CHARTING THE PRIVACY LANDSCAPE IN CANADIAN PAEDIATRIC BIOBANKS
Edward S. Dove, Lee Black, Denise Avard & Bartha M. Knoppers*
1. Introduction: The Evanescence of PrivacyIs unpacking the meaning of privacy a Sisyphean ordeal? While privacy has long been considered a “universal,”1 it is also labelled a “chameleon-like word,”2 “protean,”3 “ephemeral,”4 a “black box,”5 a “haystack in a
* Edward S. Dove, LLM, is an Academic Associate at the Centre of Genomics and Policy, Department of Human Genetics, Faculty of Medicine, McGill University. Lee Black, LLM, is an Academic Associate at the Centre of Genomics and Policy and a DCL (PhD) candidate at McGill University, Faculty of Law. Denise Avard, PhD, is Research Director at the Centre of Genomics and Policy and an Associate Professor in the Department of Human Genetics, Faculty of Medicine, McGill University. Bartha M. Knoppers, PhD, OC, OQ, is Director of the Centre of Genomics and Policy and Canada Research Chair in Law and Medicine. All authors acknowledge and thank the Offi ce of the Privacy Commissioner of Canada (OPC), the Maternal Infant Child and Youth Research Network (MICYRN), the Finding of Rare Disease Genes (FORGE) in Canada Project, and the Réseau de médecine génétique appliquée (RMGA) for funding to support this research and publication.
1 Judith Wagner DeCew, In Pursuit of Privacy: Law, Ethics, and the Rise of Technology (Ithaca, NY: Cornell University Press, 1997) at 12.
2 Lillian R BeVier, “Information About Individuals in the Hands of Government: Some Refl ections on Mechanisms for Privacy Protection” (1995) 4 Wm & Mary Bill Rts J 455 at 458.
3 R v Tessling, [2004] 3 SCR 432 at para 25, 63 OR (3d) 1, Binnie J [Tessling]; Tom Gerety, “Redefi ning Privacy” (1977) 12 Harv CR-CLL Rev 233 at 234.
4 Ontario (AG) v Dieleman (1994), 20 OR (3d) 229 at para 568, 117 DLR (4th) 449 (Ont Gen Div).
5 Lars Øystein Ursin & Kristin Solum Steinsbekk, “Peeking into the Black Box of Privacy – Biobank Participants on the Importance of Recognition” (2012) 21:2 Norsk Epidemiologi 269.
Health Law Journal Volume 20 (2013)2
hurricane,”6 and a “broad and somewhat evanescent concept.”7 One wonders if a defi nition is possible or even necessary given that privacy instruments, such as the statutory privacy torts in Canada, do not state what privacy means.8 Some scholars have nobly attempted defi nitions,9 while others contend that any attempt to circumscribe privacy in a uniform and mono-lithic manner would undermine the richness, context-dependency, fl uidity and malleability of the concept.10
6 Ettore v Philco Television Broadcasting Co, 229 F (2d) 481 at 485 (3d Cir 1956). 7 Dagg v Canada (Minister of Finance), [1997] 2 SCR 403 at para 67, 148 DLR (4th)
385, La Forest J, dissenting. 8 Privacy Act, RSBC 1996, c 373; Privacy Act, RSNL 1990, c P-22; The Privacy Act,
RSS 1978, c P-24; The Privacy Act, CCSM c P125. 9 See e.g. Graeme Laurie, Genetic Privacy: A Challenge to Medico-Legal Norms
(Cambridge, UK: Cambridge University Press, 2002) (viewing privacy as a “state of affairs”, rather than a right or claim, which contains an informational and spatial component); Daniel J Solove, “A Taxonomy of Privacy” (2006) 154 U Pa L Rev 477; Daniel J Solove, Understanding Privacy (Cambridge, Mass: Harvard University Press, 2008) (privacy is “[a] set of protections from a plurality of problems that all resemble each other, yet not in the same way” at 100); DeCew, supra note 1 (privacy is “whatever types of information and activities [that] are not, according to a reasonable person in normal circumstances, the legit-imate concern of others” at 58); Anita L Allen, “Genetic Privacy: Emerging Concepts and Values” in Mark A Rothstein, ed, Genetic Secrets: Protecting Privacy and Confi dentiality in the Genetic Era (New Haven, CT: Yale University Press, 1997) 31 (situating privacy within four dimensions: informational privacy concerns about access to personal information; physical privacy concerns about access to persons and personal spaces; decisional privacy concerns about govern-mental and other third-party interference with personal choices; and propri-etary privacy concerns about the appropriation and ownership of interests in human personality); Kendall Thomas, “Beyond the Privacy Principle” (1992) 92 Colum L Rev 1431 (dividing the US constitutional right to privacy into three paradigms: zonal, relational and decisional).
