Charting the Privacy Landscape in Canadian Paediatric Biobanks

CHARTING THE PRIVACY LANDSCAPE IN CANADIAN PAEDIATRIC BIOBANKS

Edward S. Dove, Lee Black, Denise Avard & Bartha M. Knoppers*

1. Introduction: The Evanescence of PrivacyIs unpacking the meaning of privacy a Sisyphean ordeal? While privacy has long been considered a “universal,”1 it is also labelled a “chameleon-like word,”2 “protean,”3 “ephemeral,”4 a “black box,”5 a “haystack in a

* Edward S. Dove, LLM, is an Academic Associate at the Centre of Genomics and Policy, Department of Human Genetics, Faculty of Medicine, McGill University. Lee Black, LLM, is an Academic Associate at the Centre of Genomics and Policy and a DCL (PhD) candidate at McGill University, Faculty of Law. Denise Avard, PhD, is Research Director at the Centre of Genomics and Policy and an Associate Professor in the Department of Human Genetics, Faculty of Medicine, McGill University. Bartha M. Knoppers, PhD, OC, OQ, is Director of the Centre of Genomics and Policy and Canada Research Chair in Law and Medicine. All authors acknowledge and thank the Offi ce of the Privacy Commissioner of Canada (OPC), the Maternal Infant Child and Youth Research Network (MICYRN), the Finding of Rare Disease Genes (FORGE) in Canada Project, and the Réseau de médecine génétique appliquée (RMGA) for funding to support this research and publication.

1 Judith Wagner DeCew, In Pursuit of Privacy: Law, Ethics, and the Rise of Technology (Ithaca, NY: Cornell University Press, 1997) at 12.

2 Lillian R BeVier, “Information About Individuals in the Hands of Government: Some Refl ections on Mechanisms for Privacy Protection” (1995) 4 Wm & Mary Bill Rts J 455 at 458.

3 R v Tessling, [2004] 3 SCR 432 at para 25, 63 OR (3d) 1, Binnie J [Tessling]; Tom Gerety, “Redefi ning Privacy” (1977) 12 Harv CR-CLL Rev 233 at 234.

4 Ontario (AG) v Dieleman (1994), 20 OR (3d) 229 at para 568, 117 DLR (4th) 449 (Ont Gen Div).

5 Lars Øystein Ursin & Kristin Solum Steinsbekk, “Peeking into the Black Box of Privacy – Biobank Participants on the Importance of Recognition” (2012) 21:2 Norsk Epidemiologi 269.

Health Law Journal Volume 20 (2013)2

hurricane,”6 and a “broad and somewhat evanescent concept.”7 One wonders if a defi nition is possible or even necessary given that privacy instruments, such as the statutory privacy torts in Canada, do not state what privacy means.8 Some scholars have nobly attempted defi nitions,9 while others contend that any attempt to circumscribe privacy in a uniform and mono-lithic manner would undermine the richness, context-dependency, fl uidity and malleability of the concept.10

6 Ettore v Philco Television Broadcasting Co, 229 F (2d) 481 at 485 (3d Cir 1956). 7 Dagg v Canada (Minister of Finance), [1997] 2 SCR 403 at para 67, 148 DLR (4th)

385, La Forest J, dissenting. 8 Privacy Act, RSBC 1996, c 373; Privacy Act, RSNL 1990, c P-22; The Privacy Act,

RSS 1978, c P-24; The Privacy Act, CCSM c P125. 9 See e.g. Graeme Laurie, Genetic Privacy: A Challenge to Medico-Legal Norms

(Cambridge, UK: Cambridge University Press, 2002) (viewing privacy as a “state of affairs”, rather than a right or claim, which contains an informational and spatial component); Daniel J Solove, “A Taxonomy of Privacy” (2006) 154 U Pa L Rev 477; Daniel J Solove, Understanding Privacy (Cambridge, Mass: Harvard University Press, 2008) (privacy is “[a] set of protections from a plurality of problems that all resemble each other, yet not in the same way” at 100); DeCew, supra note 1 (privacy is “whatever types of information and activities [that] are not, according to a reasonable person in normal circumstances, the legit-imate concern of others” at 58); Anita L Allen, “Genetic Privacy: Emerging Concepts and Values” in Mark A Rothstein, ed, Genetic Secrets: Protecting Privacy and Confi dentiality in the Genetic Era (New Haven, CT: Yale University Press, 1997) 31 (situating privacy within four dimensions: informational privacy concerns about access to personal information; physical privacy concerns about access to persons and personal spaces; decisional privacy concerns about govern-mental and other third-party interference with personal choices; and propri-etary privacy concerns about the appropriation and ownership of interests in human personality); Kendall Thomas, “Beyond the Privacy Principle” (1992) 92 Colum L Rev 1431 (dividing the US constitutional right to privacy into three paradigms: zonal, relational and decisional).

10 Sonia Le Bris & Bartha M Knoppers, “International and Comparative Perspec-tives of Privacy” in Rothstein, supra note 9, 418 at 438. See also James Q Whitman, “The Two Western Cultures of Privacy: Dignity versus Liberty” (2004) 113 Yale LJ 1151 (contrasting American privacy norms based on protecting primarily a liberty interest and European privacy norms based on protecting dignity and personal honour); Avner Levin & Mary Jo Nicholson, “Privacy Law in the United States, the EU and Canada: The Allure of the Middle Ground” (2005) 2 U Ottawa L & Tech J 357 (fi nding that Canadian privacy protection, in

Dove, Black, Avard & Knoppers Paediatric Biobanks 3

Philosophical, ontological and semantic debates aside, most seem to agree that privacy encompasses an ability “to be left alone”11 and to exercise some degree of control over access to and use of personal information.12 This is refl ected in privacy legislation and policies across much of the world,13 and continues to infl uence its legislative reform and passage as society moves into the digital age.14 The desire for informational self-control coincides with the increasing tension between (post)modern mobility-driven autonomy and technoscientifi c innovations that transform “life itself.”15 And so, while

contrast to the US and EU, is focused on individual autonomy through personal control of information).

11 Samuel C Warren & Louis D Brandeis, “The Right of Privacy” (1890) 4 Harv L Rev 193 at 195. Warren and Brandeis implied that the right to privacy is a special case of the “right to be let alone.” The notion of a right to be let alone was fi rst advanced in Thomas M Cooley, A Treatise on the Law of Torts, or the Wrongs Which Arise Independent of Contract (Chicago: Callaghan & Co, 1880).

12 This statement is made with the assumption that much of this Journal’s reader-ship resides in societies that subscribe to the privacy values described in this article.

13 See e.g. OECD, Recommendation of the Council concerning Guidelines governing the Protection of Privacy and Transborder Flows of Personal Data (Paris: OECD, 2013) [OECD 2013 Guidelines]. See also Graham Greenleaf, “The Infl uence of Euro-pean Data Privacy Standards Outside Europe: Implications for Globalization of Convention 108” (2012) Int’l Data Privacy L 68. In 1970, and in response to growing concerns about databanks of sensitive information on citizens, the Parliament of the German federal state of Hesse enacted the world’s fi rst comprehensive information privacy statute. See Spiros Simitis, “Privacy – An Endless Debate?” (2010) 98 Cal L Rev 1989.

14 See e.g. EC, Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), COM (2012) 11 fi nal (25 January 2012).

15 DeCew, supra note 1 (“[a]nthropological literature documents the increased physical and psychological opportunities in modern societies to gain privacy through anonymity, mobility, and economic autonomy. At the same time, however, greater population density, technological advances, and increased governmental power all undermine an individual’s ability to maintain a private space within a broader social community” at 13). See also Peter Burns, “The Law and Privacy: the Canadian Experience” (1976) 52 Can Bar Rev 1 (“[t]he pressing need to preserve ‘privacy’ which is being threatened by science and technology to the point of surrender” at 1).


privacy as a concept may forever remain ephemeral, within the dimen-sion of information privacy, one may fi nd use in the defi nition provided by the Supreme Court of Canada: “the right of the individual to determine for himself when, how, and to what extent he will release personal information about himself.”16

Two questions arise from this defi nition, however, at least for the purposes of this Article. First, does information privacy differ in ambit and application when the individual is generally considered vulnerable, such as a child? Recently, the Supreme Court has suggested that children may be deserving of enhanced privacy protection. It noted that “the inherent vulner-ability of children has consistent and deep roots in Canadian law,”17 resulting in protection for young people’s privacy in various national statutes and international conventions. The Court quoted favourably an Ontario Court of Justice decision regarding young persons:

Privacy is recognized in Canadian constitutional jurisprudence as implicating liberty and security interests. In Dyment, the court stated that privacy is worthy of constitutional protection because it is “grounded in man’s physical and moral autonomy,” is “essential for the well-being of the individual,” and is “at the heart of liberty in a modern state” (para. 17). These considerations apply equally if not more strongly in the case of young persons. Furthermore, the constitutional protection of privacy embraces the privacy of young persons, not only as an aspect of their rights under section 7 and 8 of the Charter, but by virtue of the presumption of their diminished moral culpa-bility, which has been found to be a principle of fundamental justice under the Charter.

. . .

[T]he protection of the privacy of young persons fosters respect for dignity, personal integrity and autonomy of the young person. [Emphasis added]18

16 R v Duarte, [1990] 1 SCR 30 at para 25, 65 DLR (4th) 240, La Forest J. 17 AB v Bragg Communications Inc, 2012 SCC 46 at para 17, [2012] 2 SCR 567,

Abella J [emphasis in the original]. 18 Ibid. at para. 18, citing Toronto Star Newspaper Ltd v Ontario, 2012 ONCJ 27 at

paras 40-41, 44, 255 CRR (2d) 207, Cohen J.


A second question is how well does information privacy law, even when purposively drafted in abstract language to anticipate unknown trajectories and technoscientifi c innovations, cover emerging areas such as biobanks?19 Indeed, one of the most pressing issues at the intersection of children and biobanks is the robustness of structures – legal, ethical20 or otherwise – that both protect privacy and facilitate international research collaboration. Paediatric biobanks must navigate the rapids of socio-ethical, professional and legal norms while simultaneously advancing knowledge in biomedical research. Some of these norms transcend national boundaries, such as the requirement to obtain voluntary and informed consent. Others are location-specifi c and contextual, dependent on research ethics board (REB) over-sight, legislative decree or biobank governance infrastructure. A grand chal-lenge is properly addressing privacy issues that impact not only biobanks in general, but paediatric biobanks specifi cally.

This Article explores the legal contours of information privacy by systematically analyzing it in the context of Canadian paediatric biobanks that are created and used for research purposes, and that serve to acquire scientifi c and medical knowledge for the benefi t of children’s (and society’s)

19 Biobanks are defi ned in Section 3, infra. 20 Non-legal ethical norms play a critical role in Canadian biobanks. For instance,

biobanks that receive funding from any of the three major Canadian federal funding agencies (Canadian Institutes of Health Research, Natural Sciences and Engineering Research Council, and Social Sciences and Humanities Research Council), or are part of institutions that are eligible to receive and administer research funding from any of these three agencies, must ensure that their governance framework and policies conform to ethical standards established by the second edition of the Tri-Council Policy Statement (TCPS), which governs research involving human subjects: Interagency Advisory Panel on Research Ethics, 2nd Edition of the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (Ottawa: Her Majesty the Queen in Right of Canada, 2010) [TCPS]. Certain health and social service institutions in provinces also have policies endorsing the TCPS (e.g. the Ministère de la Santé et des Services sociaux du Québec). See Centre of Genomics and Policy (CGP), Maternal Infant Child and Youth Research Network (MICYRN), Best Practices for Health Research Involving Children and Adolescents, 2012, online: Centre of Genomics and Policy <http://www.genomicsandpolicy.org/best-practices.html> [Best Practices]. See also Edward S Dove et al, “Emerging Issues in Paediatric Health Research Consent Forms in Canada: Working Towards Best Practices” (2013) 14 BMC Medical Ethics 5 [Dove et al, “Emerging Issues”].


health and development. Paediatric biobanks are rapidly evolving in terms of governance structures, participant population size, geographic distri-bution and fi eld(s) of study.21 Ensuring that personal information is suffi -ciently protected by way of legislation is challenged by such burgeoning and evolving advances in technology, particularly in genetics and genomics.22

We assess whether there are legislative limits to the effectiveness and regulatory oversight needed to adequately protect children’s privacy in paediatric biobanks;23 and if so, how to improve the status quo so as to foster public trust in paediatric health research using biobanks. Section 2 outlines the methodology for our case study of three paediatric biobanks and rele-vant privacy legislation. Section 3 discusses the Canadian biobank frame-work. Section 4 briefl y explores the relevant legislative privacy framework in Canada. Section 5 analyzes the applicability of the privacy framework to paediatric biobanks and explores three policy issues framing the privacy landscape in paediatric biobanks: (1) the use and transfer of the child’s data and samples; (2) the risks of unauthorized access by third parties; and (3)

21 See e.g. Emmanuelle Lévesque & Bartha M Knoppers, “Principes assurant la protection des enfants participant à des biobanques: du stade prénatal jusqu’aux adolescents” (2011) 5:2 McGill JL & Health 163; Elena Salvaterra et al, “Pediatric

Biobanking: A Pilot Qualitative Survey of Practices, Rules, and Researcher Opinions in Ten European Countries” (2012) 10:1 Biopreservation and Biobanking 29.

22 Marie Hirtle, “Children and Genetics: Comparative Study of International Policy Positions” (1998) 6 Health LJ 43.

23 Admittedly, “adequate protection” of children’s privacy is a vague notion, further challenged by the fact that the perspective of adequacy can vary greatly, depending on whether it is from a child’s or an adult’s. It is possible to employ certain principles to assess an area of regulation like privacy laws and biobanking: see e.g. Robert Baldwin & Martin Cave, Understanding Regulation: Theory, Strategy, and Practice (Oxford: Oxford University Press, 1999); Better Regu-lation Task Force, Regulation – Less is More: Reducing Burdens, Improving Outcomes: A BRTF Report to the Prime Minister (London, UK: Better Regulation Executive, 2005). To focus our research and stay within the spacing limits of this Article, however, we limit our assessment to adequacy rather than other principles such as proportionality, accountability, consistency, transparency or targeting. We defi ne “adequate protection” as privacy laws and regulatory content and mech-anisms that effectively and consistently protect a child’s personal information from unlawful breach, as viewed from a reasonable adult person, in the light of all the normal circumstances in Canada.


the nature of the shared relationship between the child, the parents24 and the researcher. Each issue includes an examination of the legal and biobank practice dimensions that affect the processes and outcomes of paediatric biobanking and privacy protection. Section 6 provides recommendations to ameliorate the shortcomings in the current Canadian privacy landscape and Section 7 concludes the Article.

