Molecular medicine and medical genetics are at the forefront of new and emerging health technologies. With these new techniques and discoveries come new challenges for the law, especially on the privacy front.
Earlier this year, I referenced Bills S-201 and 127 as legislative examples of society attempting to prevent the misuse of genetic information. In particular, there is a concern that incomplete knowledge or understanding of genetic predispositions, and still evolving understandings of how multiple genomes interact with each other, could result in logically skewed and flawed conclusions about employees or the insured, and result in a form of unwarranted discrimination.
Earlier this week, the Office of the Privacy Commissioner of Canada released a joint guidance with the respective privacy commissioners in Alberta and B.C. on direct to consumer genetic testing, as well as a policy statement on the collection, use, and disclosure of genetic information. Both of these follow the adoption of Bill S-201, which received Royal Assent on May 4, 2017.
Concerns over private recreational genetic testing companies have been around for years, and have largely focused on identifying Y-chromosome or mtDNA haplogroups for the purported purposes of identifying ethnic ancestry. Of course, given the extensive human migrations over the millennia, these findings are largely presumptive, and only provide limited information about a single line of ancestors on either parental line. Medical testing has historically been far more infrequent, but is becoming a product that many patients are inquiring and requesting of their physicians.
The joint guidance notes that when this information is shared on a social media type site, which many of these services offer to help identify distant relatives, it can be difficult for this information to be removed. Use of this information for research purposes however should cease once consent is withdrawn. The joint guidance states,
Given the sensitive nature of genetic or genomic information, companies should not be able to simply assume you have given your implied consent or otherwise pressure you into accepting the proposed collection, use or disclosure. Rather, they must first ask you if you agree to do so voluntarily, and if you do, your consent must be provided in writing.
They note that given the lack of accreditation or certification, there is little quality control over the accuracy of results. However, the greater challenge may not in fact be in the accuracy of the genetic information provided, but rather the oversimplifications imparted to the consumer about what the genetic findings may mean.
The policy statement focuses more on compliance with the Personal Information Protection and Electronic Documents Act. Although the Genetic Non-Discrimination Act now makes it illegal for an organization to require individuals to undergo genetic testing or provide their results in order to obtain a product or service, or as a condition of a federally regulated business’ employment, individuals may still provide this information voluntarily. Even where this occurs, there are limits as to how this information may be collected, used or disclosed,
Generally speaking, an organization subject to federal or provincial privacy laws must ensure that its collection, use or disclosure of personal information is for purposes that a reasonable person would consider are appropriate in the circumstances. Collection, use or disclosure of personal information that contravenes the laws of Canada would not be considered appropriate by a reasonable person.
The most interesting aspect of this is the pushback experienced primarily by insurance companies on the new legislative changes. The Federal Minister of Justice announced earlier this year that she intends to refer the Act to the Supreme Court of Canada over its constitutionality. The Privacy Commissioner’s policies will be accordingly modified if there is any further legal developments in this area.