An analysis of the Icelandic Supreme Court judgement on the Health Sector Database Act
Dr Renate Gertz*
|
Table of Contents: 1. Introduction 2. An outline of the Icelandic Health Sector Database 3. Background of the judgement of the Icelandic Supreme Court 4. The main aspects of the judgement 4.1. Legal standing 4.2. The consent issue 4.3. Data protection issues 4.3.1. The one-way encryption system 4.3.2. Identifiability due to richness of data 4.4. Open queries into the database 4.5. Monitoring of the Health Sector Database 5. Conclusion 5.1. Consent Issue 5.2. Data Protection 5.3. Lack of independent review mechanism 5.4. An international perspective |
||||||
Cite as: R Gertz, "An analysis of the Icelandic Supreme Court judgement on
the Health Sector Database Act ", (2004) 1:2 SCRIPT-ed 241, @: <http://www.law.ed.ac.uk/ahrc/script-ed/issue2/iceland.asp>
|
||||||
|
©
Renate Gertz 2004. This work is licensed through
SCRIPT-ed Open Licence (SOL).
Please click on the link to read the terms and conditions. |
||||||
1. Introduction
November
27, 2003 was a triumphant day for the opponents of the Icelandic
Health Sector Database project. The legislation passed by the
Icelandic government not for the benefit of scientists in general,
but for one specific commercial company and enabling deCODE Genetics,
a firm registered in the USA and based in Iceland, to set up a
database consisting of the medical and genealogical records of the
entire Icelandic population, living and dead, as well as tissue
samples of every living Icelander, was considered unconstitutional by
the Icelandic Supreme Court.1
This decision could be of considerable international importance,
taking into account the fact that genetic databanks are being
established in many countries. The Icelandic court decision shows
clearly that there are limits as to how far genetic research can
intrude into the private lives of participants and how far the
government can pass legislation on the scientists’ behalf. This
article provides an analysis of the decision reached by the Icelandic
Supreme Court and determines which of the concerns about the Health
Sector Database from various quarters have been addressed by the
judgement and which remain unresolved.
2. An outline of the Icelandic Health Sector Database
The
history and development of the Icelandic Health Sector Database has
been much publicised with a multitude of articles written both in
favour of, and in opposition to, the project.2
Still, it is important to begin with a short outline of the
development of the Health Sector Database from the original idea
until the present day to depict the situation on which the Icelandic
Supreme Court judgement is based.
In
1996, the biomedical company deCODE Genetics was founded in Delaware,
USA by Dr Kari Stefánsson and Dr Jeffrey Gulcher. At the end
of 1997, Stefánsson submitted the idea of a genebank to the
Icelandic Minister of Health and convinced him of the feasibility and
success of such a project. The idea was to utilise the already
existing medical and genealogical records of all Icelanders and
combine this information with the genetic information gained from
tissue samples of the entire population. In effect, this would result
in three different databases that could, and would, be linked as well
as operate separately: a genealogical database, a genetic one and one
consisting of all past, present and future medical records from the
entire Icelandic population, both living and dead.3
The reason given for performing the study in Iceland was the relative
genetic homogeneity of the Icelandic population,4
an issue contested by some scientists as being basically wrong.5
Stefánsson drafted and submitted a bill for an enabling piece
of legislation. On 31 March, 1998, the Icelandic Minister of Health
introduced this first draft bill to the parliament. Finally, after
several changes to the bill, the Health Sector Database Act was
passed by the Icelandic parliament on 17 December, 1998.6
In October 1998, as an opposition to the Icelandic genebank, the
organisation Mannvernd was established, consisting of Icelandic
physicians and scientists.7
In
2000, an exclusive licence to commercial exploitation of the genetic
database for 12 years with the possibility of renewal was granted to
deCODE to construct the Health Sector Database (HSD) and develop the
necessary informatics technology.8
As early as 1998, deCODE entered into non-exclusive arrangement with
Hoffmann-LaRoche for a duration of 5 years with regard to genetic
research and drug development.9
In 2002, a new agreement was enacted between deCODE and
Hoffmann-LaRoche whereby deCODE agreed to provide Hoffmann-LaRoche
with blood samples from the Icelandic project.10
Based
on the fact that the Icelandic population was deemed to be
genetically homogenous to a considerable degree as well as easily
manageable - taking into account that the population numbers around
288,000 – the Health Sector Database Act provided for the
entire population to be encompassed in the genebank. The medical and
genealogical records of all citizens were to be used as the
foundation for the health sector database. The records were to be
obtained from medical practitioners and hospitals and consequently
digitalised. Presumed consent was deemed sufficient for these two
databases. However, Icelandic citizens could opt out of the medical
records database. To do so, they were required to fill in a special
form, available in health clinics. On 27 August, 2001, an agreement
was executed between deCODE, the Icelandic Medical Association and
the Director General of Public Health. In this agreement, deCODE
agreed that citizens could have their data removed from this database
after they had been collected if they filled in and submitted the
opting out form.11
Part of the agreement was for the Icelandic Medical Association to
drop its opposition to the database project.
Informed
consent was to be required for the genetic samples that were to be
taken from the entire Icelandic population. However, in May 2000, the
Icelandic Biobanks Act was adopted, a piece of legislation that could
enable deCODE to negotiate access to clinical samples collected or
archived at various institutions. This access would be without
express consent of the original donors.12
If deCODE followed up on this, the company’s assurance to
secure informed consent from citizens donating samples would not be
adhered to. 13
In
an article published in 2000, Stefánsson and Gulcher of deCODE
explain the consent and encryption process. According to this
article, all participants in the databases were going to remain
anonymous, made feasible through one-way encryption.14
The paper medical records were to be encoded, converting social
security numbers to an alphabet-derived character string.15
From this list the opt-outs would then be removed and the list would
be delivered to the laboratory. The government’s Personal Data
Protection Authority would encrypt the remaining data for use in the
final database.16
Once donors had given their consent, blood would then be taken and
stored in containers labelled with a barcode sticker with a number
acting as a temporary coded identifier so that the blood sample could
be matched with the data regarding the donor already collected from
the medical and genealogical records. The final link was then encoded
again and sent to the laboratory on a sealed computer disk together
with the blood samples.17
At this
time, the Health Sector Database has not yet been initialised; none
of the medical records have yet been transferred. In fact, several
physicians have stated their intention of refusing outright to hand
over any medical records of their patients. Since deCODE Genetics has
to contract with each physician and hospital to obtain the records,
no estimate can be given as to when the database might become
operational.
