Fostering public engagement in the ethical and social implications of genetic technologies

'A Shift in Privacy law, and the Attendant Risks'

  • Published in Blog

EthicsandGenetics has published ‘A Shift in Privacy Law, and the Attendant Risks'. Coverage of the report by the Guardian can be found here. In this report, we identify and explore the risks associated with the government’s plans to establish a national genetic database and commercialise personal genetic information. Furthermore, we assess changes to privacy law and practice - in particular, the recent information governance review, and demonstrate that the new privacy framework fails to adequately safeguard highly sensitive information. 

Our report, reveals that the government are set to commercialise personal genetic information collected from the population, and stored on a national genetic database. As well as this, EthicsandGenetics can reveal that now, by default, NHS-users can be contacted to take part in clinical trials with private companies, without having expressed an interest in taking part in research of any kind - let alone clinical trials. 

Furthermore, the report offers a critical account of a major legislative programme to commercialise medical and genetic information collected from the population, and shows that in combination with major changes to privacy law and practice, these developments put people at serious risk of harm.      

Here is a brief summary of the report:

A Freedom of Information Disclosure by the Department of Health to EthicsandGenetics, confirms that Section 251 of the NHS social care Act can be used by pharmaceutical companies to trawl through personal, identifiable medical data, so that people, without having expressed an interest can be invited to take part in clinical trials. A further FoI disclosure by the Department of Health to EthicsandGenetics confirms that genetic information collected from the population and held on a central database, will be commercialised. At present, UK privacy law does no stop the government or private sector organisations from accessing personal medical and soon, genetic information, for a variety of purposes, which extend far beyond administering patient care or the advancement of medicine.    

A national genetic database is part of the Government’s intentions to connect genetic information with electronic medical records, and is the culmination of more than a decade of policy and legislative developments. Ultimately, the plan is to sequence the genomic information of the entire population and connect it to electronic medical records. Indeed, accessing massive datasets of genetic and medical data has long been considered a potential ‘unique selling point’ for the UKbiosciences and pharmaceutical sectors. 

In our report, we question the secrecy with which successive governments have implemented a legislative programme designed to secure this ‘unique selling point’ for the health-research, and UK pharmaceutical and bioscience sectors. Furthermore, we demonstrate that over the past decade, a shift in privacy law and practice has taken place, which primarily serves private companies, and is not of direct benefit to the person whose data it is. In fact, these changes not only compromise our right to privacy, but they also put people at risk of harm, too. 

Although the information governance review, and the substantial amendments to the NHS constitution that took place last Autumn, went largely unnoticed, their implications remain immense. We show that, within the context of privacy law, and over the course of the last decade, power has shifted away from the individual and towards the governement and other actors. The concepts of the ‘public interest’, ‘proportional’ and ‘necessary’ have become central, and the requirement to seek 'informed consent' when seeking to use a person's confidential information is quickly becoming a thing of the past.

Indeed, this new climate of information governance offers something very different to 'informed consent' and the control we used to have over personal data. In point of fact, it is now down to the Secretary of State for Health and the ‘Confidentiality Advisory Group’ to determine if it is in the public interest to disclose identifiable confidential information, and not the person whose data it is, to decide. 

At the launch of the recent information governance review, the Secretary of State for Health stated that an opt-out clause would be included. However, default opt-in is the problem. Default opt-in suggests that a fundamental shift in attitude towards personal medical information has taken place, in which everyone is content to hand over identifiable, personal data. But, has a shift in public perception regarding personal, often highly senstive information, really occured? As there has little in the way of meaningful, public-consultation, the government are not in a position to know, either way. 

Would the public, without hesitation, have warmed to the idea that identifiable medical data can be sold to Bupa without their consent, or indeed, that all NHS-users - by default, could be contacted to take part in clinical trials with private companies? And lastly, that genomic information collected from the population and held on a national genetic database will be commercialised, and the paramaters within which such information can be shared remains at best, unclear? These are questions that ought to have been put to the public; not least, as there are serious risks involved with this laissez-faire approach to personal genetic material.  

