The Eighth Asian Bioethics Conference Biotechnology, Culture, and Human Values in Asia and Beyond Confidentiality and Genetic data: Ethical and Legal Rights and Duties. An European Perspective Dr Sergio Romeo-Malanda March 2007, Bangkok CENTRE FOR LAW AND GENETICS

1 Right to Privacy and Right to Data Protection (I) European Convention on Human Rights, of 4 November 1950, Article 8 : 1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

1 Right to Privacy and Right to Data Protection (II) Right to privacy in ECHR : Society must guarantee respect for privacy as essential to the individual’s develoment; Privacy is not an absolute but a relative right. In particular, the protection of health is mentioned

1 Right to Privacy and Right to Data Protection (III) Right to privacy in relation to health: Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine: Convention on Human Rights and Biomedicine, of 4 April 1997, Article 10: “Everyone has the right to respect for private life in relation to information about his or her health” Recommendation No. R (97) 5 on the Protection of Medical Data, of 13 February 1997, Principle 3.1: “The respect of rights and fundamental freedoms, and in particular of the right to privacy, shall be guaranteed during the collection and processing of medical data”

1 Right to Privacy and Right to Data Protection (IV) Charter of Fundamental Rights of the European Union, of 7 December 2000, Article 8: Right to data protection 1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority”.

1 Right to Privacy and Right to Data Protection (V) Directive 95/46/EC, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, of 24 October 1995: Principles of data protection Principle of self-determination Right of access to information

1 Right to Privacy and Right to Data Protection (VI) Right to Self-determination and Consent Directive 95/46/EC, Article 8.2.a): data subject must give his or her explicit consent to the processing of personal data concerning health. Recommendation No. R (92) 3 on genetic testing and screening for health care purposes, of 10 February 1992, Principle 5: “the provision of genetic services should be based on respect for the principle of self-determination of the persons concerned. For this reason, any genetic testing, even when offered systematically, should be subject to their express, free and informed consent”.

1 Right to Privacy and Right to Data Protection (VII) Right of access to information Directive 95/46/EC, Articles 10 and 11: the data subject has a right to receive information, both when the data is collected directly from said data subject and when the data has not been obtained from said data subject. Directive 95/46/EC, Article 12: Right of access: right to obtain without constraint at reasonable intervals and without excessive delay or expense: a) confirmation as to whether or not data relating to him are being processed; and b) communication in an intelligible form of the data undergoing processing and of any available information as to their source. Recommendation R (97) 5, Principle 8.1: “Every person shall be enabled to have access to his/her medical data, either directly or through a health-care professional or, if permitted by domestic law, a person appointed by him/her. The information must be accessible in understandable form”.

2 Right to Privacy and Duty of Confidentiality (I) Distinction between “privacy” and “confidentiality”: Privacy is a broader concept, that involves the right to control one’s own personal information. Confidentiality is one means of protecting information, usually in the form of keeping that information protected from disclosure.

2 Right to Privacy and Duty of Confidentiality (II) Recommendation R (92) 3, Principle 9 : “Persons handling genetic information should be bound by professional rules of conduct and rules laid down by national legislation aimed at preventing the misuse of such information and, in particular, by the duty to observe strict confidentiality. Personal information obtained by genetic testing is protected on the same basis as other medical data by the rules of medical data protection”.

2 Right to Privacy and Duty of Confidentiality (III) Conflict of interests: a) the data subject will have an interest in the protection of his/her personal data. b) certain legal entities or individuals may show an interest in gaining knowledge or making use of the very data which the subject would like to safeguard (e.g. blood relatives) The subject himself or herself will agree to inform close family members. Does the doctor have a duty to inform the interested parties?

2 Right to Privacy and Duty of Confidentiality (IV) Convention on Human Rights and Biomedicine, Articles 10.1 and 26: Article 10.1: “Everyone has the right to respect for private life in relation to information about his or her health” Article 26.1: “No restrictions shall be placed on the exercise of the rights and protective provisions contained in this Convention other than such as are prescribed by law and are necessary in a democratic society in the interest of public safety, for the prevention of crime, for the protection of public health or for the protection of the rights and freedoms of others”)

2 Right to Privacy and Duty of Confidentiality (V) Recommendation No. R (92) 3, Principle 9: “In the case of a severe genetic risk for other family members, consideration should be given, in accordance with national legislation and professional rules of conduct, to informing family members about matters relevant to their health or that of their future children” Recommendation No. R (97) 5, Principle 7.3: “Medical data may be communicated if they are relevant and: a. if the communication is provided for by law and constitutes a necessary measure in a democratic society for … iv. the protection of the rights and freedoms of others; or b. if the communication is permitted by law for the purpose of: i. the protection of the data subject or a relative in the genetic line “

3 Conclusion Health and genetic information is sensitive information that must be highly protected; In exceptional situations, that information can be communicated to certain other people, even when this goes against the will of the data subject.

Thank you! CENTRE FOR LAW AND GENETICS