Guidelines for the use of Genetic Information
The Body as Information
I must give credit where credit is due. The “body as information” is listed as one of the Office of the Privacy Commissioner of Canada’s (OPC) strategic privacy priorities, but as it affects every man, woman and child, is of interest to us all. On this topic, the OPC offers the following:
The information generated by our bodies is uniquely personal, and as such it can be highly sensitive. As more and more information about our bodies is collected and digitized, particularly by non-medical organizations and individuals, the impacts on privacy must be considered.
The Ontario Information and Privacy Commissioner (IPC) offered advice on genetic testing back in September 1992. In its Submission to the Ontario Law Reform Commission, the Commissioner at the time, Tom Wright, noted the following that still resonates today:
The complex issues surrounding genetic testing have been succinctly summarized in a U.S. Congress report in the following way:
The impact of genetic testing on privacy is one of the most significant and perplexing issues that society will face, as the availability and use of such testing practices becomes more widespread. If left unregulated, the potential exists for every individual to have his or her genetic code become publicly known. The implications of this possibility was recently characterized as follows:
The routine availability of identifiable genetic information about individuals may have effects that reach far beyond the provision of medical care. As the amount of detailed genetic information grows, society may be required to re-examine the basic principles of health and life insurance, review the rules that govern employment and hiring, reconsider the confidentiality rules that are part of the doctor-patient relationship, and, in general reassess the way in which individuals are categorized and treated in a variety of social and economic relationships.
As further advancements are made around genetic testing, more emphasis is being placed on the emerging field of “personalized medicine.” However, at the same time, that same information could be used in insurance or employment related contexts, not to the subject individuals benefit, if unregulated.
Through a Saskatchewan Lens
In terms of privacy protection, Saskatchewan has three access and privacy laws to which this office provides oversight:
- The Freedom of Information and Protection of Privacy Act (FOIP);
- The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP); and
- The Health Information Protection Act (HIPA).
FOIP and LA FOIP provide rules around the collection, use and disclosure of personal information. In the event that a local authority is not also a trustee under HIPA, personal health information is treated as personal information under that Act. In particular, subsection 23(1)(c) of LA FOIP provides that “information that relates to health care that has been received by the individual or to the health history of the individual.”
HIPA deals only with personal health information. Is genetic information captured under the definition of personal health information? We think so. Not only does the definition include “information with respect to the physical or mental health of the individual,” but also “information with respect to the donation by the individual of any body part or any bodily substance of the individual or information derived from the testing or examination of a body part or bodily substance of the individual.”
Many that would make use of genetic information are not bound by our provincial access and privacy laws. The federal law, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies in Saskatchewan to a certain extent but this office does not provide oversight. That responsibility falls on the OPC.
Also explored in the Ontario IPC publication, referenced above, are the following privacy interests that come into play:
The privacy interest in genetic information arises in several contexts:
- the right not to have one’s genetic information collected;
- if the authority to collect exists, the right not to have one’s genetic information used for unauthorized purposes;
- the right not to have one’s genetic information disclosed to a third party; and
- the right not to know one’s own genetic information.
Being in control of one’s own genetic information, and being able to determine if and how that information should be collected and used, is the central question from a privacy perspective.
Without an autonomous ability to have control over one’s own genetic information, the individual could become vulnerable to a variety of adverse consequences that could alter one’s life. In this context, the notion of “informational self-determination” as the right of an individual to determine the scope and degree to which he or she will reveal personal information about him or herself, takes on particular significance.
FOIP, LA FOIP and HIPA include rules to regulate the collection, use and disclosure of personal information/personal health information so some protections do exist. Further, with the proclamation of Bill 30 and Bill 31, a new duty to safeguard will be introduced to FOIP and LA FOIP as already found in HIPA. That new provision, from Bill 30 for example, reads as follows:
Duty of government institution to protect
24.1 Subject to the regulations, a government institution shall establish policies and procedures to maintain administrative, technical and physical safeguards that:
(a) protect the integrity, accuracy and confidentiality of the personal information in its possession or under its control;
(b) protect against any reasonably anticipated:
(i) threat or hazard to the security or integrity of the personal information in its possession or under its control;
(ii) loss of the personal information in its possession or under its control; or
(iii) unauthorized access to or use, disclosure or modification of the personal information in its possession or under its control; and
(c) otherwise ensure compliance with this Act by its employees.
The Risk of Discrimination
None of our privacy laws have provisions that specifically address the issue of discrimination based on genetic history. However, authorized purposes for the collection, use and disclosure of the personal health information in question are spelled out by these Acts and would arguably limit such uses. Further protections may be found in human rights legislation, Bill S-201, the Genetic Non-Discrimination Act (received Royal Assent on May 4th, not yet proclaimed) and other amendments to Canadian Labour Law. Commissioner Therrien noted the following in a news release dated May 5, 2017:
… he expects organizations subject to Canada’s federal private sector privacy law to re-examine their practices related to genetic tests and bring them in line with the new law. In light of Parliament’s passage of S-201, organizations that require genetic test results as a condition of providing a good or service will also generally be considered in contravention of the Personal Information Protection and Electronic Documents Act (PIPEDA).
The BC Civil Liberties Association prepared a publication in 2012 titled Genetic Privacy and Discrimination, An Overview of Selected Major Issues. On the topic of the relationships between the private sector and individuals – insurance and employment, the following is offered:
Employers may try to make a business case for obtaining genetic information about job applicants or employees. Such information might prove useful in making decisions about employing individuals and assigning them to certain tasks. Genetic testing in employment could take various forms:
- susceptibility testing – testing that leads to the identification of a genetic mutation that makes people more susceptible to developing a disease or condition when exposed to certain environmental hazards;
- pre-symptomatic testing – testing carried out on healthy individuals to determine whether they carry a genetic mutation that increases their likelihood of developing a genetic condition;
- diagnostic testing – confirming a particular diagnosis through a genetic test.