In its report to Government, the head of the Human Genomics Strategy Group, Sir John Bell, is adamant that “a whole genome cannot be truly anonymised.” Adding that, “an individual’s genetic information is sensitive personal data” and “there is a risk of the information being misused.” Even some form of anonymisation offers no guarantee that the information will not be re-identified. In a recent, high-profile DNA study in the US, Harvard Professor Latanya Sweeney re-identified the names of more than 40% of a sample of anonymous participants.

Despite the risks, the government are pressing ahead with a national genetic database and the commercialisation of genetic information, and there is no sign that the government are set to legislate against the associated risks. In contrast to what is happening here, the federal US government sought to legislate against absuses of personal genetic information at the earliest opportunity. After a number of genetic discrimination cases, the 'Genetic Information Non-Discrimination Act' (GINA) was enacted. In the UK, however, there is no such legislation that prohibits discrimination on the grounds of genetic traits or dispositions. Furthermore, there is merely a moratorium between the Association of British Insurers, and the Department of Health, on the use of genetic test results for insurance purposes - and this only lasts until 2017.

In the report, we link the lack of transparency in the implementation of a national genetic database to the risks that now confront us. We argue that the decision to change privacy laws in a way which serves the interests of the UK biosciences and pharmaceutical sectors - and establish a national genetic database and commercialise genetic information - puts certain groups at serious risk of discrimination based on genetic characteristics; and others at risk of being re-identified through their genomic information. As re-identification could lead to a person being subject to some form of genetic discrimination, greater protection is needed in order to avoid such an eventuality.    

In light of the inadequacies of current privacy law and practice, and the risks associated with a national genetic database, we propose a traffic light system as way of ensuring the individual has greater choice over what happens to their confidential information, and reduce any potential harm that may come from the unconsented disclosure of genetic information. This would bring information governance practice into line with Article 8 of the Human Rights Act, and a plethora of international treaties, agreements and charters.

For a traffic-light system along these lines to work, far greater clarity is needed regarding what the government deems acceptable and non-acceptable uses of whole-sequenced genomes. As the new privacy model fails to do this, we urge the government to adopt a framework that provides greater clarity on what types of studies or research genomic information can be used for. Finally, as the government intends to commercialise genetic information held on a national database, it is essential that adequate protections are reinstated so as to protect people from unnecessary harm.  


Edward Hockings



The full report can be found in the ‘Reports’ section. 



Privacy, the CRPD and the Commercialisation of Personal Medical and Genomic Information

  • Published in Blog

Medicine and healthcare appear to be in the midst of previously unimaginable changes. These changes might result in an improvement in our understanding of the nature of disease and, in time, assist us in predicting how a patient might respond to treatment. However, the fact remains, sweeping changes have been made to the way medical information is shared and accessed, and the cornerstones of medical law are being eroded for a science still in its infancy. The coming together of genomics, genetics and society in entirely novel ways, brings with it risks that are difficult to quantify, and must be the object of open and sustained public discussion.

Genetics, genomics and advanced biotechnology are not business as usual. The public must,  therefore, be given a central role in decision-making when it comes to substantive decisions in these areas. Indeed, a national genetic database and the commercialisation of genomic data was certainly was a big decision; we will soon have a national genetic database that has been a decade in the making. Throughout this period, the public, reassured by promises of anonymity and misled from the beginning, have been excluded from playing any part in what amounts to no less than a cultural shift. Let me explain.  

In anticipation of a supposed paradigm shift in healthcare based upon genetics, New Labour, under the direction of the UK pharmaceutical sector, set about implementing a major legislative programme in order to gain a competitive edge in the development of proactive genomics. It began with NHS National IT Programme, which included, ‘Connecting for Health’ – a set of interconnected databases, containing electronic medical records. The Secondary Uses Service soon followed, a mechanism by which personal medical information can be shared and accessed. Shortly after, the piece of legislation that facilitated all of this was introduced: Section 251 of the 2006 NHS Act. Section 251 is granted by the Secretary of State for Health and provides relief to the common law of confidentiality, Article 8 of the Human Rights Act 1998, as well as the Data Protection Act 1998. It permits access to patient-identifiable medical information without the need for consent. The only thing that is missing is a national genomic database; the last piece in this grand design.