2. Research MethodologyTo chart the privacy landscape in Canadian paediatric biobanks, we under-took a legislative, jurisprudential and doctrinal analysis of relevant privacy laws through research on Westlaw Canada, LexisNexis Quicklaw, CanLII, HeinOnline, Google Scholar, and provincial/territorial and federal parlia-mentary websites. We also consulted A Compendium of Canadian Legislation Respecting the Protection of Personal Information in Health Research,25 developed by the Canadian Institutes of Health Research (CIHR) and last updated in 2005, as a base-point reference. The authors interpreted the legislation to determine the extent to which it applies to paediatric biobanks.

According to the Inventory of Pregnancy and Birth Cohort Studies in Canada, as of December 2009, there were at least 18 Canadian paediatric biobanks.26 In line with our defi nition of a paediatric biobank (Section 3), we selected three publicly funded Canadian biobanks constructed for research purposes, whose names have been anonymized: (1) Biobank A; (2) Biobank B; and (3) Biobank C. These biobanks were chosen because they differ in geographic scope (Québec and eastern Ontario-based versus pan-Canadian), type (popu-lation-based versus disease-based), participant population (pregnant women and children versus only children), participant duration (ranging from preg-nancy to two years or from birth through adulthood) and size (ranging from 500 to 15,000 participants). Table 1 summarizes the diversity of characteris-

24 For this Article, “parent(s)” includes legal representative(s), legal guardian(s) or other substitute decision-makers.

25 Canadian Institutes of Health Research, Adam Kardash & Antonella Penta, eds, A Compendium of Canadian Legislation Respecting the Protection of Personal Informa-tion in Health Research (Ottawa: Public Works and Government Services Canada, 2005).

26 Canadian Institutes of Health Research (CIHR) et al, Inventory of Pregnancy and Birth Cohort Studies in Canada, online: MICYRN

<http://www.micyrn.ca/databases/afhlistallrecords.asp>.


tics. Information was obtained from one or more sources: policies listed on each biobank’s website; consent forms available on each biobank’s website or provided to us personally; and personal correspondence with the biobank researchers, ethicists, consultants and administrators.

3. The Canadian Paediatric Biobank Framework

3.1 Defi ning “Paediatric Biobank”Achieving a common and broadly applicable defi nition of “paediatric biobank” has proven diffi cult given that biobanks are by nature diverse, fl uid and imprecise “boundary objects.”27 In addition, the terms “child” or “minor,” which can be used as broad synonyms for “paediatric,” must be explicated. In Canada, a minor is a person who is not an adult, non-eman-cipated, and is under the age of majority (18 or 19 years of age is considered the legal age of majority, depending on the jurisdiction).28 Where addressed,

27 Kristien Hens et al, “Developing a Policy for Paediatric Biobanks: Principles for Good Practice” (2013) 21 European Journal of Human Genetics 2 [Hens et al, “Principles”]; Edward S Dove, Yann Joly & Bartha M Knoppers, “Power to the People: A Wiki-Governance Model for Biobanks” (2012) 13 Genome Biology 158; Peter H Watson & Rebecca O Barnes, “A Proposed Schema for Classifying Human Research Biobanks” (2011) 9:4 Biopreservation and Biobanking 327; Catherine Heeney, “Dynamic Networks of Practice” in Jane Kaye et al, Governing Biobanks: Understanding the Interplay between Law and Practice (Oxford: Hart Publishing, 2012) 93 [Kaye et al, Governing Biobanks]; Susan MC Gibbons, “Regulating Biobanks: A Twelve-Point Typological Tool” (2009) 17:3 Med L Rev 313. See also James R Griesemer & Susan Leigh Star, “Institutional Ecology, ‘Translations’ and Boundary Objects: Amateurs and Professionals in Berkeley’s Museum of Vertebrate Zoology, 1907-39” (1989) 19:3 Social Studies of Science 387 (describing boundary objects as entities that can be interpreted in different ways by different communities but are robust enough to maintain an identity across them).

28 The age of majority is 18 years of age in Alberta (Age of Majority Act, RSA 2000, c A-6, s 1), Manitoba (The Age of Majority Act, CCSM, c A7, s 1), Ontario (Age of Majority and Accountability Act, RSO 1990, c A7, s 1), Québec (art 153 CCQ), Prince Edward Island (Age of Majority Act, RSPEI 1988, c A-8, s 1) and Saskatch-ewan (The Age of Majority Act, RSS 1978, c A-6, s 2). The age of majority is 19 years of age in British Columbia (Age of Majority Act, RSBC 1996, c 7, s 1), New Brunswick (Age of Majority Act, RSNB 1973, c A-4, s 1(1)), Newfoundland and

Labrador (Age of Majority Act, SNL 1995, c A-4.2, s 2), the Northwest Territories


the age for consent to medical care or to research varies across Canada,29 and can include the common law “mature minor” doctrine, which focuses more on the capabilities of the minor to understand, rather than a presumed age of consent to medical care or research30 (though, according to the Supreme Court, it does not mean “automatic judicial deference to the young person’s medical treatment decisions where doing so will put the adolescent’s life or health in grave danger”31).

For the purposes of this Article, a paediatric biobank is defi ned as a systematically organized and searchable collection of data and material

(Age Of Majority Act, RSNWT 1988, c A-2, s 2), Nova Scotia (Age of Majority Act, RSNS 1989, c 4, s 2(1)), Nunavut (Age Of Majority Act, RSNWT ((Nu)) 1988, c A-2, s 2) and the Yukon (Age of Majority Act, RSY 2002, c 2, s 1(1)).

29 In the medical context, the law respecting consent to medical treatment of persons who have attained the age of majority may apply to minors who have

attained an age of less than 18 years. In New Brunswick, for example, the law respecting consent to medical treatment of persons who have attained the age of majority applies, in all respects, to minors who have attained the age of 16 years in the same manner as if they had attained the age of majority: Medical Consent of Minors Act, SNB 1976, c M-6.1, s 2. Capacity to consent to research may also differ from that of medical care. For example, in Québec, the legis-lated age of consent to required care is 14 years of age, while for research, the minor must have attained 18 years of age – the legal age of majority. See arts 14 and 20 CCQ [Civil Code of Québec]. See also Karine Sénécal, Julie Samuël & Denise Avard, “Research and the Assent of the Child: Towards Harmonization?” in Denise Avard, Julie Samuël & Bartha M Knoppers, eds, Paediatric Research in Canada (Montréal: Les Éditions Thémis, 2009) 33.

30 A “mature minor” has been defi ned as “a child who is capable of giving consent to or refusing treatment and is able to appreciate the nature and consequences of the consent or refusal.” See Erin Nelson, Kathrina Haymond & Mona Sidarous, “Selected Legal and Ethical Issues Relevant to Pediatric Genetics” (1998) 6 Health LJ 83 at 91. See also AC v Manitoba (Director of Child and Family Services), 2009 SCC 30, [2009] 2 SCR 181 [AC cited to SCR], Abella J (“[t]he doctrine addresses the concern that young people should not automatically be deprived of the right to make decisions affecting their medical treatment. It provides instead that the right to make those decisions varies in accordance with the young person’s level of maturity, with the degree to which maturity is scrutinized intensifying in accordance with the severity of the potential conse-quences of the treatment or of its refusal” at 213).

31 AC, supra note 30 at 225.


used for one or more research purposes, and where such data and material comprises stored human biological material and associated data on persons who have either (a) not yet reached the age of legal majority or otherwise acquired the ability to consent at the time of the contribution of such data or materials, or (b) not yet reached the age of majority to consent in accordance with the law respecting consent to medical treatment or research at the time of the contribution of such data or materials.

3.2 An Overview of the BiobanksTable 1 provides an overview of the three selected Canadian paediatric biobanks.

4. The Canadian Privacy FrameworkVarious international guidelines and legal instruments to which Canada is a signatory acknowledge an individual’s privacy interest.32 Privacy interests are also established at the national or regional level. For example, in the European Union, privacy is treated comprehensively and as a fundamental right;33 in the United States, privacy legislation is implemented in an ad hoc, sectoral manner.34 Canada has adopted somewhat of a middle ground.

32 See e.g. Convention on the Rights of the Child, 20 November 1989, 1577 UNTS 3, Can TS 1992 No 3 (entered into force 2 September 1990, accession by Canada 13 December 1991) (“[n]o child shall be subjected to arbitrary or unlawful inter-ference with his or her privacy” at art 16) [Convention on the Rights of the Child]; Universal Declaration of Human Rights, GA Res 217(III), UNGAOR, 3d Sess, Supp No 13, UN Doc A/810 (1948) 71 (“[n]o one shall be subjected to arbitrary inter-ference with his privacy” at art 12) [Universal Declaration]; International Covenant on Civil and Political Rights, 19 December 1966, 999 UNTS 171, arts 9-14, Can TS 1976 No 47, 6 ILM 368 (entered into force 23 March 76, accession by Canada 19 May 1976) (“[n]o one shall be subjected to arbitrary or unlawful interference with his privacy” at art 17); OECD 2013 Guidelines, supra note 13 “[i]ndividuals should have the right: ... to challenge data relating to them and, if the challenge is successful to have the data erased, rectifi ed, completed or amended” at art 13).

33 See e.g. EC, Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, [1995] OJ, L 281/31.

34 See e.g. Family Educational Rights and Privacy Act, 20 USC § 1232g; Health Insur-ance Portability and Accountability Act (HIPAA) Privacy Rule, 45 CFR Parts 160, 164


Biob

ank

&Ye

ar in

Wh

ich St

udy

Comm

ence

d

Regio

nNa

ture

of

Biob

ank

Rese

arch

Goa

lsTy

pe of

Bi

oban

kRe

quire

ment

s for

Pa

rticip

ation

Parti

cipan

ts fo

r Da

ta/

Biolo

gical

Samp

le Co

llecti

on

Size

Biolo

gical

Samp

les

Colle

cted

Data

Co

llecte

d

Perio

d of

Dat

a/Sa

mple

Stora

ge

Venu

e of

Biob

ank

Biob

ank

A

2008

–

BC, A

lta.,

Man.,

Ont.

an

d Qc.

Prosp

ectiv

e(in

clude

s mo

ther, a

nd

fathe

r, if

possi

ble)

To de

termi

ne th

e rol

es of

a ran

ge of

en

viron

menta

l facto

rs an

d the

ir inte

ractio

ns

with

gene

tic an

d ho

st fac

tors i

n the

de

velop

ment

of ch

ildren

’s he

alth (

e.g.

deve

lopme

nt of

allerg

y an

d asth

ma in

child

ren)

Popu

lation

-ba

sed

(<30

wee

ks

into p

regna

ncy)

Pregn

ant w

omen

over

the ag

e of 1

8 (1

9 in

Vanc

ouve

r) wh

o are

less t

han 3

0 we

eks

into p

regna

ncy a

nd

plann

ing to

deliv

er at

one o

f the

partic

ipatin

g ho

spita

ls

Pregn

ancy

- 5

years

5000

fam

ilies &

15

,000

pa

rticipa

nts

Blood

Urine

Faec

es

Gene

ticPh

enoty

picHe

alth-r

elated

Lifes

tyle

Indefi

nite

Hosp

itals

and

Acad

emic

Institu

tions

Biob

ank

B

2010

–

Easte

rn On

t. an

d Qc.

Prosp

ectiv

e(in

clude

s mo

ther, a

nd

fathe

r, if

possi

ble)

To un

derst

and t

he

effec

ts of

perin

atal

even

ts (li

festyl

e, he

redity

, nutr

ition,

emplo

ymen

t, fam

ilial

status

, etc.

) on c

hild

deve

lopme

nt

Popu

lation

-ba

sed

(14

wee

ks

into p

regna

ncy)

Pregn

ant w

omen

who

are

at le

ast 1

4 we

eks

into p

regna

ncy a

nd

plan t

o deli

ver in

one

of the

partic

ipatin

g ho

spita

ls

Pregn

ancy

- 2

years

(pos

sibly

beyo

nd, if

fun

ding p

ermits

)

5700

pa

rticipa

ntsCo

rd blo

odPla

centa

Meco

nium

Blood

Urine

Tissu

es (h

air)

Gene

ticPh

enoty

picHe

alth-r

elated

Lifes

tyle

Indefi

nite

Hosp

itals

and

Acad

emic

Institu

tions

Biob

ank

C

2011

–

All pr

ovinc

es

and t

errito

ries

Prosp

ectiv

eTo

iden

tify th

e gen

es

that c

ause

the m

ost

chall

engin

g typ

es of

ca

ncer

and r

are di

seas

es

in ch

ildren

, and

to fi n

d ne

w tre

atmen

ts

Disea

se-ba

sed

(iden

tifying

ge

nes i

n rare

pa

ediat

ric

disea

ses)

Cana

dian p

atien

ts wi

th a d

isorde

r tha

t is

cong

enita

l or

deve

lops i

n chil

dhoo

d/ad

olesce

nce

Disord

er is

mono

genic

an

d gen

e is u

nkno

wnIf

cond

ition i

s eti

ologic

ally

heter

ogen

eous

, kno

wn

gene

tic ca

uses

have

be

en ex

clude

d

Birth

– ad

ultho

od(a

ll age

s)50

0 pa

tients

Blood

Saliv

aGe

netic

Phen

otypic

Indefi

nite

Hosp

ital a

nd

Acad

emic

Institu

tions

Tabl

e 1:

Cha

ract

eris

tics

of th

e se

lect

ed C

anad

ian

paed

iatri

c bi

oban

ks


Omnibus laws have been enacted for the public and private/commercial sector, but other various federal, provincial and territorial statutes and regu-lations, professional codes of practice, human rights codes, guidelines, stan-dards, the common law, and constitutional law also determine the scope of information privacy.35 The subsections below briefl y discuss the constituent parts of the legislative privacy framework and the applicability of this frame-work to paediatric biobanks.