3. Background of the judgement of
the Icelandic Supreme Court
As already
touched upon briefly above, one of the disputed aspects of the Health
Sector Database Act was the fact that the medical records of deceased
Icelanders were to be included in the database without the
possibility for relatives to demand the opting out clause for the
deceased. On 30 April, 2001, Birna Þórðardóttir
filed a suit before the Reykjavik District Court against the Director
General of Public Health on behalf of her daughter, Ragnhildur
Guðmundsdóttir, a minor. The claim was for annulment of an
administrative decision made by the defendant on 16 February, 2000,
rejecting the plaintiff’s request not to transfer the medical
records of the plaintiff’s deceased father to the Health Sector
Database pursuant to Act No. 139/1998, the Health Sector Database
Act. On 31 October, 2001, the Reykjavik District Court dismissed the
case on the grounds that the data were not personally identifiable
and that the plaintiff had no standing in the case. That same day,
the plaintiff appealed to the Icelandic Supreme Court, who instructed
the lower court to take the case for material hearing. On 13
February, 2002, the Reykjavic District Court denied the plaintiff’s
request to allow expert witnesses in the field of computer science to
be heard. On 3 March, 2003, the Reykjavik District Court ruled that
the defendant was not guilty of the charges brought by the plaintiff.
On 29 April, 2003, the appellant, Birna Þórðardóttir
on behalf of Ragnhildur Guðmundsdóttir, referred the case
to the Icelandic Supreme Court.
The
Icelandic Supreme Court made the following adjudication:
“The
decision of the Medical Director of Health to deny the request of
Ragnhildur Guðmunddóttir, dated 16 February 2000, that
information from the medical records of Guðmundur Ingólfsson,
who died on 12 August 1991, should not be entered into the Health
Sector Database, is reversed. The right of the Appellant to prohibit
the transfer of this information into the database is upheld.
The
Defendant, the State of Iceland, shall pay to the Appellant a total
of ISK 1,500,000 in costs before the District Court and the Supreme
Court.”18
4. The main aspects of the judgement
The
judgement of the Icelandic Supreme Court dated 27 November, 2003 can
be divided into several main aspects.
4.1. Legal standing
The
first item analysed by the Icelandic Supreme Court was that which had
led to the original dismissal of the case by the Reykjavik District
Court. While the lower court had based its decision on the finding
that the plaintiff had no legal standing, the Icelandic Supreme Court
followed a different reasoning, granting legal standing to the
appellant. The Supreme Court based its decision on the appellant’s
right to privacy, stating that information about the plaintiff
herself could be inferred from the data related to hereditary
characteristics of her father and that these data could apply to
herself.19
This provided the appellant with legal standing and a personal
interest in preventing the integration of her deceased father’s
medical records into the Health Sector Database.
The
question of a person’s legal standing and personal interest
when attempting to refuse the inclusion of a deceased relative’s
medical data could be seen as a feature which is specific to the
Icelandic database. From an international perspective, the Icelandic
Health Sector Database Act is the only piece of legislation that
expressly provides for the medical data of deceased individuals to be
transferred into a database with no provision for opting out,
irrespective of the wishes of the relatives. The Estonian Genome
Project, for example, requests that citizens fill in a questionnaire
which includes genealogical questions, also containing information
about deceased relatives and the respective causes of death. However,
before filling in these questionnaires, Estonians are provided with
detailed information about the questionnaire and what it will be used
for. Accordingly, taken from this perspective, the legal standing
aspect of the Icelandic Supreme Court’s judgement is the one
with the least international significance.
However,
it depends very much on the characterisation of the circumstances and
the definition of ‘personal data’ whether the Icelandic
situation can be seen as unique in this way. The European Data
Protection Directive 95/46 provides a definition for ‘personal
data’. Accordingly, ‘personal data’ encompasses
information that relates to one identified or identifiable person.
Identifiable in this respect means that the person can be identified
through a list of means, namely by reference to an identification
number or to factors specific to the person’s physical,
physiological, mental, economic, cultural or social identity. 20
However, if ‘personal data’ are considered to be ones own
data by virtue of ones blood relationship with a deceased person,
‘personal data’ encompass a much wider meaning than set
out in Directive 95/46/EC. If such a broad meaning were to be
considered, the entire data protection legislation would have to be
rethought. The Data Protection Directive and associated laws would
potentially be under threat. The way in which the Icelandic Supreme
Court reached the decision to grant legal standing to the appellant
follows along the lines of a broader meaning of ‘personal data’
and bases the decision on genetic reasoning.
As in many
legal systems, under Icelandic law, personal rights end with the
death of the individual unless legislation provides otherwise. While
the Icelandic Health Sector Database Act provides for the inclusion
of the personal information about deceased citizens in the database,
there is no provision for descendants or other relatives to execute
the right to opt out on their behalf. The Icelandic Supreme Court,
however, attempted to find a way to circumvent this prohibition to
grant legal standing to the appellant. The Court reached its desired
aim through recognising that personal information about the appellant
herself could be derived from the personal information related to the
hereditary characteristics of her father. As it stands, the genetic
background to the way this decision was reached is questionable to a
certain degree.
First,
it has to be taken into consideration that all humans share 99.9% of
their DNA with each other.21
What varies is the arrangement of the base pairs of DNA. In this
connection, the research described by Cavalli-Sforza needs to be
taken into account.22
Cavalli-Sforza illustrates how due to genetic drift, populations tend
to be homogenous to a high degree. An example given by him is the
discovery of “Oetzi”, a bronze-age man in the
Austrian/Italian alps. DNA analysis showed that “Oetzi’s”
DNA showed a remarkable similarity to the DNA of people living in the
same region today.23
If Icelanders are as genetically homogeneous as proclaimed by Gulcher
and Stefánsson, should legal standing then not be given to
each Icelander in such a case? And could each Icelander then
challenge the inclusion of every other Icelander in the database on
the basis that the Icelandic population is supposedly so remarkably
homogeneous? Surely this can be classified as an undesired and
undesirable result.