Remember, the premise of ‘Connecting for Health’ and Summary Care Records was that they were ‘essential to treating patients in an emergency or out-of-hours with faster access to key clinical information.’ EthicsandGenetics has long argued that ‘Connecting for Health’ was in fact specifically designed so that electronic medical records would ultimately be linked to personal genetic data.

In response to a Freedom of Information request by EthicsandGenetics, Danny Lamond, Ministerial Correspondence and Public Enquiries for the Department of Health confirmed that a ‘central repository for storing genomic and genetic data and relevant phenotypic data from patients’ will be established. Lamond goes on to say that ‘the report [by the Human Genomics Strategy Group] has been welcomed by the Secretary of State for Health and the Minister for Universities and Science, who have asked for the recommendations to be implemented through a shared strategic framework.’

A national genomic database is a major development which that has far-reaching implications for confidentiality and privacy. With regards to this, the report by the Human Genomics Strategy Group recognises that ‘an individual’s genetic information is sensitive personal data, and a whole genome cannot be truly anonymised.’ Furthermore, ‘there is a risk of the information being misused.’

In September, a further and crucially important development took place: The Clinical Practice Research Datalink (CPRD) was launched. It streamlines medical research by connecting patient information from GPs and hospitals to other records, such as the national genomic storage facility; making the data accessible to both the public and private sectors at a cost. Under the new system, anyone who uses the NHS will automatically become a research subject, unless they chose to opt -out. On the CPRD website, it is claimed that ‘researchers never get access to names, addresses, post codes or dates of birth.’ Moreover, Dame Sally Davies, Chief Medical Officer and Chief Scientist at the Department of Health said: ‘protecting the confidentiality of patients remains a priority, so all data is anonymised and people can opt out.’

When these proposals were initially announced, David Cameron claimed that ‘this does not threaten privacy, it doesn’t mean anyone can look at your health records but it does mean using anonymous data to make new medical breakthroughs and that is something that we should want to see happen right here in our country.’ Shortly afterwards Andrew Lansley claimed that ‘it is not about sharing individual records in a way that can identify who those people are.’ Within the context of medical research, anonymised information is not of that much use. I could not help but feel sceptical. A further FoI disclosure to EthicsandGenetics by the Department of Health revealed that ‘information may be made accessible where it has been effectively anonymised or where there is appropriate legal authority to make it accessible. Whilst most researchers will only want access to effectively anonymised data, legal authority to access identifiable information may be provided through the consent of the citizens concerned or through legislation, such as Section 251 of the NHS Act 2006 can be used to authorise access for specific purposes.’ In a further Freedom of Information request by EthicsandGenetics, the Department of Health was asked if patient-identifiable information will be made accessible to private organisations:

“In most cases, the Department would expect consent to be obtained for disclosures of identifiable data. However, projects may apply to the Ethics and Confidentiality Committee for Section 251 approval where consent cannot be obtained. There are circumstances where it is very difficult to contact patients to seek their consent, or where it is vital that the data are identifiable, for example, to link data with a separate data set.”  

When we turn to the number of times Section 251 is secured, a separate FoI request by EthicsandGenetics to the Department of Health revealed that Section 251 of the NHS Act 2006 was been granted 42 times in 2008-09, 36 in 2009-10 and 54 times in 2010-11. This is at the rate of once a week and is often for very large studies. Moreover, this is before the launch of the Clinical Practice Research Datalink. The picture that emerges is that that identifiable personal medical information is being made available, through the CRPD, to private organisations without the consent of the individual. This is in complete contradiction to the official line given by the Conservatives as well as what is stated on the CRPD website.