4.1 Constitutional ProtectionsRespect for privacy is a constitutional principle in Canada, but there is no explicit “right to privacy” in the Constitution of Canada. An early draft of the Canadian Charter of Rights and Freedoms36 (Canadian Charter) had expressly recognized a “right to be secure against arbitrary invasion of privacy,” similar to the United Nations’ Universal Declaration of Human Rights,37 but was left out of the fi nal version.38 In the absence of an explicit right, the development of the concept and categories of privacy interests have been driven largely by Canadian Charter cases. The generally accepted categories include personal, territorial and informational privacy.39

Two provisions in the Canadian Charter have been interpreted as protecting a person’s privacy. Section 7, which guarantees everyone “the right to life, liberty and security of the person,” has been interpreted to include the right to be free of the psychological stress resulting from unauthorized disclosure of one’s personal health information.40 Section 8, which grants the “right to

(2011); Genetic Privacy Act, NJ Stat § 10:5-43. See generally Paul M Schwartz, “Preemption and Privacy” (2009) 118 Yale LJ 902. But see Simitis, supra note 13 (“Europe more and more resembles the United States” at 2000).

35 Barbara McIsaac, Rick Shields & Kris Klein, The Law of Privacy in Canada, student ed (Scarborough, Ont: Carswell, 2011).

36 Canadian Charter of Rights and Freedoms, Part I of the Constitution Act, 1982, being Schedule B to the Canada Act 1982 (UK), 1982, c 11 [Canadian Charter].

37 Universal Declaration, supra note 32. 38 Allen M Linden & Bruce Feldthusen, Canada Tort Law, 8th ed (Markham, Ont:

LexisNexis Butterworths, 2006) at 61. 39 Bigstone v St. Pierre 2011 SKCA 34 at para 20, 231 CRR (2d) 181. See also Tessling,

supra note 3. 40 Canadian AIDS Society v Ontario (1995), 25 OR (3d) 388, 57 ACWS (3d) 121 (Ont

Gen Div); appeal dismissed, (1996), 31 OR (3d) 798, 67 ACWS (3d) 598 (Ont CA); leave to appeal to the Supreme Court of Canada denied, [1997] SCCA


be secure against unreasonable search or seizure,” includes the protection of an individual’s informational privacy. The Supreme Court has stated that “[w]hat is protected by s. 8 is people, not places or things. The principal right protected by s. 8 is individual privacy, and the provision must be purposively applied to that end.”41 Québec’s Charter of human rights and freedoms42 (Québec Charter), which applies equally to the provincial government and private parties,43 also guarantees every person the right to “respect for his private life” (Article 5) and “non-disclosure of confi dential information” (Article 9).44

4.2 The Common LawUnlike the United States, Canada has yet to fully recognize a distinct common law right to privacy.45 There have been few cases where Canadian

No 33. See also R v O’Connor, [1995] 4 SCR 411, 103 CCC (3d) 1 (complainants in a sexual assault case had a right to a reasonable expectation of privacy in the records of those who had provided them counselling and medical advice); Ruby v Canada (Solicitor General), [2000] 3 FC 589, 187 DLR (4th) 675 (FCA), Létourneau and Robertson JJA (“there is an emerging view that an individual’s right to privacy is also enshrined in one’s liberty interest set out in section 7 ... because the protection of private life is considered to be at the heart of liberty in a democratic society” at para 165); British Columbia Government and Services Employees’ Union v British Columbia (Minister of Health Services), 2005 BCSC 446, 27 Admin LR (4th) 125, Melvin J (“[t]he importance of the right of privacy as it emerges for consideration in s. 7 and s. 8 of the Charter cannot be minimized” at para 68).

41 R v Colarusso, [1994] 1 SCR 20 at para 86, 110 DLR (4th) 297, La Forest J. See also Hunter v Southam, [1984] 2 SCR 145, 11 DLR (4th) 641; R v Dyment, [1988] 2 SCR 417, 55 DLR (4th) 503; R v Wise, [1992] 1 SCR 527, 70 CCC (3d) 193; R v Plant, [1993] 3 SCR 281, 84 CCC (3d) 203.

42 Charter of human rights and freedoms, RSQ, c C-12 [Québec Charter]. 43 The Canadian Charter and the Canadian Human Rights Act, RSC 1985, c H-6 are

also applicable in Québec. 44 See Aubry v Éditions Vice-Versa, [1998] 1SCR 591, 157 DLR (4th) 577. See also

H Patrick Glenn, “The Right to Privacy in Quebec Law” in Dale Gibson, ed, Aspects in Privacy Law: Essays in Honour of John M. Sharp (Toronto: Butterworths, 1980) 40.

45 Halsbury’s Laws of Canada – Torts (Markham: LexisNexis Canada, 2012) at s II.3(7). See also John DR Craig, “Invasion of Privacy and the Charter Values: The Common Law Tort Awakens” (1997) 42 McGill LJ 355; Lisa M Austin, “Privacy and Private Law: The Dilemma of Justifi cation” (2010) 55 McGill LJ 165.


courts have recognized a common law tort action for invasion of privacy46 and there is provincial variation of the recognition.47 In 2012, the Ontario Court of Appeal recognized a tort of intrusion upon a person’s seclusion or solitude, or into his or her private affairs.48 It remains to be seen if other provinces will follow Ontario’s suit, but it is clear that there has been no coordinated, national movement as yet to establish a common law right to privacy.

4.3 Coverage of Privacy LegislationTable 2 presents an overview of the coverage of federal and provincial and territorial privacy legislation, as well as the Canadian Charter, Québec Charter, and Civil Code of Québec.

It is not possible due to space constraints to intricately analyze the contours of each privacy statute, but Table 3 lists non-exhaustively the rele-vant privacy statutes currently in force in each jurisdiction.

Table 3 only begins to illustrate the complex framework addressing privacy.49 How well does this complex framework of federal, provincial and territorial laws and regulations apply to paediatric biobanks?

46 See e.g. Roth v Roth (1991), 4 OR (3d) 740, 9 CCLT (2d) 141 (Ont Gen Div) (cause of action in invasion of privacy accepted for interference with access to

cottage and with enjoyment of property); Saccone v Orr (1981), 34 OR (2d) 317, 11 ACWS (2d) 402 (Ont Co Ct) (cause of action in invasion of privacy accepted for playing tape of private telephone conversation aloud at municipal council meeting without counsel).

47 See e.g. Parasuik v Canadian Newspapers Co (1988), 53 Man R (2d) 78, 9 ACWS (3d) 52 (MBQB), Scollin J (“[t]here is no foundation whatever for claiming that from the primeval mud of the common law in force in Manitoba there has evolved the tort of ‘false light invasion of privacy’: that concept has been fabricated in the markedly different social, constitutional and legal framework of the United States” at 30). Compare Dyne Holdings Ltd v Royal Insurance Company of Canada (1996), 138 Nfl d & PEIR 318, 135 DLR (4th) 142 (PESCAD), Carruthers CJ (“[i]t would seem to me the courts in Canada are not far from recognizing a common law right of privacy if they have not already done so. ... [and] Canadian courts do not hesi-tate to protect privacy interests under some recognized tort” at para 63). Accord MacDonnell v Halifax Herald Ltd 2009 NSSC 187, 279 NSR (2d) 217, Moir J (“[t]he plaintiff relies on what may be an emerging tort, invasion of privacy...” at para 13).

48 Jones v Tsige, 2012 ONCA 32, 108 OR (3d) 241. 49 As one example, prior to the passing of the Personal Health Information Act in


Juris

dict

ion

Cons

titut

iona

l Re

cogn

ition

of

Priv

acy

Righ

t or

Inte

rest

Stat

utor

y To

rt

Prot

ectio

n of

“Pe

rson

al

Info

rmat

ion”

–

Publ

ic S

ecto

r

Prot

ectio

n of

“Pe

rson

al

Info

rmat

ion”

–

Priv

ate

Sect

or

Prot

ectio

n of

“P

erso

nal H

ealth

In

form

atio

n”

Can

ada

(fede

ral)

Briti

sh C

olum

bia

Alb

erta

Sask

atch

ewan

Man

itoba

Ont

ario

Qué

bec

*

Nov

a Sc

otia

New

Bru

nsw

ick

Prin

ce E

dwar

d Isl

and

New

foun

dlan

d an

d La

brad

or

Yuko

n

Nor

thw

est T

errit

orie

s

Nun

avut

Tabl

e 2:

Cov

erag

e of

fede

ral,

prov

inci

al a

nd te

rrito

rial p

rivac

y sta

tute

s.

*Th

e Q

uéb

ec C

har

ter,

su

pra

note

39, s

5 a

nd a

rts

35 a

nd 1

457 C

CQ

[C

ivil

Cod

e of

Qu

ébec

] ca

n li

kel

y be

inte

rpre

ted a

s eq

uiv

alen

t to

a s

tatu

tory

tort

.


Jurisdiction Statute

Canada (federal) • Canadian Charter of Rights and Freedoms• Privacy Act• Personal Information Protection and Electronic Documents Act

British Columbia • Personal Information Protection Act• Freedom of Information and Protection of Privacy Act• Privacy Act• E-Health (Personal Health Information Access and Protection of Privacy) Act

Alberta • Personal Information Protection Act• Freedom of Information and Protection of Privacy Act• Health Information Act

Saskatchewan • Freedom of Information and Protection of Privacy Act• The Health Information Protection Act• The Local Authority Freedom of Information and Protection of Privacy Act• The Privacy Act

Manitoba • Freedom of Information and Protection of Privacy Act• The Personal Health Information Act• The Privacy Act

Ontario • Freedom of Information and Protection of Privacy Act• Personal Health Information Protection Act, 2004• Municipal Freedom of Information and Protection of Privacy Act

Québec • An Act respecting Access to documents held by public bodies and the Protection of personal information• An Act respecting the Protection of personal information in the private sector• An Act respecting health services and social services• Civil Code of Québec• Charter of human rights and freedoms

New Brunswick • Right to Information and Protection of Privacy Act• Personal Health Information Privacy and Access Act

Nova Scotia • Freedom of Information and Protection of Privacy Act• Personal Health Information Act• Municipal Government Act• Personal Information International Disclosure Protection Act

Prince Edward Island • Freedom of Information and Protection of Privacy Act

Newfoundland and Labrador

• Access to Information and Protection of Privacy Act• Personal Health Information Act• Privacy Act

Yukon • Access to Information and Protection of Privacy Act

Northwest Territories • Access to Information and Protection of Privacy Act

Nunavut • Access to Information and Protection of Privacy Act

Table 3: List of substantive privacy legislation in Canadian provinces and territories


5. Privacy Legislation and Paediatric Biobank Applicability

5.1 A Tenuous Relationship

Our analysis of the Canadian privacy framework indicates a lack of complete and harmonized coverage, which could compromise the privacy of paediatric biobank participants. Paediatric biobanks are not necessarily inconsistent with the legislation, but much of the legislation constitutes a patchwork and variegated approach to the ever-evolving world of genomics and biobanking, and especially the issues particular to paediatric biobanking. Our fi nding is consistent with health law scholar Lorraine Sheremeta, who notes that, “there is no coherent legal framework to appropriately address the health-related privacy issues that are relevant in the context of biobanking.”50

While most privacy legislation explicitly applies to public bodies, regional health authorities, physicians, universities, or other individuals or entities, it may not cover a biobank. Much of the complexity rests on the composi-tion and governance of a biobank, a construct that challenges traditional legal principles: they are structured resources often built around the collabo-ration of distinct funders, donors, custodians and researchers (and poten-tially, one day, genomics or pharmaceutical companies and their customers). Indeed, some biobanks are public-private partnerships that receive multi-source fi nancing.51 Further, large-scale paediatric biobanks do not so much resemble discrete research projects as they do infrastructures, given their budget size, management structure and administrative support.52 It may be

2012, the Nova Scotia Department of Health reported that personal health information was governed by over 40 different pieces of legislation. See Nova Scotia, Department of Health, “Personal Health Information Legislation for

Nova Scotia: Discussion Paper” (Halifax: Department of Health, 2008) at 3, online: <www.gov.ns.ca/health/>.

50 Lorraine Sheremeta, “Population Biobanking in Canada: Ethical, Legal and Social Issues” (Paper commissioned by the Canadian Advisory Council on Biotechnology, September 2003) at 64, online:

<http://publications.gc.ca/collections/Collection/Iu44-19-2004E.pdf>. 51 Joyce Rogers et al, “Biobankonomics: A Taxonomy for Evaluating the Economic

Benefi ts of Standardized Centralized Human Biobanking for Translational Research” (2011) 42 Journal of the National Cancer Institute Monographs 32.