Second, following the court’s reasoning, every Icelander could not only object to his/her deceased parent’s data being included in the database, but also those of his/her living parent’s. The genetic connections would be the same and would provide this person with legal standing before court. This means that every Icelander would be able to take his/her parents to court and demand that they opt out of the database, a result that was surely not intended by the Supreme Court. Not only would this have the potential to disrupt family life to a considerable extent, it also focuses on a problem that commentators in legal and ethical studies as well as in social sciences have remarked on, namely the tension between the individual and the family regarding genetic information.24 Modern medicine regards diseases increasingly as founded in genetic inheritance with medical genetics and genetic counselling based largely on knowledge of family and the family history of illnesses.25 In this context, genetic data is difficult to define due to this tension between the individual and the family, taking into consideration that certain family medical records can be classified as genetic data.26 As Heyd points out, genetic testing may affect other persons besides the individual being tested, for example if an inherited disease is determined. Basically, the decision in favour of an inquiry into the genetic make-up will ultimately have an influence on other family members.27 Attempting to find a solution to the tension of family versus individual in the field of genetic information, or even providing an in-depth discussion, however, would be well outside the frame of this paper.
Third,
Icelanders have been granted legal standing for requesting that their
deceased parents’ medical information not be included in the
Health Sector Database. Every individual shares 50% of his/her
genetic material with father and mother. These 50% are obviously be
deemed to be sufficient by the Icelandic Supreme Court to infer
information about the plaintiff could be inferred from the data
related to hereditary characteristics of each parent. This allows the
question to arise whether grandchildren would be granted legal
standing to challenge their grandparents’ inclusion in the
database, taken into consideration that they share 25% of their
genetic material with their grandparents. Or, similar, whether legal
standing would be granted to challenge the inclusion of the siblings
of their parents in the database. Thus, the judgement opens up many
more questions than it provides answers to.
4.2. The consent issue
It
is warranted to say that the issue, which aroused most of the
criticism regarding the Icelandic Health Sector Database, is the use
of presumed rather than informed consent.28
The background to the debate is the internationally accepted standard
of requiring informed consent for genetic research carried out on
human subjects. This norm is laid down in legal texts and guidelines
such as the Helsinki Declaration,29
the CIOMS guidelines,30
the recommendations by HUGO31
as well as in European legislation. However, instead of informing the
population of Iceland about the Health Sector Database and all that
it encompasses, and subsequently asking the citizens for consent to
have their medical records entered into the database and to link this
database with the genealogical and the genetic database, the
Icelandic government adopted national legislation containing the
provision of presumed consent. The justification provided by the
Icelandic government for this use of presumed instead of informed
consent is that the information is supposed to be non-identifiable
and that Icelanders can opt out.32
Furthermore, the technophile character of the Icelandic population
was mentioned and the assumption that people would act in the
interest of the community.33
Still, obtaining informed consent from the Icelandic population would
not have been an insurmountable task. One of the reasons for choosing
Iceland to create a population-based database was the very fact that
the Icelandic population was relatively small. Also, as deCODE
Genetics claims to have overwhelming public support, the danger of
citizens not giving their consent would not have been overly large. 34
The topic
of presumed versus informed consent, however, is only touched upon
briefly by the Icelandic Supreme Court. As it stands, the entire
judgement dedicates only two sentences to the consent problem,
pointing out that Article 7 of the Health Sector Database Act
provides private entities, who are neither medical institutions nor
health-service workers of any kind, with the possibility to obtain
information from medical records without any informed consent given
by the individuals to which the information refers. While this simple
fact did not constitute a violation of Paragraph 1, Article 71 of the
Icelandic Constitution, all legislation should take care to ensure
that the information could not be traced back to individuals. The
Court then proceeds to discuss the issue of encryption of the data so
that information cannot be traced back to specific persons and
continues to comment on the privacy issue without returning to the
consent question.
However,
the possibility of identifying individuals through the information
contained in the database links directly with the problem of informed
consent which can be deducted from international legislation and
guidelines, at least some of which are legally binding for Iceland.
Regard should be had to guidelines as early as the Nuremberg Code,35
which was established after the Nuremberg trials as a consequence of
the unethical medical research performed in Nazi Germany. The
Nuremberg Code contains the provision that informed consent is
required for medical research, values which were then adopted into
the principles of the Helsinki Declaration. However, the Helsinki
Declaration does not distinguish between anonymous and identifiable
data. Accordingly, any and all medical research, whether with
strictly anonymous data or personally identifiable information,
requires informed consent from the research subjects. The European
Directive 95/46,36
on the other hand, makes this distinction. For data that is not
identifiable in any way, presumed consent is sufficient, but
according to Art. 8 of the Directive, for personal data from which a
person can be identified, explicit consent is required.
The
question that needs to be answered with regard to the requirement for
informed consent is whether the information contained in the Health
Sector Database is personally identifiable. The Icelandic Supreme
Court answers this question clearly in the affirmative and argues
that due to the richness of the data and the fact that the Health
Sector Database would link up with the genealogical and the genetic
database, individual persons could be identified without the use of
complicated technology and great manpower. Iceland as a member of the
EEA has to adhere to Directive 95/46 on Data Protection.37
Following the Icelandic Supreme Court on the issue of personal
identifiability, the Health Sector Database Act would violate
Directive 95/46 by entering personally identifiable data into the
database without previous explicit consent. The Court, however,
instead of making this connection, focuses its findings solely on the
Icelandic Constitution, especially Paragraph 1 of Article 71, which
stipulates that everyone has the right to freedom from interference
with privacy, home and family life. While the Court discusses the
privacy and data protection issues in this connection, no further
mention of the consent issue is made. While consent should provide
the threshold mechanism for becoming involved in the database at all,
privacy provisions should protect people once they have become
involved, i.e. once their data have been entered into the database.