After a series of FoI requests by EthicsandGenetics to the Department of Health, however, the Department confirmed that patient-identifiable data - which will soon be followed by genetic data - is being made available to private organisations without the consent of the indivdual.  After a series of exchanges between the Department and the EthicsandGenetics, the ‘for the public’ section on the CRPD website, which covers privacy and confidentiality, was finally brought a little closer to the reality of current practice. When the website was first set-up, it stated that all information shared through the CRPD is strictly anonymised and consent is alwayys sought. By the end of September, it was changed to the following: 

“CPRD Researchers never* get access to names, addresses, post codes or dates of birth. They also work under strict rules covered by legal agreements about what they can do with the data and what they must never do. CPRD is based around a service that has been operating for many years and we can state we are not aware of any breaches of our security policy.”

“*There are studies undertaken where patients give consent that some forms of identifiers can be accessed.” 

While this may be closer to the truth, it is impossible to reconcile it to the FoI disclosure by the Department of Health, which clearly states that identifiable information is made available through the CRPD without individual consent. Surely, given that it is our data,  a modicum of transparency would be the least we could expect. 

Let us reflect upon these developments. I am enthusiastic about the prospects of personalised medicine and proactive genomics. However, it is truly objectionable that promises of anonymity do not reflect the reality of current practice or the considerable changes that have taken place over the last decade. Whilst these changed have occured incrumentally, they amount to a cultural shift which has redefined the status of personal medical data and the legal framework that governs it. Given the salience of these developments, and our democratic credentials, the public must be afforded a more central role.

The impending scenario of personal medical information moving between public and private sectors puts the individual at risk of being targeted by aggressive marketing strategies based upon tenuous claims about genetic predisposition to illness. Pharmaceutical companies will create new 'needs' for products, the medical and scientific basis of which may be little more than conjecture. The commercialisation of personal medical data and the relaxation of the medical research framework, opens up the possibility that genomic information could be used for purposes far beyond the public good. Many now believe that the future of marketing lies in genetics; it doesn't take too long to make the right connections and appreciate that it could be imprudent to hand over our genomic information without serious consideration of the consequences.

At EthicsandGenetics, we believe that big decisions about new forms of biotechnology and  genomics ought to be democratised. Indeed, people should decide for themselves if there is a clear medical advantage, individual benefit or public good, to be found in handing over our entire genome for purposes far beyond our knowledge. In order to do this, more transparency, more public engagement, is vital.    

For more information, please refer to the EthicsandGenetics Report, 'Privacy, The CPRD and the Commercialisation of Personal Medical Information,' in the 'research' section of this website. For more background information and commentary, please refer to GeneWatchUK, 'A DNA database in the NHS.' 


Edward Hockings


Moratorium on Insurers' use of Genetic Tests

  • Published in Blog

The Moratorium on insurers’ use of predictive tests was recently extended and the UK Government has launched a consultation on how it is working in practice. The Moratorium is exclusively concerned with tests used to predict future illness. While EthicsandGenetics applauds these developments, as the Concordat is merely an agreement, the question remains: how long will it last for, and most importantly, the Government will eventually have to regulate this new terrain by way of legislation, when we arrive at this point, what kind of legislative measures can we expect? Can we assume that future legislation will broadly reflect the current Concordat? Let us firstly consider its substance.    

In brief: The Association of British Insurers (ABI) and the Government have agreed to the following measures:

A. To abide by a policy framework that ensures that insurers’ use of genetic information is transparent, fair and subject to regular reviews.

B. Remain committed to the voluntary Moratorium on insurers’ use of predictive genetic test results until November 2017, and the scheduled review of the Concordat in 2014.

It was also agreed that the Association of British Insurers will not seek to end the agreement before the end of the Moratorium, and the Government will not introduce legislation on the use of genetic test results or family history during the term of the agreement.

The overarching purpose of the Concordat is that it ensures 'fair rights of access.' In principle, the Concordat protects the interests of both customers and insurers by preserving customers’ access to insurance, and insurers’ right of equal access to information about the associated risks.

• It allowes people to take out substantial amounts of cover without having to disclose the results of predictive genetic tests.

• It promotes fair assessment and risk pricing in the interests of all past, present and future customers.