52 See e.g. National Children’s Study, online: <http://www.nationalchildrensstudy.gov>.


that “research biobanks” are in fact complementary scientifi c infrastructures to traditional discovery science.53

There is neither legislative nor jurisprudential guidance on what deter-mines whether a biobank is a “person,” “public body,” “organization,” “institution,” or similar designation. Because a biobank has been defi ned by the Organisation for Economic Co-operation and Development (OECD) as a “structured resource”54 – a term unfamiliar to Canadian privacy legis-lation – its very composition is uncertain, especially when analyzing the geographic coverage and control of the biobank. Consequently, the water-tight, formalistic dichotomy between public sector or private sector privacy legislation fails to recognize the hybridity of many biobank structures, which often serve as resources for future, unspecifi ed research which may or may not include commercial support or use. Constitutional divisions between trade and commerce (federal jurisdiction)55 and healthcare and civil rights (provincial jurisdiction)56 also complicate the modern, mixed picture. The federal Personal Information Protection and Electronic Documents Act (PIPEDA), as a commercial activity-based statute, falls under the federal government’s trade and commerce powers.57 Additionally, it may apply to “personal health information” that crosses interprovincial borders,58 but no private or public sector privacy statute specifi cally addresses applicability to the structure of the information-holding entity in question (the biobank), rather than only some of its contents, i.e. data.59

53 Paul N Schofi eld et al, “Sustaining the Data and Bioresource Commons” (2010) 330 Science 592.

54 OECD, OECD Guidelines for Human Biobanks and Genetic Research Databases (Paris: OECD, 2009) at Annotations, para 2.

55 Constitution Act, 1867 (UK), 30 & 31 Vict, c 3, s 91(2), reprinted in RSC 1985, App II, No 5 [Constitution Act].

56 Ibid, ss 92(7), (13), (16). 57 Mahmud Jamal, “Is PIPEDA Constitutional?” (2006) 43:3 Can Bus LJ 434. 58 Personal Information Protection and Electronic Documents Act, SC 2000, c 5 s 30(2.1)

[PIPEDA]. 59 Privacy legislation generally defi nes “personal information” or “health infor-

mation” as “recorded information about an identifi able individual” or “iden-tifying information about an individual in oral or recorded form.” A contrario, information about non-identifi able individuals, e.g. anonymous or anonymized information, does not fall under the purview of the legislation. See e.g. Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A, s 4(2) (“‘identifying


Unless a biobank’s governance framework clearly divides roles and responsibilities and creates an unambiguous management structure, and a well-documented funding apparatus, determining whether a paediatric biobank falls under public sector or private sector privacy legislation will prove challenging. This challenge has not gone unnoticed by CIHR, which in the context of PIPEDA has remarked the following:

[t]he activities of health researchers themselves will be diffi cult to categorize as either commercial or non-commercial in nature. Increasingly, academia, private sector, voluntary charitable organi-zations and government are joining forces to engage in innovative research partnerships and to transform this new knowledge into forms which are benefi cial to the population. In an era where such partnerships are actively encouraged, a whole spectrum of public-private arrangements have begun to emerge.60

information’ means information that identifi es an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual”) [Ontario PHIPA]. A plain and ordinary meaning of “information” demonstrates that biological samples are not recorded information – only information extracted from those biological samples can be interpreted as recorded information (assuming it is documented in paper or electronic format and linked to an identifi able individual). Thus, most privacy statutes will not prima facie apply to genetic material or other biological samples collected for a biobank, though given DNA can be digital-ized, a broad interpretation could apply. The current bi-modal legislative frame-work (i.e. “identifi able” information affords legal protection, “non-identifi able” information does not) affords clarity and predictability but little justifi cation. Residual privacy interests may exist even in anonymized genetic information or biospecimens, given that Canadian Charter jurisprudence views privacy as forming a part of one’s fundamental right to dignity, integrity and autonomy. See generally R v Mills, [1999] 3 SCR 668, 180 DLR (4th) 1; R v O’Connor, [1995] 4 SCR 411, 130 DLR (4th) 235; R v Plant. [1993] 3 SCR 281, 84 CCC (3d) 203. Identifi ability, especially in the genomics fi eld, exists on a continuum, and ever-evolving de- and re-identifi cation techniques will continue to challenge and undermine the bi-modal model.

60 Canadian Institutes of Health Research (CIHR), Personal Information Protection and Electronic Documents Act: Questions and Answers for Health Researchers (Ottawa: Public Works and Government Services Canada, 2001) at 8.


This limitation is demonstrated in privacy statutes that apply only to “commercial activity,” “federal government institutions” or “the legisla-ture and government of each province.” For example, it is unclear whether PIPEDA, as a commercial activity-based statute, applies to a paediatric biobank stored in a hospital or university since the paramount purpose is research-related and is not commercial in character.61 Yet, the requirement by many federal funding agencies (e.g. Genome Canada62) to have matching funds from the private sector (or non-government organizations or provin-cial governments) could implicate PIPEDA. Indeed, researchers who request genetic data or biological samples from a biobank as part of a commercially funded study may, in fact, be directly or indirectly participating in a commer-cial activity.

The recent slate of health information privacy legislation appears more applicable, as it applies to “health information custodians,”63 who are individ-uals or organizations having custody or control of personal health informa-tion. This would likely apply to researchers or managers who exercise some control over a biobank participant’s personal health information, though it is not always the case that biobanks contain “personal health information” (for example, the collection and use of anonymized or anonymous samples and data would not constitute health information). There is wide variation, however, regarding the interaction of health information privacy legislation with federal and provincial public and private sector privacy legislation.64

61 Unlike s 2 of PIPEDA, supra note 58, which states that the statute will apply to “any particular transaction, act or conduct...that is of a commercial character” [emphasis added], Industry Canada has indicated that PIPEDA will only apply if the commercial transaction, act or conduct is part of the “core activities” of an entity. See “PIPEDA Awareness Raising Tools (PARTs) Initiative for the Health Sector”, online: Industry Canada <http://www.ic.gc.ca/>.

62 “Co-Funding”, online: Genome Canada <http://www.genomecanada.ca/>. 63 In Saskatchewan and Manitoba, the health information privacy legislation

governs entities designated “trustees”; in British Columbia, it governs an “administrator” of a “health information bank”; in Alberta, Newfoundland and Labrador, Nova Scotia, and New Brunswick, it governs a “custodian”; and in Ontario, it governs “health information custodians.”

64 McIsaac, Shields & Klein, supra note 35 (“[f]or example, while British Colum-bia’s Freedom of Information and Protection of Privacy Act binds hospitals, Ontario’s statute of the same name does not” at 6-30).


In Ontario, it is voluntary for biobanks to register as “prescribed persons” under the province’s Personal Health Information Protection Act, 2004 (Ontario’s PHIPA) in order to receive personal health information from health infor-mation custodians. The Ontario Institute for Cancer Research’s Ontario Tumour Bank (OTB) is a “prescribed person” under paragraph 39(1)(c) of Ontario’s PHIPA.65 As a result, the OTB is entitled to collect, use and disclose personal health information without consent strictly “for the purposes of facilitating or improving the provision of health care, or that relates to the storage or donation of body parts or bodily substances.”66 The “prescribed person” status makes it easier for the OTB to enrich its database with valu-able follow-up information such as patient treatment and vital statistics by linking into other data holdings, such as those held at Cancer Care Ontario.67 To maintain the “prescribed person” status, the OTB is required to have policies that describe how it collects, retains and protects personal health information and anonymized data, as well as circumstances under which personal health information and anonymized data may be disclosed and to whom. Participants in the OTB fully consent to the provision of samples and are informed of their status as an individual within Ontario’s PHIPA and as to the intended use(s) of the data.

In sum, while health information privacy legislation applies to some biobanks, voluntary self-regulation, uncertainty and variant coverage colour the overall Canadian privacy framework. There remains no relevant case law in Canada to help map the contours. Public bodies have called on legis-latures to amend current laws to specifi cally address biobanks and infra-structure science.68 For example, the Fonds de recherche du Québec – Santé

65 Ontario PHIPA, supra note 59, s 39(1)(c); O Reg 329/04, s 13(1). 66 Halyna Perun, Michael Orr & Fannie Dimitriadis, Guide to the Ontario Personal

Health Information Protection Act (Toronto: Irwin Law, 2005) at 362. 67 Interview of Monique Albert, Manager, Ontario Tumour Bank, by Edward S

Dove (5 May 2011). 68 Infrastructure science embodies the emerging “fi rst experiment-then-hypoth-

esize” framework that stands in contrast to discovery science, which embodies the traditional “fi rst hypothesize-then-experiment” framework. Biobanks represent a new dual reconfi guration of 21st century science whereby infra-structure science and individual discovery science now co-exist. See generally Edward S Dove, Vural Özdemir & Yann Joly, “Harnessing Omics Sciences, Popu-lation Databases, and Open Innovation Models for Theranostics-guided Drug Discovery and Development” (2012) 73 Drug Development Research 439.


has recommended that “laws making provision for personal information protection be adapted to the emerging trends in health research so that such laws recognize the legal validity of data banks and biobanks and of research exploring themes rather than specifi c hypotheses.”69

5.2 Exploring the Case StudiesThis section explores the privacy landscape in the selected paediatric biobanks by focusing on the three issues that particularly highlight the tension between the scientifi c promises of research and the legal obligations to protect a child’s privacy: (1) the access, use and transfer of the child’s data and samples; (2) the risks of unauthorized access by third parties; and (3) the nature of the shared relationship between the child, the parents and the researcher.70 This section also discusses how the biobank policies differ quite dramatically with respect to the coverage of these three issues, causing concern about the level of privacy protection afforded to children in the absence of comprehensive and clear legislation.

1) Access, Use and Transfer of the Child’s Data and SamplesWhile informed consent is recognized as a legal and ethical obligation of primary importance to protect and respect privacy and the person, its effect is detrimentally impacted by legislative gaps in protecting access, use and transfer of data and samples. A core obligation of most privacy legislation is that individuals or organizations can access or use personal information only for purposes that a reasonable person would consider appropriate in the circumstances,71 or for the primary purpose for which it was collected or for directly related secondary purposes.72 Many statutes also combine “fair information principles”73 (i.e. internationally accepted principles regarding the collection, use and disclosure of personal information) with research

69 Fonds de la recherche en santé du Québec, Final Report Advisory Group on a Governance Framework for Data Banks and Biobanks Used for Health Research (Québec: Fonds de la recherche en santé du Québec, 2006) at 14.

70 There are also multiple socio-ethical issues to explore, but space constraints limit our discussion to legal issues. See generally Best Practices; Dove et al, “Emerging Issues”, supra note 20.

71 PIPEDA, supra note 58, s 5(3). 72 Privacy Act, RSC 1985, c P-21, s 8(2)(a). 73 Fair information principles, also known as fair information practices, gener-

ally revolve around eight core principles, as espoused in OECD, Guidelines


ethics norms to govern the access to personal health information for research purposes. Depending on the source, these accepted principles may not include an independent consent principle, which is why some statutes (e.g. the federal Privacy Act) generally allow the collection of personal information without consent, whereas others (e.g. PIPEDA) mandate consent unless there is an explicit exception.74 Those statutes that do not operate on this combined fair information principles/research ethics model nonetheless contain excep-tions to consent for research purposes. Those provinces with personal health information protection legislation also have particular rules governing disclo-sure of personal health information without the individual’s consent.75 None of the privacy statutes address the issue of consent in biobanks as a broad, ongoing process rather than a discrete, one-off transaction.76

on the Protection of Privacy and Transborder Flows of Personal Data (Paris: OECD, 1980): 1) collection limitation; 2) data quality; 3) purpose specifi cation;

4) use limitation; 5) security safeguards; 6) openness; 7) individual participa-tion; and 8) accountability. The fair information principles included in Schedule 1 of PIPEDA, supra note 58, which are enunciated in the Canadian Standards Association Model Code for the Protection of Personal Information, are some-what broader: 1) accountability; 2) identifying purposes; 3) consent; 4) limited collection; 5) limiting use, disclosure and retention; 6) accuracy; 7) safeguards; 8) openness; 9) individual access; and 10) challenging compliance. The United States’ Code of Fair Information Principles (Washington, DC: US Department of Health, Education and Welfare, 1973) fi rst elaborated some of these principles out of concerns related to computerization.

74 See generally Trudo Lemmens & Lisa M Austin, “The End of Individual Control Over Health Information: Governing Biobanks and Promoting Fair Information Practices” in Jane Kaye & Mark Stranger, eds, Principles and Practice in Biobank Governance (Farnham: Ashgate, 2009) 243.

75 See e.g. E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c 38, ss 14-15 [BC E-Health Act]; Health Information Act, RSA 2000, c H-5, ss 49-54 [Alberta HIA]; Ontario PHIPA, supra note 59, s 44.

76 Timothy Caulfi eld, “Biobanks and Blanket Consent: The Proper Place of the Public Good and Public Perception Rationales” (2007) 18:2 King’s Law Journal 209; Timothy Caulfi eld & Bartha M Knoppers, Consent, Privacy & Research Biobanks: Policy Brief No. 1 (Ottawa: Genome Canada, 2010); Søren Holm, “Informed Consent and the Bio-banking of Material from Children” (2005) 1:1 Genomics, Society and Policy 16; Aaron J Goldenberg et al, “Pediatric Biobanks: Approaching Informed Consent for Continuing Research After Children Grow Up” (2009) 155:4 The Journal of Pediatrics 578.


Moreover, unlike (arguably) in Europe, there is no clear privacy law coverage applicable to access, use or transfer of biological materials.77 This means that while privacy statutes prohibit persons from using or transfer-ring information derived from or related to an identifi able biological sample without the individual’s consent (subject to limited exceptions),78 there may not be an explicit prohibition to the access, use or transfer of the identifi able biological sample itself. The access, use and transfer dimension is further

77 S and Harper v the United Kingdom, No 30562/04 [2008] ECHR 1581, 48 EHRR 50 (retention per se of DNA samples are suffi cient as having the potential to inter-fere with the right to private life of an individual). See also Matteo Macilotti, “Reshaping Informed Consent in the Biobanking Context” (2012) 19:3 Eur J Health L 271 (“[t]he right of the protection of personal data invests in the person a continuing power of control over the tissue, even after the transfer of the tissue to a biobank” at 281-282); EC, Directorate-General for Research and Innovation, Biobanks for Europe: A Challenge for Governance. Report of the Expert Group on Dealing with Ethical and Regulatory Challenges of International Biobank Research (Luxembourg: EC, 2012) (“[t]he principles applying to the retention and circulation of biological samples should not differ signifi cantly from personal data protection principles even if the legal framework devised for personal data were not found to be directly applicable” at 38).

78 See e.g. Ontario PHIPA, supra note 59, s 4(1)(e) (“[i]n this Act, ‘personal health information’ ... means identifying information about an individual in oral or recorded form, if the information ... relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance...”). Similar defi nitions are found in Alberta HIA, supra note 75, s 1(1)(i)(iii); The Health Information Protection Act, SS 1999, c H-0.021, s 2(m)(iii) [Saskatchewan HIPA]; Personal Health Information Act, SNL 2008, c P-7.01, s 5(1)(c) [Newfoundland and Labrador PHIA]; Personal Health Information Privacy and Access Act, SNB 2009, c P-7.05, s 1(e) in defi nition of “personal health information” [New Brunswick PHIPAA]. It is intriguing that the word “donation” is used in this context as it can imply that an individual has given away a body part or bodily substance qua gift and expects nothing owed in return. Yet, by virtue of the legislation, an ongoing legal obligation is created between the health information custodian and the individual. This suggests that the individual may not be “donating” as much as “contributing” a body part or bodily substance. The BC E-Health Act, supra note 75 and The Personal Health Information Act CCSM c P33.5 [Manitoba PHIA] do not contain a similar provision.


compounded by the continuing legal uncertainty regarding property rights and ownership of biological materials held in a biobank.79

Not only does this issue challenge the traditional legal distinction between “information” and “biological samples,” it also has a profound impact on the scope of informed consent. A biobank may face regulatory, contractual, or other consequences for disclosing or transferring the samples without prop-erly informed consent, but under privacy legislation the access to, use and transfer of materials is not covered (although human tissue-related legisla-tion can require consent for the taking of tissue80), thereby limiting the effec-tiveness of consent provisions. Similarly, privacy legislation generally allows an individual to access their own information, but the legislation does not explicitly permit individuals to access their biological materials containing information. It may be argued that individuals do not need access because they can provide another sample. However, the amount of biological mate-rials stored is limited and certain types of materials, such as cancer tumour tissue, may be special, rare and diffi cult or painful to extract.81 Cell lines can be made, but this is expensive. The paediatric context exacerbates the problem since a child may wish to have access to their (identifi able) biolog-ical materials when they reach maturity for purposes of medical testing, diagnosis or treatment.

