3 When considering common law duty of confidence there is a need to establish a lawful basis other than consent e.g. public interest.… in accordance with the law, necessary and proportionate … Where is the tipping point between public interest in confidential health service and public interest in disclosure for public health purposes? Distinction between health protection and health improvement? Where is the tipping point between public interest in confidential health service and public interest in disclosure for public health purposes? Distinction between health protection and health improvement?

12. Disclosure of Genetic Data: Statutory Basis Identifiable Anonymous Public Interest DEID4LA e.g. approved persons and purpose under COPI Regulations (1438/2002).… in accordance with the law, necessary and proportionate … Statutory BasisConsent Health Service Control of Patient Information Regulation 2002 No practicable alternative Fair Processing (& other DPA requirements) But Regulation 3 or 5?

13. Disclosure of Genetic Data: Statutory Basis Identifiable Anonymous Public Interest DEID4LA e.g. approved persons and purpose under 2002 COPI Regulations.… in accordance with the law, necessary and proportionate … Statutory BasisConsent Health Service Control of Patient Information Regulation 2002 No practicable alternative Fair Processing (& other DPA requirements) Regulation 3 or 5 Regulation 3 Purpose? (1)(a) diagnosing communicable diseases and other risks to public health; (b) recognising trends in such diseases and risks; (c) controlling and preventing the spread of such diseases and risks. … etc. Recipient? (a)... (b) persons employed or engaged for the purposes of the health service; (c) other persons employed or engaged by a Government Department or other public authority in communicable disease surveillance. Case by Case Approval? No. Not unless there is to be reliance upon 3(4) Regulation 5 Purpose? Medical purposes: “preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of health and social care services” (Section 251 NHS Act 2006) Recipient? Any body approved to conduct the processing by the decision maker. Case by Case Approval? Yes. Case by case approval decision following advice by Advisory Group

14. Disclosure of Genetic Data Identifiable Anonymous Public Interest DEID4LA Controlled Query Publication Safe Haven e.g. approved persons and purpose under 2002 COPI Regulations.… in accordance with the law, necessary and proportionate … Statutory Basis Data Stewardship & Contractual Arrangments Consent

15. Disclosure of Genetic Data for Public Health Purposes Focus on identifiable genetic data (not tissue) and disclosure for further public health (secondary/ indirect care) use Key point: identifiable genetic data, about patients, can be disclosed for public health purposes lawfully (and ethically) – but different safeguards/ conditions apply to alternate legal basis – need to be clear on which are the most appropriate basis: which are the appropriate safeguards. – Consent – Public Interest – Statutory Basis e.g. Health Service (Control of Patient Information) Regulations 2002 Specific Points: 1.Identifiability needs to be understood in context 2.Limits of consent when data disclosed for public health purpose - Consultation as an alternative? 3.Importance of public confidence in alternative legal basis - if consent is not to be relied upon, then need to be clear on whether disclosure is “in the public interest” and/or e.g. on the basis of regulation 3 or 5 of the 2002 Regs.