The two protection mechanisms are closely linked, as on one hand
participants can be involved in the database without their explicit
consent if their privacy is guaranteed, i.e. if the data cannot be
personally identified. On the other hand, if this is not guaranteed,
if the data can be traced back to individuals, explicit consent is
required. The Icelandic Supreme Court, however, fails to make this
important connection. Commentators worldwide on the Icelandic Health
Sector Database will be disappointed with this missed opportunity for
clarification on the consent question. Taking the diversity of types
of consent in account, ranging from broad, open consent to narrow,
specific consent for one research project, some guidelines by the
Icelandic Supreme Court would have been welcomed.
Considering
the present situation in Iceland, however, the significance of asking
the population for informed consent to the transfer of medical
records to the Health Sector Database now seems rather
inconsequential. As Hoeyer and Lynoe point out, the Icelandic
citizens have heard the debate about the database through the media
in great detail.38
The question that needs to be asked is what further information a
consent form could provide, what additional news could be offered.
Seeing informed consent as the saving grace in the Icelandic context
would seem to be a rather belated effort. 39
In this case, the change to informed consent would be too little too
late and would only constitute an end in itself.
This
could be considered as an argument in favour of the opt-out system.
However, an opt-out system can never replace the signing of an
explicit informed consent form. For a research project funded by the
Wellcome Trust, Rose studied the Icelandic Health Sector Database and
also did field work in Iceland.40
In interviews with Icelandic citizens it became clear that in order
to opt out, people had to actively seek out their physicians’
surgeries and request a form, then fill it in and resubmit it, proved
to be too much of an effort. People who under other circumstances
would not have consented to having their medical records transferred
to the Health Sector Database, did not obtain an opt-out form. Rose
gives an example of a flight attendant in her late twenties, who
proclaimed that she did not want to know whether she would die of a
heart attack in her forties, and that she didn’t want anybody
else to know either. When asked if she was going to opt out, she
replied that she wasn’t going to bother, because it all “seemed
a bit unreal”.41
4.3. Data protection issues
The Icelandic Supreme Court divides
the data protection issue into two aspects. First, the Court
discusses the security of the one-way encryption system and second,
provides an analysis of the privacy provisions of the Icelandic
Constitution.
4.3.1. The one-way encryption system
In its findings the Icelandic Supreme Court states that the type of one-way encryption as scheduled by the Health Sector Database Act is sufficient with regard to data confidentiality and that the encryption could be carried out in such a way that it would be virtually impossible to read the encrypted information. As elaborated by the Icelandic Supreme Court, the District Court decision regarding the security of the data was not successfully contested. Instead, the Supreme Court pointed towards the fact that the Health Sector Database Act contained no provision giving any clear instruction as to which information from the medical records was to be encrypted in such a way before being transferred into the database or whether certain information regarding the personal identity of people was not to be transferred at all. Still, from the various comments on the database and the elaborations of Dr Stefánsson, the only data to be encrypted will be the national identity number of each person whose data will be entered into the Health Sector Database, while the name and address will be omitted.42
To
understand fully the reasoning behind the issue of one-way
encryption, a look back needs to be taken to the time when the first
drafts of the Health Sector Database bill were submitted. When Dr
Kari Stefánsson drafted the first bill, he included a
definition of “personal information” that contained the
words “An individual shall not be counted as nameable if a
considerable amount of time and manpower would be required in order
to name him/her. When an individual is not nameable the information
about him/her shall not be considered to be personal information”.43
This draft bill was submitted to the Ministry of Health in September
1997. A modified draft was later presented to the Icelandic
Parliament in Spring 1998.
A further
addition was made to the original draft, containing the provision
that if a key to the data existed, individuals should not be
considered personally identifiable when the body in possession of the
data did not have access to that key. The sentence “The same
applies if the identification could only take place through use of a
decoding key, not available to the person having the information”
was inserted between the two original sentences. The definition
regarding personal identifiability through a “considerable
amount of time and manpower” are derived from the Council of
Europe Committee of Ministers on the protection of medical data,
Recommendation No R(97)5, which was given to the Member States.
After
considerable opposition from both the Parliament and the Icelandic
public, the bill was amended again. This draft again contained the
requirement of “considerable time and manpower” for the
data to be considered identifiable. This draft was sent out to
several official Icelandic bodies, amongst those the National
Bioethics Committee and the Icelandic Data Protection Commission. The
response from the Data Protection Commission was a sharp criticism of
the draft bill’s definition of personal data and the
requirement for identifiability. For the first time, the attention
was drawn to the European Directive 95/46 on the protection of
individuals with regard to the processing of personal data and on the
free movement of such data. As already mentioned above, Iceland as a
member of the European Economic Area was legally bound to adhere to
this Directive. The Directive, however, does not mention the time or
manpower needed to identify personal data.
The
final draft of the bill was then changed accordingly and contained
the definitions of the Directive: “An individual shall be
counted as personally identifiable if he can be identified, directly
or indirectly, especially by reference to an identity number, or one
or more factors specific to his physical, physiological, mental,
economic, cultural or social identity.”44
In
concluding that the encrypted data were indeed anonymous and not
personal data as defined in Article 2 of the Act, the Icelandic
Supreme Court comes to the same conclusion as can be found in the
report of the Council of Europe Steering Committee on Bioethics, who
performed a study on the Health Sector Database in 1999. This report,
which has mistakenly been interpreted as the Council of Europe’s
opinion instead of the Icelandic Government’s evidence,45
contains the conclusion that the main criterion to be applied was
that of reasonableness.46
The Steering Committee deduced that an identification of individuals
“cannot be regarded as reasonably possible without substantial
effort” and continued that the information contained in the
Health Sector Database had to be considered to be anonymous according
to international law.47
This was based on the fact that according to Article 7 of the Health
Sector Database Act, the one-way encoding system meant that no key
for decoding the information was allowed. Accordingly, the question
that needed to be answered was not whether the Health Sector Database
Act is in accordance with Directive 95/46, but whether a key existed
in direct violation of Article 7 of the Act. It will have to be taken
into account, however, that this report was prepared by the Icelandic
Ministry of Health and Social Security and is not an official Council
of Europe document.