79 Jasper A Bovenberg, Property Rights in Blood, Genes & Data: Naturally Yours? (Leiden, Neth: Martinus Nijhoff Publishers, 2006); Radhika Rao, “Genes and Spleens: Property, Contract, or Privacy Rights in the Human Body?” (2007) 35:3 JL Med & Ethics 371; Muireann Quigley, “Property: the Future of Human Tissue?” (2009) 17:3 Med L Rev 457; Lars Øystein Ursin, “Privacy and Property in the Biobank Context” (2010) 22:3 HEC Forum 211.

80 See e.g. Human Tissue and Organ Donation Act, SA 2006, c H-14.5. Human tissue donation acts generally do not apply to tissues that are replaceable by natural process of repair, such as blood, hair and skin. Most biological samples provided to biobanks are self-replicating. Ontario’s Trillium Gift of Life Network Act, RSO 1990, c H-20 applies to skin but not blood, yet its scope for living persons is limited to transplantation.

81 Eric Vermeulen et al, “Connective Tissue: Cancer Patients’ Attitudes towards Medical Research Using Excised (Tumour) Tissue” (2011) 6 BioSocieties 466.


Biobank PracticesIn summary, the three paediatric biobanks analyzed have varying prac-

tices with respect to access, use and transfer of a child’s samples and data. Biobank C82 and Biobank B83 provide disclosure in their consent forms about the processes involved in access, use and transfer, including obligatory REB approval and a data/material transfer agreement, while Biobank A’s consent forms provide little information about the issue.84 None of the biobanks employ the “honest broker” model, seen by some as a best practice, where

82 The Biobank C consent forms state that, following institution-specifi c REB approval, all data and samples will be shared with Canadian investigators who are members of the Canadian Pediatric Genetic Disorders Sequencing Consor-tium (CPGDS). Before such sharing, however, the data and samples will be coded. Researchers outside of Canada may access the coded data (in a controlled access database) and samples following the approval of the CPGDS scientifi c committee and relevant REBs. General research results and anonymized data (i.e. data that cannot be linked back to the patient or the patient’s child) will be available to all researchers in an open access database. See Biobank C, “Children/Minors: Information and Consent Form” at 2; Biobank C, “Affected/Unaffected/Incompetent Adults: Information and Consent Form” at 2 [unpublished, on fi le with authors] [Biobank C consent forms].

83 Researchers who wish to obtain access to data or biological materials from Biobank B must obtain their institutional REB and Board of Principal Investiga-tors authorizations. Even if such authorizations are given, further conditions may be imposed, including an obligation to obtain specifi c consent for a project (from an adult for him- or herself or in a child’s stead) or the assent of a child, or the anonymization of the data or biological material before they are sent to an investigator (rather than sending them encoded). Additionally, Biobank B specifi es that a Data/Biomaterial Transfer Agreement is also required, which obligates the researchers to, inter alia, not transmit data or biological material to unauthorized recipients, respect the participants’ confi dentiality and not attempt to re-identify participants, and destroy all the data obtained at the end of the research and destroy or return to the biobank any biological material that remains unused. See Biobank B, “Databank and Bank of Biological Material Management Policy”, at 20-21 [unpublished, on fi le with authors].

84 The Biobank A policies and consent forms provide no information about use by external researchers. The consent forms state only that, “[r]esearchers involved in the study might be interested in follow-up after the fi ve year time period, and participants may be asked in the future about their interest in participating in further studies.” See Biobank A, Study Information and Consent Form [unpub-lished, on fi le with authors].


an individual or entity serves as a trusted intermediary to provide de-identi-fi ed biospecimens and/or data to approved researchers.85

Table 4 illustrates the biobank practices relating to access, use and transfer.

2) Risks of Unauthorized Access by Third PartiesUnauthorized access to personal health information, including genetic information, is a traditional concern of research. Biobanks collect a substan-tial amount of information on children that might be stored and used for prolonged periods – or indefi nitely. Access to data and samples by third parties such as the government, law enforcement agencies, employers, insurers and educational institutions raises particular privacy concerns since the informa-tion could be incorporated in a decision affecting a child’s future employ-ment, insurance coverage and education. The increasing use of banked biological materials and data augments the prospect of a breach of privacy by virtue of its wide availability and distribution. The special circumstance of children – generally non-consenting participants in research – requires additional consideration.

Canada’s privacy statutes generally prohibit disclosure of personal infor-mation to third parties, subject to mandatory reporting requirements, unless the person concerned consents to such disclosure or if the information has been de-identifi ed (i.e. coded).86 But there are several shortcomings. The statutes focus entirely on the (identifi able) individual; they do not address the broader community and social implications of unauthorized access or disclosure of medical information that can comprise information beyond the privacy of the individual.87 Also, it is unclear what happens in the context of

85 Jim Vaught & Nicole C Lockhart, “The Evolution of Biobanking Best Practices” (2012) 413 Clinica Chimica Acta 1569.

86 See e.g. New Brunswick PHIPAA, supra note 78, s 36 (“[a] custodian may disclose personal health information that has been de-identifi ed for any purpose”). The standard or nature of de-identifi cation referenced in Canadian privacy statutes may not align with the standards imposed in the US federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, 45 CFR § 164.514(b)(2) (2011) (allowing covered entities to use and disclose data without obtaining authorization via the “safe harbor” de-identifi cation method, which requires the removal of all of the identifi ers enumerated in the section).

87 Joan L McGregor, “Population Genomics and Research Ethics with Socially Identifi able Groups” (2007) 35:3 JL Med & Ethics 356; Katherine Drabiak-Syed,


Biob

ank

Acc

ess

or u

se b

y ch

ild a

nd/o

r pa

rent

s to

dat

a an

d sa

mpl

esTr

ansf

er o

f dat

a an

d sa

mpl

es/s

econ

dary

use

Leng

th o

f sto

rage

of d

ata

and

sam

ples

Biob

ank

A•

No

disc

ussi

on o

f pos

sibi

lity

to

acce

ss o

r use

dat

a an

d

sam

ples

by

eith

er p

aren

t or

ch

ild, b

ut if

par

ent d

ecid

es to

w

ithdr

aw fr

om s

tudy

, par

ent

w

ill n

ot b

e in

clud

ed in

follo

w-u

p da

ta c

olle

ctio

ns a

nd

stu

dy w

ill o

nly

use

data

pare

nt/c

hild

pro

vide

d du

ring

stu

dy p

artic

ipat

ion

• C

onse

nt fo

rm m

entio

ns th

at re

sear

cher

s in

volv

ed in

study

may

be

inte

reste

d in

long

er te

rm fo

llow

-up

afte

r

the

fi ve-

year

tim

e pe

riod,

and

par

ent m

ay b

e as

ked

ab

out i

nter

est i

n pa

rtici

patin

g in

add

ition

al s

tudi

es in

the

futu

re•

Dat

a or

sam

ple-

requ

estin

g in

divi

dual

or g

roup

of

in

vesti

gato

rs m

ust s

ubm

it a

lette

r of r

eque

st to

the

D

irect

or a

t the

Nat

iona

l Coo

rdin

atin

g C

entre

,

statin

g: 1

) pur

pose

of t

he re

ques

t; 2)

dat

a w

hich

are

requ

este

d as

pre

cise

ly a

s po

ssib

le; 3

) pop

ulat

ion

for

w

hom

dat

a ar

e re

ques

ted;

4) u

se w

hich

will

be

m

ade

of th

e da

ta in

clud

ing

statis

tical

app

roac

h to

anal

ysis

whe

re a

ppro

pria

te; 5

) how

the

data

sho

uld

be

bes

t for

mat

ted;

and

6) w

hen

the

data

are

requ

ired

• Sa

mpl

es w

ill u

sual

ly b

e

proc

esse

d in

a lo

cal l

abor

ator

y

for l

ong-

term

sto

rage

in a

cent

raliz

ed li

quid

nitr

ogen

faci

lity,

pen

ding

det

erm

inat

ion

of

bes

t met

hods

and

faci

litie

s fo

r

anal

ysis

, and

acq

uirin

g

nece

ssar

y fu

ndin

g•

Proc

ess

is o

vers

een

by a

Biol

ogic

al S

ampl

es C

omm

ittee

• D

ata

will

be

used

for s

tudy

only

and

will

be

kept

as

long

as re

quire

d, th

en d

estro

yed

as

requ

ired

by lo

cal s

tudy

cen

tre

po

licie

s

Biob

ank

B•

No

disc

ussi

on o

f pos

sibi

lity

to

ac

cess

or u

se d

ata

and

sa

mpl

es b

y ei

ther

par

ent o

r

child

, but

par

ent m

ay re

ques

t

that

all

data

and

sam

ples

prov

ided

be

destr

oyed

• Bi

oban

k w

ill b

e re

sour

ce fo

r var

ious

rese

arch

ers

co

nduc

ting

rese

arch

on

the

cour

se o

f pre

gnan

cy

an

d th

e im

pact

s of

mot

her’s

and

fath

er’s

heal

th o

n

the

child

’s he

alth

and

dev

elop

men

t•

Aut

horiz

atio

n re

quire

d•

Poss

ibili

ty o

f obl

igat

ion

of s

eeki

ng c

hild

’s as

sent

• D

ata

or b

iolo

gica

l mat

eria

l sen

t to

rese

arch

ers

are

id

entifi

ed

with

a c

ode

• D

ata/

Biom

ater

ial T

rans

fer A

gree

men

t also

requ

ired

• In

defi n

ite, u

nles

s pa

rent

requ

ests

de

struc

tion

Biob

ank

C•

No

disc

ussi

on o

f pos

sibi

lity

to

ac

cess

or u

se d

ata

and

sam

ples

by e

ither

par

ent o

r chi

ld, b

ut if

ther

e is

with

draw

al fr

om th

e

study

com

plet

ely,

sam

ples

and

data

will

be

destr

oyed

whe

re

po

ssib

le (a

lread

y pu

blis

hed

data

and

alre

ady

used

sam

ples

can

not

be

des

troye

d)

• A

ll co

ded

data

and

sam

ples

are

sha

red

with

Can

adia

n in

vesti

gato

rs w

ho a

re m

embe

rs o

f the

Can

adia

n Pe

diat

ric G

enet

ic D

isor

ders

Seq

uenc

ing

C

onso

rtium

• C

oded

dat

a an

d sa

mpl

es w

ill b

e sh

ared

ext

erna

lly

fo

r res

earc

h re

late

d to

the

study

of r

are

gene

tic

di

sord

ers,

follo

win

g ap

prov

al fr

om th

e C

onso

rtium

scie

ntifi

c co

mm

ittee

and

the

rele

vant

REB

• In

defi n

ite (d

ata)

• D

NA

sam

ples

and

any

cel

l lin

es

w

ill b

e ke

pt u

ntil

the

gene

for t

he

ra

re g

enet

ic d

isea

se in

pat

ient

’s

fam

ily h

as b

een

iden

tifi e

d

and

the

mec

hani

sms

lead

ing

to

the

heal

th is

sues

rela

ted

to th

e

diso

rder

are

und

ersto

od

Tabl

e 4:

Bio

bank

pra

ctic

es re

latin

g to

acc

ess,

use

and

tran

sfer

of t

he c

hild

’s da

ta a

nd s

ampl

es.


paediatric biobanks where consent is provided by the parents and where the competent child may oppose disclosure. Given the tenuous applicability of privacy legislation to biobanks, its applicability to biobank policies regarding unauthorized access is also unclear, especially in light of consent and the opinions of the parents and child.88 Many paediatric biobanks rely on private ordering via access or transfer agreements to determine the scope of third party access and sanctions for violations. Whether this operates under the backdrop of privacy legislation – wherein consent of the parent or the competent child is required to permit disclosure – or in spite of it, following rules developed through ethical norms, remains unknown.

Protection against unauthorized third party access to personal infor-mation held in biobanks should be coupled with meaningful penalties for privacy violations, though it is worth noting that to date, there is no evidence of an individual having been harmed by unauthorized use or disclosure of a genome research dataset.89 Some foreign jurisdictions contain specifi c and strict penalties for genetic privacy violations.90 While the absence of such specifi c legislation in Canada is not problematic in and of itself, the absence of meaningful, enforceable penalties for privacy violations may be. Genotypic and phenotypic data or material contained in biobanks may not be “exceptional,” but concerns associated with them (especially with rare genetic conditions associated with highly penetrant genes) are often ampli-fi ed in comparison to other health information. For example, obtaining a

“Lessons from Havasupai Tribe v. Arizona State University Board of Regents: Recognizing Group, Cultural, and Dignitary Harms as Legitimate Risks Warranting Integration into Research Practice” (2010) 6 Journal of Health & Biomedical Law 175; Stephanie M Fullerton & Sandra S-J Lee, “Secondary Uses and the Governance of De-Identifi ed Data: Lessons from the Human Genome Diversity Panel” (2011) 12 BMC Medical Ethics 16 (fi nding that potential risks to communities cannot be wholly eliminated by anonymization of individual data).

88 Compare International Declaration on Human Genetic Data, UNESCOR, 32nd Sess, UN Doc SHS/BIO/04/1 (2003) art 14 (generally forbidding biological samples linked to an identifi able person from being disclosed to third parties).

