1. Page 1 Legal Framework for e-Research e-RESEARCH and PRIVACY 12 July 2007 David Ruschena Health Legal

2. Page 2 The political environment There will always be someone who opposes you Easily understood concepts are more powerful Perception is more important than reality Normalisation is essential All research exists at the public’s sufferance

3. Page 3 What privacy means to e-Research From the Researcher’s perspective 1.Higher research costs 2.Lost opportunity costs 3.Barriers to innovation 4.Less effective cooperation and education 5.Sub-optimal quality of data

4. Page 4 How (medical) researchers see themselves

5. Page 5 How the public sees (medical) researchers

6. Page 6 Nature of the dilemma Many people will not seek the health care they need if they believe that their information will not remain private. A single decision finding that there has been a intrusion on the privacy of the subject will have a chilling effect on e-Research generally.

7. Page 7 Relevant Legislation Privacy Act 1988 (Cth) Health Records and Information Privacy Act 2002 (Cth) Health Records Act 2001 (Cth) Personal Information Protection Act 2004 (Tas) Health Records (Privacy and Access) Act 1997 (ACT) Information Act 2002 (NT) Privacy and Personal Information 1998 (NSW) Information Privacy Act 2000 (Vic) Information Standard 42 on Information Privacy (SA) Section 135 AA National Health Act 1953 (Cth) Jurisdiction occurs where –Information that reasonably identifies an individual –Information is of a sensitive nature (health information)

8. Page 8 What duties are owed? –Collection with consent (or exceptions) –Use and Disclosure with consent (or exceptions) –Accuracy –Security –Transborder Data Flows

9. Page 9 How can e-Research proceed? Use non-identifiable / de-identified information Obtaining consent Use for a secondary purpose that is directly related and reasonably expected Relevant to public health plus hoops Relevant to health service management plus hoops

10. Page 10 De-identified Information Can the individual’s identity “is apparent, or can reasonably be ascertained”? By whom? With what additional data?

11. Page 11 Secondary purpose What types of secondary activities are reasonably expected? What scope of secondary activities is reasonably expected? Guidelines: reasonable expectations are “what a reasonable individual with no special knowledge of the health sector would expect to happen to their health information in the given circumstances.” Everything the public knows, it learnt on television.

12. Page 12 Obtaining consent Voluntarily provided Based upon adequate information (sufficient detail and specificity) Given by a person with sufficient capacity and in appropriate circumstances Obtaining consent in advance Consent to different aspects of the project Allocation of appropriate resources Opt out v opt in

13. Page 13 The hoops Inappropriate to use de-identified information Impracticable to seek consent of all individuals involved Collected in accordance with competent professional body Complies with Privacy Commissioner’s Guidelines Additional security if disclosed to another party

14. Page 14 The traps Impracticability is not determined by HREC NRHMC: “impracticable” means -it is impossible in practice to obtain consent; -obtaining consent is likely to cause unnecessary anxiety -obtaining consent would prejudice the scientific value of the research; and -public interest in the research substantially outweighs the public interest in privacy.

15. Page 15 What are your long term goals? Successful completion of individual research projects Successful publication of results of the research project Normalisation of eResearch Increased infrastructure to leverage existing results and expertise

16. Page 16 What are the best solutions? Understand which legislation applies to you and your project Understand the privacy concerns that people raise If consent can be obtained, it must be obtained Split up the matters to which the subject is consenting Publicise your results to the community and to the subjects Sell eResearch as far and as wide as possible Be modest when developing databases