In
2000, Dr Stefánsson gave an interview in the New Scientist.
When discussing the situation of identifying a family with a certain
disease, he mentioned contacting that family and asking for a blood
sample as well as for permission to cross-reference their names with
the Health Sector Database. When asked how the identification from
the Health Sector Database was to be made possible, Dr Stefánsson
replied that the while the information in that database was to be
encrypted, the keys would be kept by the Icelandic Data Protection
Commission. Also, deCODE Genetics’ Department of Database
explained in an interview in the Icelandic newspaper Morgunblað
that the encryption would be performed using a special key, which
supposedly adhered to the strictest technical security measures. The
statement regarding technical security measures that the keys would
fulfil is a reference to the requirement of the Council of Europe
Committee of Ministers Recommendation No R(97)5, which requires
“considerable time and manpower” to decrypt the
information. Due to the changes in the Health Sector Database bill,
these requirements have become obsolete, since Directive 95/46 was
used as a base for the Health Sector Database Act, meaning that the
criterion of “considerable time and manpower” was not
applicable. However, the Health Sector Database Act also included the
explicit prohibition of any key to decode the data. The fact remains
that a key to identify personal data obviously does exist. According
to the Health Sector Database Act, it does not matter who has
possession of the keys, the person with access to the data or
somebody else. Considering the fact that further information is
scheduled to be added to the Health Sector Database once it is
established, the necessity for a key and therefore the violation of
the Icelandic Health Sector Database Act becomes obvious.48
The Icelandic Supreme Court, however, does not reach this conclusion.
The important question whether a key to decode the information
transferred into the database is not touched upon. Accordingly, the
fact that with the existence of a key, the Database seemed in obvious
violation of a provision of the Health Sector Database Act itself
also did not appear in the judgement.
4.3.2. Identifiability due to
richness of data
The second part of the Icelandic
Supreme Court judgement with regard to data protection deals with the
variety and multitude of data to be entered into the database. In the
annexes to the operating licence for deCODE Genetics it is implied
that the name and addresses of the patients and their families would
be completely omitted from the database and that the patient’s
identity number would be encrypted. All other information, however,
such as marital status, education, profession, municipality of
residence and age of the person as well as specific diseases would be
transferred to the database. From this fact, the Icelandic Supreme
Court drew the conclusion that even without having access to the
identity number or the name and address of the individual, an
identification could be possible and accordingly both the terms of
the Constitution and international treaties regarding the handling of
personally identifiable data applied. A fact that also needs to be
taken into account in this context is the size of the Icelandic
population, which results in a very limited number of births a year.
Considering that the creation of new jobs for Icelanders was one of
the incentives of the Health Sector Database project, it can safely
be assumed that the employees of the Health Sector Database will
mostly be Icelanders. That, however, increases the probability of an
employee recognising individuals from the richness of data entered
into the database to a considerable degree, thus making the data in
the database personally identifiable.49
The
Icelandic Supreme Court realises this problem when it discusses the
richness and variety of the data that will be transferred into the
Health Sector Database, namely information about the age,
municipality of residence, education, marital status and profession
of an individual. The Court then combines the aspect of data
protection with that of access to the data, taking the position that
any law must ensure that such information which involves the private
affairs of identifiable persons does not fall into the hands of third
parties who do not have a legitimate right of access to the
information in question. This was to be the case whether the third
parties consisted of other individuals or of governmental
authorities.
Obviously,
the Health Sector Database Act falls short on the data protection
issue. While supposedly secure through the encryption of the identity
number and omission of the name and address, the Act does not take
into account that individuals can be identified through means other
than their name and identity number and the Icelandic Supreme Court
reaches the conclusion that in this respect, the Act violates the
provisions on privacy contained in the Icelandic Constitution,
Paragraph 1 of Article 71, which state “Everyone shall enjoy
freedom from interference with privacy, home and family life.”
4.4. Open queries into the database
Another
problem the Icelandic Supreme Court depicted was that of open queries
into the database as regulated by Article 10 of the Health Sector
Database Act. While Article 10 prohibits the licensee from providing
direct access to the database, queries can be processed and answered
with information from the database. However, what type of queries
will be permitted and/or what form the replies will have is not
regulated. Background to this problem is the fact that deCODE
Genetics demanded that the query layer be opened up further, which
was refused by the Icelandic Data Protection Authority. By
recognising the problem and stating that the information given out
has to be limited strictly to anonymous data without any personal
identifier, the Icelandic Supreme Court strengthened and supported
the position of the Data Protection Authority. Still, as the Court
realised, the need for further regulation of the types of queries
made to the databases and the types of reply to be given out is in
need of further consideration.
4.5. Monitoring of the Health Sector
Database
A further
remark by the Supreme Court was related to the monitoring of the
Health Sector Database.
This
aspect of the judgement needs to be considered in light of the change
of the National Bioethics Committee.
Both
the Health Sector Database Act and the setting up of the genetic
databank fall under the control of the National Bioethics Committee,
which was originally established in 1997. The 7 Committee members
were appointed by the Minister of Health based on nominations from
the Faculty of Medicine, the Institute of Ethics, the Institute of
Biology and the School of Law, all University of Iceland, the
Icelandic Nurses Association and the Icelandic Medical Association.
