Virgil Cojocaru is a JD Candidate at Osgoode Hall Law School.

deCODE Genetics, an Icelandic firm that offers customers private DNA tests has filed for bankruptcy. Customers would typically take a genetic sample from the inside of their cheek and would mail it to the address provided.  deCODE Genetics would calculate the chances of a person getting cancer, diabetes, heart disease, and so on. There have been a few purchase offers for deCODE, and some worry about what this means for the privacy of the donors. Here is an explanation why.

George Nathanael in his post on IP Osgoode discusses the conflict between privacy and the need for research in genomics. Should the genetic information of patients be fully protected, for privacy’s sake? Or should we allow researchers to access anyone’s genome at leisure for the benefit of the ill? Experts argue that the kinds of treatments needed for diseases such as cancer and Alzheimer’s, would benefit greatly from access to patients’ genetic information. On the other hand, Nathanael points out that the genetic profile of an individual is far more private and unique when compared to standard medical information. The entities that might administer these new treatments or tests are not traditional health care providers. Nathanael suggests that the current legislative framework such as the Personal Information Protection and Electronic Documents Act in Canada (PIPEDA) might not be sufficient to regulate this industry.

Looking at its framework and applying it to the situation illustrated by deCODE Genetics, does PIPEDA fall short? If it does, where does this leave us?

Section 7(2)(b) in PIPEDA allows an organization to use an individual’s health record in case of emergencies threatening a person’s life. Section 7(2)(c) in PIPEDA speaks about using personal information for research. However, this can be done if it is the only way to achieve this purpose, the information is used in a manner that ensures confidentiality, and it is impracticable to obtain consent beforehand. Also, the organization has to inform the Commissioner that this information is being used. However, does ‘health information’ cover genetic profiles? Personal ‘health information’ under section 2(1) of PIPEDA refers to a wide range of definitions. The one that could concern deCODE Genetics is section 2(1)(c). This is health information from “any body part or any bodily substance of the individual or information derived from the testing or examination of a body part or bodily substance of the individual”.

PIPEDA seems to cover the situation in deCODE Genetics. Health information is categorized broadly enough to cover a genetic profile, referring to information derived from the testing of a bodily substance. This personal information could then be used for research, as long as the necessary conditions are fulfilled and the Commissioner is informed. However, some concerns do arise. For instance, a genetic profile is by no means confidential under most circumstances. Due to its uniqueness it could be matched with a medical record. Furthermore, does research include the selling of information to another company?

Does PIPEDA have any teeth? Upon receiving a complaint, the Commissioner under s. 12(1) has the powers to investigate, call any witnesses, and gather any necessary evidence. This is placed in the Commissioner’s report, which also outlines any agreements reached between the parties. Under s. 14(1) a complainant may apply to the Court following the Commissioner’s investigation into any alleged breach.  Based on s. 16(c) a Court may award damages to the complainant.  PIPEDA leaves it up to the Courts to impose damages, which may be a long and uncertain journey. Furthermore, the process appears to be claimant driven. This presupposes that the claimant is or somehow becomes aware of the breach of his/her privacy.

PIPEDA is a start. However, the manner in which it would ensure privacy over such sensitive and unique information as a person’s genetic profile is at best uncertain. Furthermore, the legislation itself lacks any real teeth, and the dispute process is claimant driven; a long uncertain road in the Courts. Indeed, the regulation of this industry needs to go beyond that which is offered in current legislation. Hence, we are left with one question. Do we wait and see what happens, or do we impose further restrictions before genetic profiles become widespread? So far it seems we are opting for the former.

Posted in Commercialization, Innovation, Ownership, Privacy, Technology