In addition, employers may want to conduct genetic monitoring of current employees. This involves examining a person’s genetic profile over time to determine if any genetic mutations (changes) occur.
In short, genetic information may be of interest to employers:
- to assess suitability for employment now (using diagnostic testing);
- to assess suitability for employment in the long term (using susceptibility or presymptomatic testing of a currently healthy individual);
- to assess the genetic consequences of exposure to certain workplace or environmental materials or contaminants – for example, radiation or chemicals (using genetic monitoring).
Employees or job applicants may also be interested in acquiring such information, but to advance their own welfare and assist them in decisions about which employment to take. However, they may well not want that information shared with employers who may then use it to the employees’ disadvantage.
Canada appears to have no legislation specifically directed at genetic testing in employment. However, a range of more general legislation may apply. The Charter of Rights and Freedoms may govern attempts by government institutions to genetically test employees or job applicants.
The Charter guarantees of equality would apply to federal and provincial government employers and could prevent discrimination on the basis of disability or perceived disability revealed by genetic testing of a worker. As well, in the narrow circumstance of a private sector organization acting in furtherance of a specific governmental program or policy, the conduct of the private entity might be subject to the Charter.
General privacy legislation might also apply: the federal Privacy Act for federal institutions, PIPEDA for employees of federally regulated private sector organizations, and provincial data protection legislation for provincially regulated private sector employees. In addition, four provinces have statutory privacy torts, and the Civil Code of Québec includes principles relating to respect for privacy. A common law right to privacy may be evolving, and several other common law principles may apply to genetic testing in employment – for example, civil battery or breach of contract.
Although cumbersome, human rights legislation does offer some protection against discrimination in employment. Still, there may be merit in specific legislation banning genetic testing in employment, or banning employer access to genetic test results, to prevent the abuse of genetic information. Another possible solution would be to create property rights in DNA or genetic information, as some US states have done. Stronger privacy laws of general application would offer yet another layer of protection.
In terms of HIPA, consent is required before an employer can use personal health information for an employment related purpose. That subsection provides as follows:
26(3) Nothing in subsection (2) authorizes a trustee as an employer to use or obtain access to the personal health information of an individual who is an employee or prospective employee for any purpose related to the employment of the individual without the individual’s consent.
The OPC’s website includes a policy statement on the use of genetic test results by life and health insurance companies (https://www.priv.gc.ca/en/opc-news/news-and-announcements/2014/s-d_140710/) dated July 10, 2014. Of particular interest are the following excerpts:
Based on our analysis, it is not clear that the collection and use of genetic test results by insurance companies is demonstrably necessary, effective, proportionate or the least intrusive means of achieving the industry’s objectives at this time.
Taking into consideration:
- the highly sensitive nature of genetic test results;
- the low predictive value of many genetic test results;
- that, at the present time, few people hold actuarially significant test results;
- the rare occurrence of monogenic disorders;
- the unregulated nature of the DtC industry and questions about the accuracy, validity and utility of DtC results;
- the public interest in encouraging individuals to voluntarily participate in health research without fear that their test results will be used for unrelated purposes;
- the importance of creating an environment in which individuals feel free to undergo medically valuable genetic tests without worrying about the impact on their ability to obtain insurance; and
- evidence that restricting insurers’ access to genetic test results would not have a significant adverse impact on the viability of the life and health insurance industry,
we, therefore, urge the life and health insurance industry to expand its voluntary moratorium, that currently calls on its members to refrain from asking applicants to undergo genetic testing, to also refrain from requesting access to existing genetic test results until such time as they can be shown to be demonstrably necessary and effective. Recognizing that the state of medical technology is changing rapidly, this position should be revisited on a periodic basis.
In Saskatchewan, both Saskatchewan Government Insurance and Saskatchewan Workers’ Compensation Board are, in part, bound by FOIP and HIPA. As such, this office is able to respond to complaints regarding personal information/personal health information that is maybe being collected for a purpose not originally contemplated by enabling legislation.
So where does this leave us? For now, we all must wait to see if Bill S-201 is proclaimed and whether any legal action results. This office has yet to receive a complaint involving genetic testing related material; however, it is only a matter of when for all the reasons noted above. In terms of investigating any complaint, this office is limited to those organizations that this office provides oversight. The OPC under PIPEDA does afford some privacy protection in Saskatchewan but is limited as it does not offer protection to employee personal information in the following circumstances:
It should be noted that PIPEDA does not apply to organizations that are not engaged in commercial activity. As such, it does not generally apply to not-for-profit and charity groups, associations or political parties, for example—unless the organization is conducting a commercial activity (fundraising is not considered a commercial activity).
- Private-sector organizations carrying on business in Canada in the provinces or territories of Manitoba, New Brunswick, Newfoundland and Labrador, Northwest Territories, Nova Scotia, Nunavut, Ontario, Prince Edward Island, Saskatchewan, or Yukon but not their handling of employee information.
- Private-sector organizations carrying on business in Canada when the personal information they collect, use or disclose crosses provincial or national borders but not their handling of employee information.
In light of this, as for other reasons, this office is recommending that Saskatchewan follows the other western provinces and enact its own private sector privacy law to cover the gaps. A draft is in the works.