In 1999, however, the Minister of Health cancelled the regulation on
biomedical research and issued a new regulation, reducing the
National Bioethics Committee to only 5 members. 50
For
the new Committee, the government nominates all members; 1 each is
nominated by the Minister of Education, the Minister of Justice and
the Director General of Public Health and the remaining 2 members are
appointed by the Minister of Health without any nomination. 51
The duties of the new Bioethics Committee were to be approving
research protocols with patient involvement as well as providing the
politicians with general advice on ethical aspects of medical
treatments. The official argument against criticism of this change
was that the new committee members were free to be frank and open
concerning their opinions. 52
However, when attempting to determine the reasoning behind the sudden
change in the Bioethics Committee, it has to be taken into account
that this change took place after the original Committee began
criticising the plans for the Health Sector Database. Furthermore,
the Committee had begun establishing guidelines for informed consent
in accordance with the Icelandic Act on Patients’ Rights and
with international conventions and principles. Had these guidelines
been established, they would have affected the Health Sector Database
considerably. deCODE Genetics would have had to abide by them when
connecting the Health Sector Database to the genetic database. 53
It is therefore doubtful whether this new Committee will wish to
speak their minds with regard to the database, considering what
happened to their predecessors. Also, the possibility will have to
be taken into account that only those already in favour of the Health
Sector Database will be appointed in the first place.
The Court,
however, commented on the lack of independent review mechanisms for
the Health Sector Database only indirectly. Rather, the remarks were
focussed on the fact that the statutory provisions were insufficient
in ensuring the privacy provided for in Paragraph 1 of Article 71 of
the Icelandic Constitution, which imposes the protection of privacy
on all legislation. The Court stated that this constitutional
guarantee cannot be replaced by any review and monitoring mechanisms
for the Health Sector Database. Moreover, public agencies and
committees such as the National Bioethics Committee were supposed to
perform their monitoring functions without any statutory norms to
regulate them. This part of the judgement refers to the whimsical
changes to regulations made by the Icelandic Government such as the
change to the regulations setting up the National Bioethics
Committee. If there is no security in knowing which monitoring bodies
are responsible for overseeing the Health Sector Database and what
regulation their monitoring power is based on, the constitutional
provision of privacy cannot be guaranteed in a sufficiently reliable
way.
5. Conclusion
An
interesting aspect of the Health Sector Database Act is the fact that
it received severe criticism from both its opponents and its
advocates. As Annas as well as Gulcher and Stefánsson point
out, the Health Sector Database Act itself does not provide any
information and guidelines on the most vital aspects: neither does it
instruct how the database is to be set up, nor does it regulate who
should run it, who should have access to the data or what, if any,
control Icelandic citizens should have over the samples. Also, the
Act does not contain any information with regard to the method or
mechanisms of linking the three individual databases. 54
To
summarise, it is now appropriate to provide a synopsis of the aspects
of the Health Sector Database that have come under international
criticism and to determine which of those the Icelandic Supreme Court
judgement has addressed and which were not touched upon.
5.1. Consent Issue
The
consent question, undoubtedly the most contested aspect of the entire
debate surrounding the Icelandic Health Sector Database, received
surprisingly little attention from the Icelandic Supreme Court. In
fact, the Court only mentions consent in the context of data
protection issues. However, the very fact that the question of
consent is linked so closely to the problem of data protection, which
the Icelandic Supreme Court dwelled on for a considerable length of
time, should have caused the Court to devote more of the judgement to
the consent issue. After all, the question of what type of consent
would be required depends largely on the anonymity or identifiability
of individuals. However, while the Court explains in detail its
findings on the encryption mechanism and the fact that the
information contained in the database can be traced back to
individuals due to the richness of the data, as discussed above, the
Court then fails to link these findings with the consent issue.
Accordingly, those hoping for a clear statement with regard to the
requirement of consent for databanks such as the Health Sector
Database in order to set an international precedent may be
disappointed.
One very
interesting fact in this context is a particular statement made by
the Icelandic Supreme Court, in the light of which the entire
judgement will have to be seen. Immediately following the description
of the appellant’s claim before the courts and before the
elaborations on the individual points of the judgement, the Court
stated that, based on the information that emerged during the
proceedings, it seemed dubious whether the Health Sector Database
would ever be initiated properly, as the case documents showed that
that the formal measures for preparation of the database had not
advanced significantly since issuing of the operating licence on 22
January 2000. From this paragraph the Icelandic Supreme Court’s
opinion on the future of the Health Sector Database can be deduced,
namely that the Court seems to believe that the entire project might
fail anyway.
5.2. Data Protection
The discussion of privacy and data protection takes up the largest part of the judgement. Still, with regard to the data protection issue itself, the Icelandic Supreme Court does not take the relevant European legislation into account. Accordingly, the result is reached through a deduction, which, while not wrong, omits an important legal aspect. The Court reaches two conclusions in connection with the data protection issue:
First, the Court considers the one-way encryption system in itself to be safe and to provide the Health Sector Database with the necessary anonymity. Therefore, one-way encryption is considered an acceptable security mechanism for the Health Sector Database.
Second, the Court continues with an analysis of the information to be transferred into the database and reaches the conclusion that the nature and extent of the data, namely the medical and genealogical records together with the genetic samples, means that an identifiability of individuals is indeed possible. Accordingly, the relevant privacy and data protection laws apply.
In the
course of this, the Court omits an important third aspect and does
not discuss the issue of the possible existence of a key to decode
the database, an issue which, while not in breach of data protection
legislation, is in direct violation of the Health Sector Database
itself.
5.3. Lack of independent review
mechanism
One
of the main concerns amongst critics of the Health Sector Database is
the fear that the database will not be subjected to sufficient
oversight by an independent ethics commission. This concern was
emphasised by the way in which the Icelandic government restructured
the National Bioethics Committee and altered the regulations with
regard to the appointment of a new Committee in 1999, a fact that
aroused international criticism.55
In its judgement the Icelandic Supreme Court focuses on the fact that
monitoring bodies cannot replace the constitutional guarantee of
privacy as laid out in Paragraph 1, Article 71 of the Icelandic
Constitution. As discussed above, the problem with regard to the new
committee was that it could not be considered independent anymore. In
this respect, the judgement should satisfy critics of the Health
Sector Database, as it clearly calls for independent review of the
database.