10 Sonia Le Bris & Bartha M Knoppers, “International and Comparative Perspec-tives of Privacy” in Rothstein, supra note 9, 418 at 438. See also James Q Whitman, “The Two Western Cultures of Privacy: Dignity versus Liberty” (2004) 113 Yale LJ 1151 (contrasting American privacy norms based on protecting primarily a liberty interest and European privacy norms based on protecting dignity and personal honour); Avner Levin & Mary Jo Nicholson, “Privacy Law in the United States, the EU and Canada: The Allure of the Middle Ground” (2005) 2 U Ottawa L & Tech J 357 (fi nding that Canadian privacy protection, in
Dove, Black, Avard & Knoppers Paediatric Biobanks 3
Philosophical, ontological and semantic debates aside, most seem to agree that privacy encompasses an ability “to be left alone”11 and to exercise some degree of control over access to and use of personal information.12 This is refl ected in privacy legislation and policies across much of the world,13 and continues to infl uence its legislative reform and passage as society moves into the digital age.14 The desire for informational self-control coincides with the increasing tension between (post)modern mobility-driven autonomy and technoscientifi c innovations that transform “life itself.”15 And so, while
contrast to the US and EU, is focused on individual autonomy through personal control of information).
11 Samuel C Warren & Louis D Brandeis, “The Right of Privacy” (1890) 4 Harv L Rev 193 at 195. Warren and Brandeis implied that the right to privacy is a special case of the “right to be let alone.” The notion of a right to be let alone was fi rst advanced in Thomas M Cooley, A Treatise on the Law of Torts, or the Wrongs Which Arise Independent of Contract (Chicago: Callaghan & Co, 1880).
12 This statement is made with the assumption that much of this Journal’s reader-ship resides in societies that subscribe to the privacy values described in this article.
13 See e.g. OECD, Recommendation of the Council concerning Guidelines governing the Protection of Privacy and Transborder Flows of Personal Data (Paris: OECD, 2013) [OECD 2013 Guidelines]. See also Graham Greenleaf, “The Infl uence of Euro-pean Data Privacy Standards Outside Europe: Implications for Globalization of Convention 108” (2012) Int’l Data Privacy L 68. In 1970, and in response to growing concerns about databanks of sensitive information on citizens, the Parliament of the German federal state of Hesse enacted the world’s fi rst comprehensive information privacy statute. See Spiros Simitis, “Privacy – An Endless Debate?” (2010) 98 Cal L Rev 1989.
14 See e.g. EC, Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), COM (2012) 11 fi nal (25 January 2012).
15 DeCew, supra note 1 (“[a]nthropological literature documents the increased physical and psychological opportunities in modern societies to gain privacy through anonymity, mobility, and economic autonomy. At the same time, however, greater population density, technological advances, and increased governmental power all undermine an individual’s ability to maintain a private space within a broader social community” at 13). See also Peter Burns, “The Law and Privacy: the Canadian Experience” (1976) 52 Can Bar Rev 1 (“[t]he pressing need to preserve ‘privacy’ which is being threatened by science and technology to the point of surrender” at 1).