In addition to this, the Concordat seeks to create a "robust and flexible framework for cooperation" between the Government and the ABI and its members. The purpose of which is to “balance the needs of consumers to have fair rights of access to insurance with the need for a commercially viable, long term and fair insurance market.” It applies to “predictive genetic tests, which examine the structure of chromosomes (cytogenetic tests) or detect abnormal patterns in the DNA of specific genes (molecular tests). And doesn't apply to diagnostic genetic tests, nor does it apply to non-genetic medical tests, for example, blood or urine tests for cholesterol, liver function or diabetes.

Furthermore, applications to approve the use of predictive genetic test results by insurers will only be for conditions that are:

A. monogenic (single gene disorders that are inherited in a simple fashion);

B. late-onset (symptoms are delayed until adult ages); and of

C. high penetrance (a high probability that those with the gene will develop the disorder).


In sum: the UK Insurance community have effectively agreed to the following:

A. customers will not be asked, nor will they be put under pressure, to take a predictive genetic test to obtain insurance cover

B. customers who have taken a predictive test before the date of this Concordat will be treated in the same way as customers taking tests under the terms of the Concordat

C. customers will not be required to disclose any of the following:

i. A predictive genetic test result from a test taken after the insurance cover has started, for as long as that cover is in force

ii. The predictive test result of another person, such as a blood relative


With reference to the Concordat, Public Health Minister, Anne Milton said: “this is an excellent agreement that has benefited many consumers. The extension and strengthening of it will make sure that the public continue to have the confidence to use predictive genetic tests whilst being reassured that they can still get insurance.” Stephen Gay, Director of Life, Savings and Protection at the ABI added that: “the agreement on genetics and insurance has provided a lot of reassurance for people since its introduction. This is the second time it has been reviewed and extended, which means people will continue to be able to take out very sizeable amounts of insurance without having to disclose predictive genetic test results.”

According to the Human Genetics Commission (HGC), inexpensive whole-genome sequencing and greatly reduced costs for genetic tests in general, will provide the “platform for genetic testing to be used for novel and unpredicted purposes” (Report on 'The Concept of Genetic Discrimination', April 2011). Genetic descrimination in the workplace might indeed become one of these ‘novel and unpredicted purposes.’ As cases of genetic descrimination are becoming increasingly prevalent, the importance of the Concordat cannot be doubted. Most notably, in 2010, in the US, Pamela Fink took her former employees to court, claiming that she had been fired because of a mere genetic predisposition to cancer. Clearly, there can be no doubt that the Concordat meets a genuine need. 

Put simply, the Concordat makes an exception to the principle of disclosure. By ensuring that those with negative results from a genetic test are able to obtain significant levels of insurance without disclosing the results of that test. In short: it ensures ‘fair rights of access’ to insurance. It might be argued that insurers should be allowed to calibrate their risks in this area. As we know, some insurers are reluctant to offer insurance on the grounds of age - why is genetics any different? Indeed, as age is seen as a predictor of ill-health, the very same principle might be applied to genetics. Of course, genetic discrimination would effectively penalize people for DNA inherited from their parents, and being penalized because of something for which one is not responsible is both unfair and counter-intuitive.

Is the current Memorandum, perhaps, indicative of the government's uncertainty regarding how to regulate this area? The bigger question, perhaps, is how policy will evolve globally? Among the questions that need to be answered are: why should insurers be prevented from mitigating risks? What are so special about genes? Why haven't the Government sought to legislate on this earlier?

EthicsandGenetics agrees with the substance of the concordat and, the apparent willingness of the insurance community to agree to it, as well as the will of the Government to seek an agreement in the first place. But what is needed are substantive legislative measures, not a mere agreement which will soon elapse. Otherwise, we are waiting for something and it isn’t obvious what that is.

While the current policy framework on insurance and predictive genetic tests and, the consultation on how it is working in practice, are both a step in the right direction – more needs to be done to shape legislation on genetic discrimination.  Clear-sightedness about social values, is essential if we are to get our policies right in this new, troubling and immensely complex area. In the meantime, in order to ensure effective monitoring of the concordat, consumers and patient groups are invited to submit relevant evidence to the Department of Health. I would urge anyone with anything of relevance to contribute.


Edward Hockings

Subscribe to this RSS feed

Most Popular