89 Pilar N Ossorio, “Bodies of Data: Genomic Data and Bioscience Data Sharing” (2011) 78:3 Social Research: An International Quarterly 907.

90 See e.g. NJ Stat § 10:5-49 (2012); Genetic Information Nondiscrimination Act of 2008, Pub L 110-233, 122 Stat 881; The Genetic Integrity Act, (Swed), SFS 2006:351, ch 8.


child’s genetic material without properly informed parental consent and (ideally) child assent violates basic human dignity and autonomy and also breaches the child’s privacy. Non-consensual disclosure of information related to the biological material can affect a plethora of areas, including the child’s (future) health, kinship, parentage, relationships and employment.

Provincial health information legislation contains penalty provisions, but they are narrowly drafted. Ontario’s PHIPA, for instance, requires an individual seeking damages to prove “actual harm” for a breach of privacy, but only after the information and privacy commissioner has made an order, or a person has been convicted of an offence under the legislation that has become fi nal as the result of there being no further right of appeal.91 Further, damages for mental anguish are capped at $10,000 and applicable only if the violation was wilful or reckless.92 A person may be fi ned for collecting, using or disclosing personal health information in contravention of the statute or its regulations, but only if it is “wilful,”93 thus imposing a higher evidentiary burden.

In sum, the lack of strict, meaningful and obtainable penalties for privacy violations concerning personal health information and biological materials in the context of paediatric biobanks fails to address the potentially unique and detrimental harms that arise from non-consensual third party collec-tion, use, and disclosure of such information or material.

Biobank PracticesIn summary, the paediatric biobank policies and consent forms generally

disclose obligations and measures taken to safely store and secure partici-pants’ data and samples from unauthorized access, but once again there is noticeable variation in the amount and type of disclosure, refl ecting variable practices in the absence of prescriptive legislation or regulations. Biobank C’s consent forms, for example, state that “[i]nformation will not be disclosed to insurance companies or employers”94 and that “no information that discloses your/your child’s identity will be shared or published without your specifi c consent to the disclosure.”95 It does disclose risks regarding unauthorized

91 Ontario PHIPA, supra note 59, ss 65(1)-(2). 92 Ibid, s 65(3). 93 Ibid, s 72(1)(a). 94 Biobank C consent forms, supra note 82 at 2. 95 Ibid.


third party access, however. Biobank A’s consent forms mention that in rare instances it will not be possible to ensure confi dentiality because of manda-tory reporting laws, while Biobank B’s consent form does not – but the latter form does state that there is a risk of disclosure of results to third parties, which may compromise or decrease the parent, child or family’s chance of insurability.

Table 5 illustrates the biobank practices relating to unauthorized third party access.

3) The Nature of the Shared Relationship between the Child, Parents and ResearcherBecause most children lack full maturity and competency, they have not been treated ethically and legally as having the capacity to consent to their own participation in health research.96 Consequently, authorization for chil-dren’s participation in research generally must come from the parent(s). Such an arrangement complicates the privacy of children as they are no longer the only person aside from the researcher involved in decision-making and with access to sensitive information related to or derived from research.97 Relevant dimensions include information that may be disclosed only to the parents, information that may be disclosed only to the child when he or she is mature, and the possibility that a competent child can request some information to remain private.98 The interaction between a child’s privacy

96 See e.g. TCPS, supra note 20, art 3.3; art 21 CCQ. See also PIPEDA, supra note 58, Principle 4.3 of Schedule 1; Ontario PHIPA, supra note 59, s 23(1). See also Hens et al, “Principles”, supra note 27.

97 Kristien Hens et al, “Children, Biobanks and the Scope of Parental Consent” (2011) 19 European Journal of Human Genetics 735 [Hens et al, “Scope of Parental Consent”].

98 Helen L Gilbert, “Minors’ Constitutional Right to Informational Privacy” (2007) 74 U Chicago L Rev 1375. See also Mireille Lacroix et al, “Should Physicians Warn Patients’ Relatives of Genetic Risks?” (2008) 178:5 Can Med Assoc J 593; Benjamin S Wilfond & Katherine J Carpenter, “Incidental Findings in Pediatric Research” (2008) 36:2 JL Med & Ethics 332; Denise Avard et al, “Pediatric Research and the Return of Individual Research Results” (2011) 39:4 JL Med & Ethics 593; Bartha M Knoppers, “Paediatric Research and the Communication of Not-So Incidental Findings” (2012) 17:4 Paediatrics & Child Health 190; Ruqayyah Abdul-Karim et al, “Disclosure of Incidental Findings From Next-Generation Sequencing in Pedi-atric Genomic Research” (2013) 131:3 Pediatrics 564.

Health Law Journal Volume 20 (2013)32Bi

oban

kH

andl

ing

of p

rivac

y an

d co

nfi d

entia

lity/

prot

ectio

n ag

ains

t un

auth

oriz

ed a

cces

s by

third

par

ties

Pote

ntia

l ris

ks

rega

rdin

g un

auth

oriz

ed

third

par

ty a

cces

s

Ass

ent o

r co

nsen

t of t

he c

hild

rega

rdin

g ac

cess

by

third

par

ties

to

data

/sam

ples

Biob

ank

A•

Pers

onal

dat

a, in

clud

ing

nam

e of

eac

h pa

rtici

pant

, is

avai

labl

e

only

to th

e re

spec

tive

loca

l stu

dy c

entre

coo

rdin

ator

s an

d co

-PI

at

eac

h si

te, f

or p

urpo

ses

of c

onta

ctin

g fa

mili

es, a

nd e

nsur

ing

ap

prop

riate

follo

w-u

p. A

ll ot

her a

cces

s to

indi

vidu

al d

ata

is

ba

sed

on ID

num

bers

and

not

nam

es•

Mul

tiple

leve

ls of

acc

ess

to th

e bi

oban

k’s

data

(fro

m fu

ll ac

cess

by e

.g. D

ata

Man

ager

to e

xtre

mel

y lim

ited

acce

ss b

y e.

g. d

ata

en

try p

erso

nnel

)•

Cop

ies

of a

ll da

ta s

ets

are

held

at s

ecur

e si

tes

by th

e bi

oban

k,

w

ith b

acku

p at

alte

rnat

e se

cure

site

s•

Rese

arch

reco

rds

and

med

ical

reco

rds

may

be

insp

ecte

d in

the

pr

esen

ce o

f the

inve

stiga

tor o

r his

/her

del

egat

e by

repr

esen

-

tativ

es o

f Hea

lth C

anad

a an

d th

e ho

spita

l’s R

EB fo

r aud

iting

purp

oses

• C

onse

nt fo

rm m

entio

ns

th

at in

rare

insta

nces

it w

ill n

ot b

e po

ssib

le

to

ens

ure

confi

den

t-

ialit

y be

caus

e of

man

dato

ry re

porti

ng

la

ws

• N

o di

scus

sion

of p

ossi

bilit

y fo

r

child

’s as

sent

Biob

ank

B•

Nam

e of

par

ticip

ants

are

code

d; li

nkin

g ke

y is

pla

ced

unde

r the

resp

onsi

bilit

y of

the

proj

ect’s

prin

cipa

l res

earc

hers

• Re

sear

ch re

cord

s an

d m

edic

al re

cord

s m

ay b

e in

spec

ted

in th

e

pres

ence

of t

he in

vesti

gato

r or h

is/h

er d

eleg

ate

by

re

pres

enta

tives

of C

IHR

and

the

hosp

ital’s

REB

for a

uditi

ng

pu

rpos

es

• C

onse

nt fo

rm m

entio

ns

th

at th

ere

is a

risk

of

di

sclo

sure

of r

esul

ts to

third

par

ties,

whi

ch

m

ay c

ompr

omis

e or

decr

ease

the

pare

nt,

ch

ild o

r fam

ily’s

ch

ance

of i

nsur

abili

ty

(li

fe, h

ealth

, inv

alid

ity,

et

c.)

• Bi

oban

k B

Dat

aban

k an

d Ba

nk

of

Bio

logi

cal M

ater

ial M

anag

e-

men

t Pol

icy

addr

esse

s po

ssib

ility

of o

btai

ning

ass

ent o

f chi

ldre

n

“whe

n th

ey a

re o

ld e

noug

h to

unde

rsta

nd”

and

cons

ent w

hen

th

ey b

ecom

e ad

ults

• Po

licy

state

s th

at n

eed

for a

ssen

t

is b

ased

on

mat

urity

and

inte

llige

nce

of th

e ch

ild

Biob

ank

C•

All

data

and

sam

ples

will

be

kept

sec

urel

y at

the

rese

arch

faci

lity

• A

ny re

cord

that

iden

tifi e

s pa

tient

by

nam

e or

initi

als

not a

llow

ed

to

leav

e in

vesti

gato

r’s o

ffi ce

s•

Dat

a an

d sa

mpl

es th

at w

ill b

e sh

ared

with

oth

er re

sear

cher

s

will

fi rs

t be

code

d (c

oded

dat

a w

ill a

lso b

e sto

red

in a

con

trolle

d

acce

ss d

atab

ase)

• Re

sear

ch re

cord

s an

d m

edic

al re

cord

s m

ay b

e in

spec

ted

in th

e

pres

ence

of t

he in

vesti

gato

r or h

is/h

er d

eleg

ate

by

re

pres

enta

tives

of H

ealth

Can

ada

and

the

hosp

ital’s

REB

for

au

ditin

g pu

rpos

es

• N

o ris

k re

gard

ing

un

auth

oriz

ed th

ird

pa

rty a

cces

s di

scus

sed

• C

hild

ren

aged

14-

18 s

peci

fi cal

ly

as

ked

to p

rovi

de a

ssen

t (or

con

-

sent

whe

n fo

rese

en u

nder

legi

slatio

n) to

par

ticip

ate

• C

hild

ren

unde

r age

14

mus

t

have

stu

dy e

xpla

ined

to th

em a

t a

le

vel t

hat i

s ap

prop

riate

and

if

th

ey c

an u

nder

stand

, the

y m

ust

pr

ovid

e as

sent

to p

artic

ipat

e

Tabl

e 5:

Bio

bank

pra

ctic

es re

latin

g to

una

utho

rized

third

par

ty a

cces

s


interests and the authority legally and ethically granted to parents creates unique risks given that the need for privacy increases as a child matures, and a competent child’s perspective on what is private may vary considerably from an adult’s perspective.99

The legally binding 1989 UN Convention on the Rights of the Child enshrines a child’s right to express a view “in all matters affecting the child” and for “due weight to be taken” of these views.100 Yet, Canadian privacy legisla-tion does not address concerns about sensitive information that competent children may not want themselves or their parents to know, i.e. a right not to know. Nor does it clearly mandate the right of children to know informa-tion that may be necessary to protect or promote their health. Several stat-utes stipulate who may give proxy consent on behalf of minors, including incorporating, by reference, surrogate decision-makers appointed for related purposes under other statutes.101 Ontario’s PHIPA details capacity issues

99 Kristien Hens et al, “Biological Sample Collections from Minors for Genetic Research: A Systematic Review of Guidelines and Position Papers” (2009) 17:8 European Journal of Human Genetics 979 [Hens et al, “Biological Samples Collections”]; Emma Williamson et al, “Children’s Participation in Genetic Epidemiology: Consent and Control”, in Richard Tutton & Oonagh Corrigan, eds, Genetic Databases: Socio-Ethical Issues in the Collection and Use of DNA (London, UK: Routledge, 2004) 139. See also Roberta L Woodgate & Marie Edwards, “Children in Health Research: A Matter of Trust” (2010) 36:4 Journal of Medical Ethics 211.

100 Convention on the Rights of the Child, supra note 32, art 12.101 Alberta HIA, supra note 75, ss 104(1)(b)-(c); Manitoba PHIA, supra note 78, s

60(1)(e); Saskatchewan HIPA, supra note 78, ss 56(c)-(d); Newfoundland and Labrador PHIA, supra note 78, s 7(d); New Brunswick PHIPAA, supra note 78, s 5. See also arts 19, 21, 22, 24, 25, 35 CCQ (whereby Québec contemplates that a person’s privacy may only be invaded upon consent or authorization by law, and such consent, in a paediatric biobank context, may be given by a parent). Note that Québec distinguishes the age of consent for research and does not employ the doctrine of the “mature minor.” In Québec, the age of consent to research is 18 years (art 21 CCQ), unless the child is fully emancipated, while the age of consent to required medical care is 14 (art 14 CCQ). While specifying an age avoids potentially arbitrary decisions concerning capacity and creates certainty, the attribution of different statuses to children and adults is contro-versial because it assumes stark differences in kind between the two groups, rather than differences in degree, including the level of maturity of members of each age-based group. See Lucinda Ferguson, “The End of an Age: Beyond Age


related to consent and stipulates certain factors that a parent must take into consideration before providing or refusing consent, withdrawing consent, or providing an express instruction.102

Privacy legislation also does not adequately address issues surrounding maturing children and the varying nature of the information to be collected and its possible disclosure, suggesting that privacy has a different meaning when the individual is not accorded full legal rights because of age or competency.103 While we generally acknowledge that as between parent and

Restrictions for Minors’ Medical Treatment Decisions” (Research paper prepared for Law Commission of Canada, 2004) at 1, online: <http://papers.ssrn.com/sol3/papers.cfm?abstract_id=998227> (noting that neuroscience and psycho-logical research suggests that it is unwise to generalize about the development of decision-making maturity).

102 Ontario PHIPA, supra note 59, ss 23(1), 24. Consent by minors under age 16 to the collection, use or disclosure of information relating to treatment within the meaning of the Health Care Consent Act, 1996, SO 1996, c 2, Sch A (wherein the age of consent to medical care is 16) is permitted. Otherwise, children under age 16 must have a surrogate decision-maker irrespective of actual maturity or competence. A child who is at least age 16 can consent to the collection, use or disclosure by a health information custodian of personal health information (including for research purposes), provided he or she is capable of consenting.