Health Law Journal Volume 20 (2013)4
privacy as a concept may forever remain ephemeral, within the dimen-sion of information privacy, one may fi nd use in the defi nition provided by the Supreme Court of Canada: “the right of the individual to determine for himself when, how, and to what extent he will release personal information about himself.”16
Two questions arise from this defi nition, however, at least for the purposes of this Article. First, does information privacy differ in ambit and application when the individual is generally considered vulnerable, such as a child? Recently, the Supreme Court has suggested that children may be deserving of enhanced privacy protection. It noted that “the inherent vulner-ability of children has consistent and deep roots in Canadian law,”17 resulting in protection for young people’s privacy in various national statutes and international conventions. The Court quoted favourably an Ontario Court of Justice decision regarding young persons:
Privacy is recognized in Canadian constitutional jurisprudence as implicating liberty and security interests. In Dyment, the court stated that privacy is worthy of constitutional protection because it is “grounded in man’s physical and moral autonomy,” is “essential for the well-being of the individual,” and is “at the heart of liberty in a modern state” (para. 17). These considerations apply equally if not more strongly in the case of young persons. Furthermore, the constitutional protection of privacy embraces the privacy of young persons, not only as an aspect of their rights under section 7 and 8 of the Charter, but by virtue of the presumption of their diminished moral culpa-bility, which has been found to be a principle of fundamental justice under the Charter.
. . .
[T]he protection of the privacy of young persons fosters respect for dignity, personal integrity and autonomy of the young person. [Emphasis added]18
16 R v Duarte, [1990] 1 SCR 30 at para 25, 65 DLR (4th) 240, La Forest J. 17 AB v Bragg Communications Inc, 2012 SCC 46 at para 17, [2012] 2 SCR 567,
Abella J [emphasis in the original]. 18 Ibid. at para. 18, citing Toronto Star Newspaper Ltd v Ontario, 2012 ONCJ 27 at
paras 40-41, 44, 255 CRR (2d) 207, Cohen J.
Dove, Black, Avard & Knoppers Paediatric Biobanks 5
A second question is how well does information privacy law, even when purposively drafted in abstract language to anticipate unknown trajectories and technoscientifi c innovations, cover emerging areas such as biobanks?19 Indeed, one of the most pressing issues at the intersection of children and biobanks is the robustness of structures – legal, ethical20 or otherwise – that both protect privacy and facilitate international research collaboration. Paediatric biobanks must navigate the rapids of socio-ethical, professional and legal norms while simultaneously advancing knowledge in biomedical research. Some of these norms transcend national boundaries, such as the requirement to obtain voluntary and informed consent. Others are location-specifi c and contextual, dependent on research ethics board (REB) over-sight, legislative decree or biobank governance infrastructure. A grand chal-lenge is properly addressing privacy issues that impact not only biobanks in general, but paediatric biobanks specifi cally.
This Article explores the legal contours of information privacy by systematically analyzing it in the context of Canadian paediatric biobanks that are created and used for research purposes, and that serve to acquire scientifi c and medical knowledge for the benefi t of children’s (and society’s)
19 Biobanks are defi ned in Section 3, infra. 20 Non-legal ethical norms play a critical role in Canadian biobanks. For instance,
biobanks that receive funding from any of the three major Canadian federal funding agencies (Canadian Institutes of Health Research, Natural Sciences and Engineering Research Council, and Social Sciences and Humanities Research Council), or are part of institutions that are eligible to receive and administer research funding from any of these three agencies, must ensure that their governance framework and policies conform to ethical standards established by the second edition of the Tri-Council Policy Statement (TCPS), which governs research involving human subjects: Interagency Advisory Panel on Research Ethics, 2nd Edition of the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (Ottawa: Her Majesty the Queen in Right of Canada, 2010) [TCPS]. Certain health and social service institutions in provinces also have policies endorsing the TCPS (e.g. the Ministère de la Santé et des Services sociaux du Québec). See Centre of Genomics and Policy (CGP), Maternal Infant Child and Youth Research Network (MICYRN), Best Practices for Health Research Involving Children and Adolescents, 2012, online: Centre of Genomics and Policy <http://www.genomicsandpolicy.org/best-practices.html> [Best Practices]. See also Edward S Dove et al, “Emerging Issues in Paediatric Health Research Consent Forms in Canada: Working Towards Best Practices” (2013) 14 BMC Medical Ethics 5 [Dove et al, “Emerging Issues”].