5.4. An international perspective
Worldwide
more and more genetic databanks similar to the Icelandic Health
Sector Database are being initiated and are in various stages of
their set-up process. Examples are the UK Biobank,56
the Estonian Genome Project,57
Generation Scotland,58
the Latvian Genome Project59
as well as projects in Japan, China, and the USA. The implications of
the Icelandic Supreme Court judgement for the other genetic
databanks, however, are limited. As mentioned above, the issue of
legal standing, which the Supreme Court focuses on first, is very
specific to the Icelandic databank. The consent issue, which is being
discussed to a great extent for every genetic databank, is almost
completely left aside by the Icelandic Court. The only aspect of the
judgement of international significance is the discussion regarding
data protection. And while Iceland is bound by the European Data
Protection Directive, even this issue is only discussed from a point
of view of purely Icelandic national law without taking a look beyond
Iceland’s borders.
One aspect
of the judgement is of significant importance for genetic databases
worldwide, namely the fact that the removal of personal identifiers
such as identification number and name and address may not be enough
to provide anonymisation. The Icelandic Supreme Court made it clear
that all data entered into a database will have to be taken into
account. If the data is of sufficient richness to enable
identification of individuals simply by adding the various factors
such as education, profession, marital status etc. together to reach
an almost certain conclusion with regard to the identity of the
person, than this is a direct violation of privacy and data
protection legislation. This again has important implications for the
type of consent such a project will require.
To summarise the findings, the Icelandic Supreme Court judgement is a considerable step forward for the opponents of the Health Sector Database, but for international legal scholars hoping for a precedent judgement on genetic databanks, the outcome is limited to the privacy and data protection issue.
*
Research Fellow, ahrc Centre, School of Law, University of
Edinburgh.
Acknowledgement: The
author would like to thank Dr G T Laurie for his advice. Any
mistakes, of course, are the author’s own.
1 The translation of the judgement into English was provided by Mannvernd. A translation from the Icelandic Supreme Court itself was not available.
2 See for example M Fortun “Breaking the code” (2001) Rensselaer Mag; J F Merz, G E McGee and P Sankar, “’Iceland Inc.’?: On the ethics of commercial population genomics” (2004) Social Science & Medicine; M Fortun “Breaking the code” (2001) Rensselaer Mag; S Sigurdsson “Bioethics Lite: Two aspects of the Health Sector Database deCODE controversy” in: T Hornschuch, K Meyer, G Rueve and M Voss: Schoene gesunde neue Welt? Das humangenetische Wissen und seine Anwendungen aus philosophischer, soziologischer und historischer Perspektive (2002) IWT –Paper 28; A Kong, J R Gulcher and K Stefánsson “Genealogy certainly matters in for multifactorial genetic disease” (1999) 319 British Medical Journal; J R Gulcher, K Kristjansson, H Gudbjartsson and K Stefánsson, “Protection of privacy by third-party encryption in genetic research in Iceland” (2000) 8 European Journal of Human Genetics; S Sigurdsson, “Decoding Broken Promises” (2003) Open Democracy; J Potts, “At least give the natives glass beads: An examination of the bargain made between Iceland and deCODE Genetics with implications or global bioprospecting” (2002) 8 Virginia Journal of Law and Technology; O Hlodan, “For Sale: Iceland’s genetic history” ActionBioscience.org, June 2000; N Duncan, “World Medical Association opposes Icelandic gene database” (1999) 318 British Medical Journal
3 M Fortun “Breaking the code” (2001) Rensselaer Mag
4 M Binyon, “An Icelandic saga unveils life’s secrets” (1999) The Times, February 13; J R Gulcher, A Helgason, K Stefansson, “Genetic homogeneity of Icelanders” (2000) Nature Genetics
5 E Arnarson, “Genetic heterogeneity of Icelanders” (2003) 67 Annals of Human Genetics 1; I Arnason, H Sigurgislason, E Benedikz, “Genetic homogeneity of Icelanders: fact or fiction?” (2000) Nature Genetics
6 Act No. 139/1998
8 J F Merz, G E McGee and P Sankar, “’Iceland Inc.’?: On the ethics of commercial population genomics” (2004) Social Science & Medicine p. 1202
9 S Sigurdsson “Bioethics Lite: Two aspects of the Health Sector Database deCODE controversy” in: T Hornschuch, K Meyer, G Rueve and M Voss: Schoene gesunde neue Welt? Das humangenetische Wissen und seine Anwendungen aus philosophischer, soziologischer und historischer Perspektive (2002) IWT –Paper 28
10 ibid.
11 Joint Statement of the Icelandic Medical Association and deCODE genetics on the health sector database, Reykjavik, Iceland: Ministry of Health and Social Security, August 27.
12 J F Merz, G E McGee and P Sankar, “’Iceland Inc.’?: On the ethics of commercial population genomics” (2004) Social Science & Medicine
13 A Kong, J R Gulcher and K Stefánsson ,“Genealogy certainly matters in for multifactorial genetic disease” (1999) 319 British Medical Journal, p. 578
14 J R Gulcher, K Kristjansson, H Gudbjartsson and K Stefansson “Protection of privacy by third-party encryption in genetic research in Iceland” (2000) 8 European Journal of Human Genetics
15 ibid.
16 J F Merz, G E McGee and P Sankar, “’Iceland Inc.’?: On the ethics of commercial population genomics” (2004) Social Science & Medicine p. 1202, 1203
17 J R Gulcher, K Kristjansson, H Gudbjartsson and K Stefánsson, “Protection of privacy by third-party encryption in genetic research in Iceland” (2000) 8 European Journal of Human Genetics, p. 741