103 R v RMB, [2006] MJ no 173 (QL) (MBPC), Garfi nkel J (“[a] minor of three years of age, for example, has less right to privacy than a minor aged nine or one aged 13 ... because the minor is so young ... [and] [a] nine-year-old may be entitled to a greater degree of privacy, but it is not absolute” at para 20). See also Benjamin Shmueli & Ayelet Blecher, “Privacy for Children” (2011) 42:3 Colum HRL Rev 759 (concluding after a survey of American jurisprudence that “privacy is recognized for adults but less so for children, and does not exist for children vis-à-vis parents” at 763); South Carolina v Samuel Whitner, (2012) 732 SE2d 861 (SC Sup Ct), Pleicones J (“a minor’s interest in privacy has barely been accorded legal recognition” at 869). But see Children’s Aid Society of Haldimand-Norfolk v CC (2004), 131 ACWS (3d) 453, 7 RFL (6th) 235 (ONCJ), Thibideau J (upholding the desire of a 12-year-old to not introduce the contents of a private journal and an autobiography she prepared for a school project into evidence in a child protection hearing, as “[e]xamination of the motivation for the position of the child with respect to privacy and a subsequent balancing of interests gives validity to the philosophy that the child in question is a person before the court whose views and preferences, when appropriate, have some meaning” at para 31).


child, the child cannot expect to exercise self-determination or security to the same degree as an adult because society expects parents to “act in the best interests of” their maturing child, we also generally acknowledge that a complete abrogation of privacy by the parents would sacrifi ce both the child’s fl ourishing and autonomy and also destroy the inter-connected, familial trust relationship.104 As a society, most of us want children to develop their personhood, self-reliance and creativity. Thus, as they mature and become competent, their involvement in the expansion of their privacy interests should be refl ected in various activities, including research studies.

There is little consensus about the privacy dynamic between parents and children, and even less between children and researchers. Neither privacy legislation nor policy guidelines on research address the position that the benefi ts or harms of infringing upon the child’s privacy, from both self-determination and security perspectives, should be taken into account. Consequently, both the abstract, theoretical issues of a child’s autonomy and self-determination, and the practical issues of information control, return of research results and incidental fi ndings, and consent or assent are left unanswered.

Biobank PracticesAll three paediatric biobanks require the authorization of parents prior

to collecting, storing and using the biological material and data of their child. There is variation, however, in the level of disclosure regarding poten-tial risks, the scope of the right to withdraw, potential re-contact, and the types of material or data to be collected, even within the same biobank (e.g. Biobank A), suggesting that providing guidance to REBs is as important as regulating biobanks. The biobank policy variation also indicates that the “soft law” nature of international and national norms and guidelines does not suffi ciently compel paediatric biobanks to explicitly address privacy and autonomy issues for competent children or parents in the consent forms.

104 See e.g. Bruce Hafen, “Children’s Liberation and the New Egalitarianism: Some Reservations about Abandoning Children to Their ‘Rights’” (1976) BYUL Rev 605; Angela Campbell, “Stretching the Limits of ‘Rights Talk’: Securing Health Care Entitlements for Children” (2003) 27 Vt L Rev 399; Emily Buss, “Allo-cating Developmental Control Among Parent, Child and the State” (2004) U Chicago Legal F 27.


Table 6 illustrates the biobank practices relating to the nature of the shared relationship between the child, the parents and the researcher.

5.3 SummaryAnalysis of the above three issues in the context of the case studies suggests that legislative standards and biobank practices are inconsistent (across and within each) when it comes to the privacy of paediatric biobank partici-pants. Legislation cannot remedy all of the potential risks and benefi ts to children, but the case studies demonstrate that, in the absence of clear statu-tory structures, researchers and institutions may act in disparate ways. For example, largely absent from the policies and consent forms is information regarding the ongoing control and use of the biological material and infor-mation collected. Further, the “potential risks and benefi ts” sections of the forms focus exclusively on the clinical risks, i.e. reactions to venipuncture or heart rate variability tests, rather than the ethical or informational risks, namely, autonomy and privacy concerns. Finally, beyond laws or paedi-atric guidelines determining competency for participation in research (i.e. the “mature minor” doctrine), these various legislative responses to health information privacy do not reach the issue of parental and researcher versus child privacy interests.

6. RecommendationsProtecting personal information privacy in the context of paediatric biobanks is an exigent endeavour compounded by complex, mismatching and incom-plete legislation. A partial explanation for this may lie in the constitutional constraints that complicate the ability to enact harmonized legislative rules on paediatric biobanking. Specifi cally, civil rights and health are provincial matters.105 While Canada’s National DNA Bank is federally regulated because criminal law is constitutionally a federal matter,106 paediatric biobanks largely revolve around (provincial) health matters that refl ect regional contexts, even if some are national in scope. The Supreme Court reference decision in 2010 on the Assisted Human Reproduction Act107 demonstrates that attempts by the federal government to address concerns that are health legislation

105 Constitution Act, supra note 55, ss 92(7), (13), (16).106 Ibid, s 91(27).107 Assisted Human Reproduction Act, SC 2004, c 2.


Biob

ank

Ass

ent o

r co

nsen

t of

the

child

Retu

rn o

f ind

ivid

ual r

esul

ts (a

nd in

cide

ntal

fi nd

ings

) to

the

pare

nts

and/

or c

hild

With

draw

al

Biob

ank

A•

No

disc

ussi

on o

f

asse

nt o

r con

sent

of

th

e ch

ild

• N

o re

turn

of i

ndiv

idua

l stu

dy re

sear

ch re

sults

to p

aren

t or c

hild

, but

if re

quire

d by

par

ent,

he

alth

test

resu

lts m

ay b

e di

sclo

sed

(e.g

. par

ent m

ay re

ques

t tha

t ski

n te

st re

sults

or l

ung

fu

nctio

n te

st re

sults

be

sent

to fa

mily

phy

sici

an o

r pae

diat

ricia

n)•

No

disc

ussi

on o

f han

dlin

g of

inci

dent

al fi

ndin

gs, b

ut c

onse

nt fo

rm s

tate

s th

at “

If ne

w

in

form

atio

n ar

ises

that

may

affe

ct y

our w

illin

gnes

s to

rem

ain

in th

is s

tudy

, you

will

be

ad

vise

d of

this

info

rmat

ion

prom

ptly

”.

• Pa

rent

may

with

draw

at a

ny ti

me

• If

pare

nt d

ecid

es to

with

draw

from

stu

dy, p

aren

t will

not

be

in

clud

ed in

follo

w-u

p da

ta c

ol-

le

ctio

ns a

nd s

tudy

will

onl

y us

e

data

par

ent/

child

pro

vide

d

durin

g stu

dy p

artic

ipat

ion

• U

ncle

ar w

heth

er c

hild

has

righ

t

of w

ithdr

awal

Biob

ank

B•

Biob

ank

B D

atab

ank

an

d Ba

nk o

f Bio

logi

cal

M

ater

ial M

anag

emen

t

Polic

y ad

dres

ses

pos-

si

bilit

y of

obt

aini

ng

as

sent

of c

hild

ren

“w

hen

they

are

old

enou

gh to

und

ersta

nd”

an

d co

nsen

t whe

n th

ey

be

com

e ad

ults

• Po

licy

state

s th

at n

eed

fo

r ass

ent i

s ba

sed

on

m

atur

ity a

nd

in

telli

genc

e of

the

child

• Pa

rent

will

not

rece

ive

indi

vidu

al re

sults

• If

resu

lts re

veal

a s

igni

fi can

t hea

lth o

r dev

elop

men

tal p

robl

em th

at p

aren

t’s d

octo

r

shou

ld b

e aw

are

of in

ord

er to

follo

w u

p th

e pr

egna

ncy,

the

mot

her,

the

fath

er o

r the

chi

ld

ap

prop

riate

ly, th

e pa

rent

’s do

ctor

will

be

info

rmed

in o

rder

to ta

ke c

harg

e of

the

follo

w-

up

. The

se re

sults

cou

ld b

e ad

ded

to th

e m

edic

al fi

les

• Pa

rent

may

with

draw

at a

ny

tim

e, a

s m

ay c

hild

who

se

m

atur

ity a

llow

s hi

m/h

er to

unde

rsta

nd th

e im

plic

atio

ns o

f

with

draw

ing

Biob

ank

C•

Chi

ldre

n ag

ed 1

4-

18 s

peci

fi cal

ly a

sked

to p

rovi

de a

ssen

t to

pa

rtici

pate

• C

hild

ren

unde

r age

14

m

ust h

ave

study

expl

aine

d to

them

at a

leve

l tha

t is

ppro

pria

te

an

d th

ey m

ust p

rovi

de

as

sent

to p

artic

ipat

e

• N

ot a

ll in

form

atio

n re

gard

ing

patie

nt’s

entir

e se

quen

ced

geno

me

will

be

revi

ewed

in

deta

il•

Chi

ldre

n/M

inor

s co

nsen

t for

m:

•

Pare

nt h

as th

e op

tion

to b

e in

form

ed o

f the

resu

lts o

f the

stu

dy o

f the

rare

dis

ease

in

fa

mily

by

patie

nt’s

doct

or w

ho is

par

t of t

he s

tudy

. With

out o

ptio

n, p

aren

t will

be

info

rmed

of th

e id

entifi

cat

ion

of o

ther

dis

ease

-cau

sing

mut

atio

ns th

at c

ould

alte

r the

man

agem

ent o

f

the

child

’s he

alth

dur

ing

child

hood

by

patie

nt’s

doct

or w

ho is

par

t of t

he s

tudy

•

Info

rmat

ion

rela

ting

to n

on-p

ater

nity

or a

dult

onse

t dis

orde

rs m

ay b

e di

scov

ered

but

will

not

be

disc

lose

d in

the

cont

ext o

f the

stu

dy•

Affe

cted

/Una

ffect

ed/I

ncom

pete

nt A

dults

con

sent

form

:

• Pa

tient

will

be

info

rmed

of t

he re

sults

of t

he s

tudy

of t

he ra

re d

isea

se in

fam

ily b

y

patie

nt’s/

war

d’s

doct

or w

ho is

par

t of t

he s

tudy

. Pat

ient

has

the

optio

n to

be

info

rmed

by

pe

rson

al p

hysi

cian

abo

ut th

e id

entifi

cat

ion

of a

dditi

onal

dis

ease

-cau

sing

mut

atio

ns th

at

ha

ve c

linic

al s

igni

fi can

ce, a

nd w

here

pre

vent

ion

and

treat

men

t are

ava

ilabl

e

• Pa

rent

may

with

draw

at a

ny ti

me

an

d w

ithdr

aw th

eir c

hild

at a

ny

tim

e•

Chi

ldre

n ag

ed 1

4-18

yea

rs m

ay

w

ithdr

aw a

t any

tim

e•

Unc

lear

whe

ther

chi

ld u

nder

14 y

ears

of a

ge h

as ri

ght o

f

with

draw

al

Tabl

e 6:

Bio

bank

pra

ctic

es re

latin

g to

the

natu

re o

f the

sha

red

rela

tions

hip

of th

e ch

ild, p

aren

ts an

d re

sear

cher


in pith and substance could well be ruled unconstitutional.108 Thus, the development of federal (paediatric) biobank privacy legislation could face multiple legal and political impediments, and so reliance on ethical norms and guidelines, professional codes of conduct, and provincial and territorial health and privacy laws will likely continue. Moreover, differing views as to the proper balance between privacy and the sharing of data and samples also make the formulation of a broadly accepted biobank governance structure a challenging undertaking.

Nonetheless, while Canada’s forensic National DNA Data Bank, created to collect DNA from certain criminals, is afforded explicit biobank legislation, oversight bodies, and a variety of safeguards, research biobanks suffer from a patchwork of under-inclusive regulatory provisions. Accountability and transparency could be affected in the face of such regulatory discrepancy, and international scientifi c collaboration could suffer if Canada’s privacy laws are found to be out of tune with international regulatory trends. Inter-national comparative analysis reveals that some countries adopt specifi c biobank professional guidance or even legislation to address the issues iden-tifi ed above,109 yet the legislation is silent on addressing the needs of biobank research involving children. That privacy protections available to Canadians vary from one province or territory to another, and from one sector (public) to another (private or hybrid), adds a further cumbersome, outdated and inadequate structural dimension to paediatric biobanks.

While professional guidance may be the best way forward, consid-ering emerging technologies such as next-generation sequencing used by

108 Reference re Assisted Human Reproduction Act, 2010 SCC 61, [2010] 3 SCR 457. See also Dave Snow, “The Judicialization of Assisted Reproductive Technology Policy in Canada: Decentralization, Medicalization, and Mandatory Regulation” (2012) 27:2 CJLS 169.

109 See e.g. Biobanks in Medical Care Act, (Swed), SFS 2002:297 (2002); Human Genes Research Act 2000, (Est), RT I 2000, 104, 685; Human Biobank Management Act, (Taiwan), Hua-Zong-Yi-Yi-Tzu No 09900022481 (2010). See also Edward S Dove, “The Genetic Privacy Carousel: A Discourse on Proposed Genetic Privacy Bills and the Co-Evolution of Law and Science” (2011) 9:4 Current Pharma-cogenomics and Personalized Medicine 252; Ma’n H Zawati, Bartha M Knop-pers & Adrian Thorogood, “Biobanking and International Collaboration” (2013) [unpublished, on fi le with authors].


researchers accessing paediatric biobanks,110 and while many of the gaps in legislative protection are remedied in the ethical norms of the TCPS, this guidance suffers from its own fl aws. The TCPS is applicable only to insti-tutions eligible to receive and administer research funding from the three agencies that authored the document or certain health and social service institutions in provinces that have policies endorsing it. Furthermore, penal-ties for violation of TCPS provisions are limited to the ineligibility to receive or suspension of agency funding, unless the breach constitutes a criminal act.111 Reliance on ethical guidance alone, therefore, may not ensure the adequate protection of children.

We briefl y offer fi ve recommendations as possible avenues to bridge the gap between norms, laws and practice. This guidance, which should be further explored and tested in future articles and studies (especially within the broader, complex fi eld of biobank governance112), is intended to assist agencies, legislators, researchers and REBs when developing and inter-preting privacy laws and regulations pertaining to paediatric biobanks.