Health Law Journal Volume 20 (2013)6
health and development. Paediatric biobanks are rapidly evolving in terms of governance structures, participant population size, geographic distri-bution and fi eld(s) of study.21 Ensuring that personal information is suffi -ciently protected by way of legislation is challenged by such burgeoning and evolving advances in technology, particularly in genetics and genomics.22
We assess whether there are legislative limits to the effectiveness and regulatory oversight needed to adequately protect children’s privacy in paediatric biobanks;23 and if so, how to improve the status quo so as to foster public trust in paediatric health research using biobanks. Section 2 outlines the methodology for our case study of three paediatric biobanks and rele-vant privacy legislation. Section 3 discusses the Canadian biobank frame-work. Section 4 briefl y explores the relevant legislative privacy framework in Canada. Section 5 analyzes the applicability of the privacy framework to paediatric biobanks and explores three policy issues framing the privacy landscape in paediatric biobanks: (1) the use and transfer of the child’s data and samples; (2) the risks of unauthorized access by third parties; and (3)
21 See e.g. Emmanuelle Lévesque & Bartha M Knoppers, “Principes assurant la protection des enfants participant à des biobanques: du stade prénatal jusqu’aux adolescents” (2011) 5:2 McGill JL & Health 163; Elena Salvaterra et al, “Pediatric
Biobanking: A Pilot Qualitative Survey of Practices, Rules, and Researcher Opinions in Ten European Countries” (2012) 10:1 Biopreservation and Biobanking 29.
22 Marie Hirtle, “Children and Genetics: Comparative Study of International Policy Positions” (1998) 6 Health LJ 43.
23 Admittedly, “adequate protection” of children’s privacy is a vague notion, further challenged by the fact that the perspective of adequacy can vary greatly, depending on whether it is from a child’s or an adult’s. It is possible to employ certain principles to assess an area of regulation like privacy laws and biobanking: see e.g. Robert Baldwin & Martin Cave, Understanding Regulation: Theory, Strategy, and Practice (Oxford: Oxford University Press, 1999); Better Regu-lation Task Force, Regulation – Less is More: Reducing Burdens, Improving Outcomes: A BRTF Report to the Prime Minister (London, UK: Better Regulation Executive, 2005). To focus our research and stay within the spacing limits of this Article, however, we limit our assessment to adequacy rather than other principles such as proportionality, accountability, consistency, transparency or targeting. We defi ne “adequate protection” as privacy laws and regulatory content and mech-anisms that effectively and consistently protect a child’s personal information from unlawful breach, as viewed from a reasonable adult person, in the light of all the normal circumstances in Canada.
Dove, Black, Avard & Knoppers Paediatric Biobanks 7
the nature of the shared relationship between the child, the parents24 and the researcher. Each issue includes an examination of the legal and biobank practice dimensions that affect the processes and outcomes of paediatric biobanking and privacy protection. Section 6 provides recommendations to ameliorate the shortcomings in the current Canadian privacy landscape and Section 7 concludes the Article.
2. Research MethodologyTo chart the privacy landscape in Canadian paediatric biobanks, we under-took a legislative, jurisprudential and doctrinal analysis of relevant privacy laws through research on Westlaw Canada, LexisNexis Quicklaw, CanLII, HeinOnline, Google Scholar, and provincial/territorial and federal parlia-mentary websites. We also consulted A Compendium of Canadian Legislation Respecting the Protection of Personal Information in Health Research,25 developed by the Canadian Institutes of Health Research (CIHR) and last updated in 2005, as a base-point reference. The authors interpreted the legislation to determine the extent to which it applies to paediatric biobanks.
