Privacy laws and sharing of genomic and health data

Currently, much of the genomic and related health data collected in Australian states and territories is kept in databases not linked to each other. To better investigate and diagnose genetic disorders, clinicians and researchers need to be able to access and share this information across state and territory ‘boundaries’. Australian Genomics is exploring a solution where these databases are ‘connected’ via a secure federated data sharing network, which — with the consent of patients — allows specific information to be accessed by clinicians and researchers.  Australian Genomics, in consultation with BioGrid Australia, prepared a brief to obtain advice from Health Legal in relation to this proposed data sharing framework.

Australian Genomics asked Health Legal to answer the following questions:

• Who owns genomic information?
• What are our obligations when sharing genomic data for clinical and research purposes?
• What role does informed consent play?

Snapshot of key Health Legal findings:

• Information that is aggregated and not linkable to an individual is not subject to Privacy laws, while information about individuals, from which their identity could be ascertained, is subject to Privacy laws.
• Privacy laws permit the use and disclosure of personal information for the primary purpose it was collected for (e.g. clinical), as well as a secondary purpose (e.g. research) if consent was provided.
• “Opt-out” patient consent is unlikely to comply with clinical requirements and is not recommended for clinical genomics or research.
• The laboratory who performs the genomic sequencing has the strongest claim to ownership of that genomic data under Australian Privacy laws, although this may conflict with public expectations.
• Genetic variant information is about the individual, and thus subject to Privacy laws and can only be shared with appropriate consent. However, aggregated variant data is no longer about the individual and therefore not subject to Privacy laws.
• Information is considered identifiable even if only the individual could identify themselves from the information.
• Transfer of information interstate is permitted under the Privacy laws if the information will remain in a jurisdiction which has equivalent privacy protections. Transfers of information within Australia meet this requirement.
• In some jurisdictions, organisations are permitted to disclose a patient’s genetic information to a genetic relative without consent where they reasonably believe that the disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of a genetic relative of the patient.

A summary of the Health Legal Report is available here.

This summary was prepared by Australian Genomics’ Policy Officer, Andrea Belcher, and Program Coordinator, Matilda Haas, with assistance from Ainsley Newson (Associate Professor of Bioethics and Australian Genomics Ethics lead) and Norah Grewal (Research Associate) from The University of Sydney.

Norah Grewal and Ainsley Newson are currently undertaking further academic research into the concepts raised in the Health Legal report. This work is part of an Australian Genomics ethics research project that is exploring the ethical, legal and policy issues in genomic data sharing. If you would like to know more about this, please contact Norah Grewal at norah.grewal@sydney.edu.au