Recommendation 1: Privacy legislation should be harmonized across Canada.The lack of harmonization is a recurring problem for biobank stakeholders as it is an additional cost and administrative burden. As Canadian policy-makers and politicians have acknowledged, legal dissimilarity creates the risk of distorting the equivalent level of protection that the privacy laws are supposed to achieve and ensure.113 It also inhibits the interoperability of

110 Adrian Thorogood et al, “Whole-Genome Sequencing and the Physician” (2012) 81 Clinical Genetics 511.

111 “Schedule 8: Investigation and Resolution of Breaches of Agency Policies,” online: Natural Sciences and Engineering Research Council of Canada <http://www.nserc-crsng.gc.ca>. See also “Draft Agreement on the Administration of Agency Grants and Awards by Research Institutions,” online:

<http://www.cihr-irsc.gc.ca>.112 See e.g. Kaye et al, Governing Biobanks, supra note 27.113 Commission on the Future of Health Care in Canada, Building on Values: The

Future of Health Care in Canada – Final Report (Ottawa: Commission on the Future of Health Care in Canada, 2002) (“Canada Health Infoway should take the lead in promoting harmonized privacy rules across the country...” at xxvi).


biobanks.114 Australia, which also has various levels of privacy laws (federal, state and territorial), has advocated harmonization of its privacy legislation. In 2002, the Offi ce of the Privacy Commission of New South Wales noted (in the specifi c context of genetic information) that:

A uniform approach to genetic information privacy is essential to ensure that all persons have equal protection regardless of where they live and who handles their genetic information. Widely differing standards of protection not only undermine human rights, they also undermine public confi dence in the way that institutions handle their personal information, especially in an increasingly networked information environment. Lack of uniformity can also add to confu-sion for those responsible for handling personal information, as well as obstruct cross-border fl ows of information.115

We do not advocate a particular avenue to achieve harmonized privacy legislation. Various models can be envisioned, such as new, uniform federal and provincial privacy or biobank legislation, or a regulatory framework specifi cally for biobanks that applies to all sectors. We note two qualifi cations, however. First, as discussed above, there are legal and political roadblocks to achieving sweeping legislative reform. In the short term, piecemeal legisla-tive amendments or regulations through intergovernmental cooperation are more likely. Second, much success is already being achieved through health information protection legislation, such as Ontario’s PHIPA. Amending these statutes to better incorporate international privacy regulatory trends and specifi c biobank-related issues, and encouraging the remaining provinces and territories that have yet to enact health information protection legis-lation to do so (on a harmonized plane), may be suitable paths to protect privacy in paediatric biobanks. Regardless, a recalibration of current legisla-tion is needed so that it adequately and harmoniously addresses paediatric biobanks and associated privacy concerns.

114 Michael Kiehntopf & Michael Krawczak, “Biobanking and International Inter-operability: Samples” (2011) 130:3 Human Genetics 369.

115 Offi ce of the Privacy Commission (New South Wales), Submission G118 (18 March 2002), in Australia Law Reform Commission and Australian Health Ethics Committee, Essentially Yours: The Protection of Human Genetic Information in Australia, ALRC Report 96 (Sydney: Commonwealth of Australia, 2003) at 245-246 [Essentially Yours].


Recommendation 2: Applicable privacy legislation should specify that genetic information and biological materials are considered personal (health) information.Privacy legislation should specify that personal or health information includes genetic information about an individual in a form which is or could be predictive of the health (at any time) of the individual or a biological relative, and whether or not the information is collected in relation to the health of, or the provision of a health service to, the individual or a biological relative.116 Biological material should also be included in the defi nition of personal information or health information. Noting the particular paediatric context, the legislation should provide legally enforceable privacy standards for the collection, storage, use and transfer of biological material. Making explicit that genetic information and biological material is health informa-tion covered by privacy legislation would better protect the privacy interests of all individuals, including children. We do note, however, the particular issues that can arise in this context, such as confl icts between a parent and a child in accessing such health information.

As a corollary, privacy legislation should grant a competent individual, including a child, conditional access to his or her own biological material and data. Because of logistical and scientifi c constraints, such access should be made only for the purpose of medical testing, diagnosis or treatment. Further, the right to access can be refused where: (a) it is not physically possible; (b) providing access contradicts the purposes of the biobank; or (c) its release to an individual raises familial or other concerns. We distin-guish access from withdrawal from research, which should continue to follow norms and guidelines concerning the coding of data and samples or their destruction or removal from further research, as per the wishes of the research participant.

Recommendation 3: Privacy legislation should provide clear sanctions and privacy commission enforcement powers for unauthorized access and disclosure of personal (health) information.The Privacy Commissioner of Canada has called for amendments to PIPEDA to allow for greater sanctions against those who violate privacy.117 Looking abroad to our Commonwealth cousins, the United Kingdom’s Informa-

116 Adapted from Essentially Yours, ibid at 255.117 See e.g. “Fines needed to help stem growing data breaches, Privacy Commis-


tion Commissioner’s Offi ce can enforce fi nes of up to £500,000,118 and the Parliament of Australia introduced legislation that allows its federal privacy commissioner to apply to the federal court to levy fi nes on indi-viduals and organizations for privacy breaches.119 Similarly, in Canada, each of the federal and provincial privacy commissioners should have the power to impose meaningful and signifi cant fi nes on individuals and enti-ties (including biobanks, respecting constitutional parameters) that breach privacy. In addition, all privacy commissioners should have order-making powers and the ability to compel entities to report privacy breaches to their offi ce. This could mitigate possible public backlash and resultant diminish-ment in trust that could stem from privacy breaches in paediatric biobanks. More meaningful penalties, combined with sanctioning and enforcement powers, would encourage biobanks to take a proactive and preventive approach to protecting privacy.

Recommendation 4: Privacy legislation should allow privacy commissioners to play an integral part in the regulatory framework for paediatric biobanks created for research. Privacy commissioners should incorporate in their regulatory scrutiny a bottom-up approach through ongoing dialogue with REBs and the broader biobanking community.Many REBs lack specifi c expertise, are under-regulated and cannot be expected to perform the kind of coherent, effective and effi cient privacy-related review and oversight that is needed for paediatric biobanks.120

sioner says” (4 May 2011), online: Offi ce of the Privacy Commissioner of Canada <http://www.priv.gc.ca>; “Social media websites ignoring privacy laws, watchdog says” CBC News (29 May 2012), online: CBC <http://www.cbc.ca>.

118 Data Protection Act 1998 (UK), c 29, s 55A; The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010, SI 2010/31, s 2.

119 Privacy Amendment (Enhancing Privacy Protection) Bill 2012 (Cth), passed 29 Nov -ember 2012 and received Assent 12 December 2012.

120 Lemmens & Austin, supra note 74 (noting that REBs are accustomed to reviewing consent in the context of traditional medical research, and that while statutes require REBs to consider whether adequate safeguards are in place to protect the privacy and confi dentiality of the health information in question, “to do so requires specialized knowledge regarding information systems and anonymisation protocols that is unclear REB members possess” at 32); Lisa M Austin & Trudo Lemmens, “Privacy, Consent, and Governance”, in Kris Dierickx


Indeed, research indicates that Canadian REB members fi nd they lack clear guidance as to whether they should play an overseeing role of biobanks, and if so, what that role should be.121 It is doubtful that most REB members are apprised of the multiple privacy issues impacting biobanks, much less paediatric biobanks, and current regulatory responses to those issues. Cana-da’s National DNA Data Bank is overseen by the National DNA Data Bank Advisory Committee, on which a representative of the Offi ce of the Privacy Commissioner of Canada (OPC) sits to ensure that the Data Bank has access to expert advice in the fi eld of individual privacy in the criminal law context. The Data Bank is also subject to auditing by the OPC at any time. Paediatric biobanks, like other biobanks, should be subject to similar regulatory scru-tiny and oversight by privacy commissioners.

This policy recommendation should not be constrained by constitutional parameters per se, as we do not advocate the creation of a federal personal health information or biobanking law. Provincial privacy commissions and the OPC can work collaboratively with provincial and federal policymakers and REBs to improve competency in biobank oversight. This recommen-dation, therefore, is bidirectional: privacy commissions should inject more regulatory scrutiny into the REB process (a top-down approach), while REBs and other stakeholders, such as researchers, privacy experts and the general public, should provide privacy commissions with comments and recommen-dations regarding privacy and biobanking issues (a bottom-up approach). This is not to diminish or eliminate the role of REBs. Rather, it is to better

& Pascal Borry, eds, New Challenges for Biobanks: Ethics, Law and Governance (Antwerpen, Belg: Intersentia, 2009) 111 (“[t]he problem is not so much that [REBs] do not know what research will be undertaken, but that they cannot be sure that the risk of privacy violation is adequately, or consistently, dealt with” at 116); Michael Yeo, “Looking Out from Inside the Panopticon: A Privacy Perspective on Biobanking” (Analytic paper commissioned by the Offi ce of the Privacy Commissioner of Canada for the 29th International Conference of Data Protection and Privacy Commissioners, 2007) [unpublished] (“[e]thics review is hardly an appropriately democratic and accountable locus of responsibility and authority for resolving the signifi cant privacy issues posed by biobanking, nor for ensuring that our privacy rights and interests are adequately represented and weighed” at 33).

121 Elaine Gibson et al, “Who’s Minding the Shop? The Role of Canadian Research Ethics Boards in the Creation and Uses of Registries and Biobanks” (2008) 9 BMC Medical Ethics 17.


protect the privacy interests of children by including in the review and over-sight by REBs competent and experienced experts, who themselves have been informed by a broad community of various biobanking stakeholders.

Recommendation 5: The provincial and federal governments should work towards developing a web-based, open access, federally administered database of all Canadian paediatric biobanks.Open access databases exist for clinical trials.122 These databases offer up-to-date information on both publicly and privately supported clinical trials for a variety of diseases and conditions. Given their success and the exponential growth of biobanks, federal and provincial privacy commissions, in collab-oration with Health Canada, should explore the possibility of preparing a transparent, federally administered, web-based, open access database of all Canadian paediatric biobanks.123

This long term recommendation124 can improve the protection of privacy in paediatric biobanks by allowing regulators and the public to have a better Canadian biobank “map,” thereby improving knowledge about the scope and content of Canadian paediatric biobanking. It would also allow poten-tial future biobank participants to inform themselves about the nature of biobanks and perhaps guide them in deciding whether to participate in a

122 See e.g. International Clinical Trials Research Platform Search Portal, online: World Health Organization <http://apps.who.int/trialsearch/>; ClinicalTrials.gov, online: National Institutes of Health <http://www.clinicaltrials.gov/>.

123 C.f. Health Canada, Guidance for Health Canada: Biobanking of Human Biological Material (Ottawa: Minister of Public Works and Government Services Canada, 2011) [draft unpublished, on fi le with authors]. Each record in the database could include information on the following (similar to ClinicalTrials.gov): 1) underlying research purposes/intended use; 2) title, description and design of the study (if clinical or research-based); 3) requirements for participation (if clinical or research-based); 4) location(s) of the biobank; and 5) contact infor-mation.

124 Such an undertaking would involve, at a minimum, prior comprehensive research, cost-benefi t analysis, discussions with various stakeholders, careful planning, and years of dedicated political and policymaking will. To facilitate this endeavour, the Public Population Project in Genomics (P3G) and Society, an organization supporting the networking of biobanks, has launched an inter-national paediatric research biobanking platform. See P3G, online:

<http://www.p3g.org>.


particular research or clinical biobank. Furthermore, a database would likely improve transparency and public engagement, and allow regulators and policymakers to keep track of biobanks’ adherence to external and internal policies (legislative or otherwise) that impact privacy, among other matters. In turn, this would strengthen the value and validity of paediatric biobank research and clinical outcomes.

7. ConclusionCanadian paediatric biobanks face multiple privacy issues that are not adequately addressed in the current legislation. This is hardly a problem unique to Canada,125 but one that this country should take a lead in reme-dying so as to preserve its deserved reputation in cutting edge biomedical research and progressive privacy protection. The positive recent spate of provincial personal health information legislation provides much greater privacy protection for personal health information, and also now covers aspects of biobanking, but the degree to which it covers all aspects, partic-ularly with samples and in the paediatric context, is an open question. We therefore conclude that the formulation of laws recognizing the legal validity of biobanks remains an issue that Canadian policymakers should address. Amending current legislation or working towards new legislation in the specifi c context of biobanking may not be an ideal solution, however; many bespoke legal frameworks for biobanks have not been successful at effectively protecting participants’ interests.126 At the same time, paediatric researchers, biobank managers and participants may fi nd that “soft law,” be it in the form of localized (best) practices and guidelines or otherwise, allows them desirable fl exibility and is suffi cient to protect a child’s privacy inter-ests. Flexible though the status quo arrangement may be, it does not appear to be suffi ciently protecting privacy. Rather, the case studies indicate that statutory and regulatory gaps are not being adequately fi lled by standards of practice, raising the spectre of future privacy violations with inadequate legal remedies.

125 See Salvaterra, supra note 21 (fi nding that researchers in Europe involved in paediatric biobanking cite a lack of specifi c policies for paediatric biobanking and the need to adopt regulations dedicated to this fi eld).

126 Shawn HE Harmon, Graeme Laurie & Gill Haddow, “Governing Risk, Engaging Publics and Engendering Trust: New Horizons for Law and Social Science?” (2013) 40 Science and Public Policy 25.


But navigating between the Scylla and Charybdis of biobank and privacy laws and policies is mitigated by recognizing that the privacy land-scape is knowable and capable of improvement. Thus, to come full circle and answer the question posed at the beginning of this Article, charting the privacy landscape in Canadian paediatric biobanks is not a Sisyphean ordeal, but it is a Herculean challenge. This Article has initiated the discussion by identifying the contours of the challenge. Now, more work must be done by ethical, legal and social science researchers and policymakers to determine specifi c solutions, including how best to address the privacy challenges in paediatric biobanking (e.g. through regulation, policies, standard operating procedures, or refl exive modes of governance), as well to determine how paediatric biobank researchers and participants – parents and children alike – view privacy issues. Only through an acknowledgment of the extant gaps in privacy legislation and a collective will to remedy these gaps can Canada ultimately move towards creating a privacy legal framework that both adequately protects children’s privacy and also advances scientifi c research and translational outcomes. This Article hopefully sets the beginning stages of necessary reform in paediatric biobanking, which perhaps will pave the way for “adult” biobanking as well.

Charting the Privacy Landscape in Canadian Paediatric Biobanks

Documents

Transcript of Charting the Privacy Landscape in Canadian Paediatric Biobanks