18 Icelandic Supreme Court, No. 151/2003
19 Icelandic Supreme Court, No. 151/2003, para. II.
20 Directive 95/46/EC, Art. 2 (a)
21 K Finkler, C Skrzynia, J P Evans, “The new genetics and its consequences for family, kinship, medicine and medical genetics” (2003) 57 Social Science & Medicine
22 L L Cavelli-Sforza, Genes, peoples and languages (2000), p. 42, 43
23 ibid., p. 34, 35
24 see for example J Sándor, “Genetic information: science, society and legal norms” in: J Sándor (ed.), “Society and genetic information: codes and laws in the genetic era” (2003), p. 22
25 K Finkler, C Skrzynia, J P Evans, “The new genetics and its consequences for family, kinship, medicine and medical genetics” (2003) 57 Social Science & Medicine
26 J Sándor, “Genetic information: science, society and legal norms” in: J Sándor (ed.), “Society and genetic information: codes and laws in the genetic era” (2003), p. 22
27 D Heyd, Genethics: moral issues in the creation of people, (1992)
28 see for example D Winickoff, “Biosamples, genomics, and human rights: context and content of Iceland’s Biobanks Act” (2000) 4 Journal of BioLaw and Business; J F Merz, G E McGee and P Sankar, “’Iceland Inc.’?: On the ethics of commercial population genomics” (2004) Social Science & Medicine; M Fortun, “Breaking the code” (2001) Rensselaer Mag
32 D Winickoff, “Biosamples, genomics, and human rights: context and content of Iceland’s Biobanks Act” (2000) 4 Journal of BioLaw and Business; J Potts, “At least give the natives glass beads: an examination of the bargain made between Iceland and deCODE Genetics with implications for global bioprospecting” (2002) 7 Virginia Journal of Law and Technology, p 13; M Fortun, “Breaking the code” (2001) Rensselaer Mag
33 H Rose, The commodification of bioinformation: the Icelandic Health Sector Database, (2001), p. 12
34 H T Greely, “Iceland’s plan for genomics research: facts and implications” (2000) 40 Jurimetrics J, p. 180
36 OJ L281/31
37 In May 1992 the European Economic Area (EEA) Agreement was signed by Norway, Iceland, Liechtenstein and Switzerland in Oporto and entered into force on 1 January 1994. Directive 95/46/EC was included in the EEA Agreement on 25 June, 1999 through Decision 83/1999.
38 K. Hoeyer, N Lynoe “Is informed consent a solution to contractual problems? A comment on the article “Iceland Inc.’? On the ethics of commercial population genomics” (2004) 58 Social Science & Medicine, 1211
39 ibid.
40 H Rose, The commodification of bioinformation: the Icelandic Health Sector Database, (2001)
41 ibid., p. 24
42 see for example: E Arnason, “Personal identifiability in the Icelandic Health Sector Database” (2002) 2 The Journal of Information, Law and Technolog; R Anderson, “The deCODE proposal for an Icelandic Health Database” (1998) <http://www.l.cam.ac.uk/users/rja14/iceland/iceland.html>; O M Arnardottir, D Björgvinsson and V M Matthiasson, “The Icelandic Health Sector Database” (1999) 6 European Journal of Health Law
43 Article 2, draft Health Sector Database bill, dated July 14, 1997
44 Article 2, draft Health Sector Database bill, dated October 1998
45 R Chadwick, “The Icelandic database - do modern times need modern sagas?” (1999) 319 British Medical Journal, p 442; corrected by: H Rose, “The commodification of bioinformation: the Icelandic Health Sector Database”, (2001) the Wellcome Trust; B Andersen, E Arnason and S Sigurdsson, “Kafkaesque ethics for post-modern vikings” (1999) 319 British Medical Journal; also confirmed in a correspondence with Helen Leatherby, Steering Committee on Bioethics, on file with the author
46 H Rose, “The commodification of bioinformation: the Icelandic Health Sector Database”, (2001) the Wellcome Trust; B Andersen, E Arnason and S Sigurdsson, “Kafkaesque ethics for post-modern vikings” (1999) 319 British Medical Journal; also confirmed in a correspondence with Helen Leatherby, Steering Committee on Bioethics, on file with the author
47 Council of Europe Steering Committee on Bioethics, “The Icelandic act on a health sector database and Council of Europe conventions” Strasbourg: Ministry of Health and Social Security, 1999 (CDBI-CO-GT2(99)7 1999)
48 see Data Protection Commission’s Opinion on the draft Bill on a health-sector database, commissioned 4 September 1998: “In the general notes to the Bill, however, it is assumed that the data on the database will be regularly updated, as new data are added. From this it may be inferred that the Bill assumes that the data will be coded and not disconnected from personal identifiers.”; H Greely, “Iceland’s plan for genomics research: facts and implications” (2000) 40 Jurimetrics J, p 185; JPotts, “At least give the natives glass beads: An examination of the bargain made between Iceland and deCODE Genetics with implications for global bioprospecting” (2002) 7 Virginia Journal of Law and Technology 8, p 13
49 H Greely, “Iceland’s plan for genomics research: facts and implications” (2000) 40 Jurimetrics J, p 186, see also Data Protection Commission’s Opinion on the draft Bill on a health-sector database, commissioned 4 September 1998, III. Observations on individual articles of the Database Bill, on Art. 1
50 A Abbot, ‘”Strenghtened” Icelandic bioethics committee comes under fire’ (1999) 400 Nature, p. 602; M Fortun “Breaking the code” (2001) Rensselaer Mag
51 M Fortun “Breaking the code” (2001) Rensselaer Mag.
52 A Abbott, ‘”Strenghtened” Icelandic bioethics committee comes under fire’ (1999) 400 Nature, p. 602
53 so also T Zoëga, B Andersen, “The Icelandic Health Sector Database: deCODE and the ‘new’ ethics for genetic research (2000) in: Nordic Committee on Bioethics, Proceedings of the Conference “Who owns our genes?”, October 1999, Tallinn, Estonia
54 J R Gulcher, K Stefánsson, “The Icelandic Healthcare Database and informed consent” (2000) 324:24 New England Journal of Medicine, p 1827 – 1830; G J Annas “Rules for research on human genetic variataion: lessons from Iceland” (2000) 324:24 New England Journal of Medicine, p 1830 – 1833; see also D E Winickoff “Biosamples, genomics and human rights: context and content of Iceland’s Biobanks Act” (2000) 4:2 Journal of BioLaw and Business, p. 11 - 17
55 see for example A Abbott, ‘”Strenghtened” Icelandic bioethics committee comes under fire’ (1999) 400 Nature, p. 602; J F Merz, G E McGee and P Sankar, “’Iceland Inc.’?: On the ethics of commercial population genomics” (2004) Social Science and Medicine, p. 1204