According to the Inventory of Pregnancy and Birth Cohort Studies in Canada, as of December 2009, there were at least 18 Canadian paediatric biobanks.26 In line with our defi nition of a paediatric biobank (Section 3), we selected three publicly funded Canadian biobanks constructed for research purposes, whose names have been anonymized: (1) Biobank A; (2) Biobank B; and (3) Biobank C. These biobanks were chosen because they differ in geographic scope (Québec and eastern Ontario-based versus pan-Canadian), type (popu-lation-based versus disease-based), participant population (pregnant women and children versus only children), participant duration (ranging from preg-nancy to two years or from birth through adulthood) and size (ranging from 500 to 15,000 participants). Table 1 summarizes the diversity of characteris-
24 For this Article, “parent(s)” includes legal representative(s), legal guardian(s) or other substitute decision-makers.
25 Canadian Institutes of Health Research, Adam Kardash & Antonella Penta, eds, A Compendium of Canadian Legislation Respecting the Protection of Personal Informa-tion in Health Research (Ottawa: Public Works and Government Services Canada, 2005).
26 Canadian Institutes of Health Research (CIHR) et al, Inventory of Pregnancy and Birth Cohort Studies in Canada, online: MICYRN
<http://www.micyrn.ca/databases/afhlistallrecords.asp>.
Health Law Journal Volume 20 (2013)8
tics. Information was obtained from one or more sources: policies listed on each biobank’s website; consent forms available on each biobank’s website or provided to us personally; and personal correspondence with the biobank researchers, ethicists, consultants and administrators.
3. The Canadian Paediatric Biobank Framework
3.1 Defi ning “Paediatric Biobank”Achieving a common and broadly applicable defi nition of “paediatric biobank” has proven diffi cult given that biobanks are by nature diverse, fl uid and imprecise “boundary objects.”27 In addition, the terms “child” or “minor,” which can be used as broad synonyms for “paediatric,” must be explicated. In Canada, a minor is a person who is not an adult, non-eman-cipated, and is under the age of majority (18 or 19 years of age is considered the legal age of majority, depending on the jurisdiction).28 Where addressed,
27 Kristien Hens et al, “Developing a Policy for Paediatric Biobanks: Principles for Good Practice” (2013) 21 European Journal of Human Genetics 2 [Hens et al, “Principles”]; Edward S Dove, Yann Joly & Bartha M Knoppers, “Power to the People: A Wiki-Governance Model for Biobanks” (2012) 13 Genome Biology 158; Peter H Watson & Rebecca O Barnes, “A Proposed Schema for Classifying Human Research Biobanks” (2011) 9:4 Biopreservation and Biobanking 327; Catherine Heeney, “Dynamic Networks of Practice” in Jane Kaye et al, Governing Biobanks: Understanding the Interplay between Law and Practice (Oxford: Hart Publishing, 2012) 93 [Kaye et al, Governing Biobanks]; Susan MC Gibbons, “Regulating Biobanks: A Twelve-Point Typological Tool” (2009) 17:3 Med L Rev 313. See also James R Griesemer & Susan Leigh Star, “Institutional Ecology, ‘Translations’ and Boundary Objects: Amateurs and Professionals in Berkeley’s Museum of Vertebrate Zoology, 1907-39” (1989) 19:3 Social Studies of Science 387 (describing boundary objects as entities that can be interpreted in different ways by different communities but are robust enough to maintain an identity across them).
28 The age of majority is 18 years of age in Alberta (Age of Majority Act, RSA 2000, c A-6, s 1), Manitoba (The Age of Majority Act, CCSM, c A7, s 1), Ontario (Age of Majority and Accountability Act, RSO 1990, c A7, s 1), Québec (art 153 CCQ), Prince Edward Island (Age of Majority Act, RSPEI 1988, c A-8, s 1) and Saskatch-ewan (The Age of Majority Act, RSS 1978, c A-6, s 2). The age of majority is 19 years of age in British Columbia (Age of Majority Act, RSBC 1996, c 7, s 1), New Brunswick (Age of Majority Act, RSNB 1973, c A-4, s 1(1)), Newfoundland and
Labrador (Age of Majority Act, SNL 1995, c A-4.2, s 2), the Northwest Territories
Dove, Black, Avard & Knoppers Paediatric Biobanks 9
the age for consent to medical care or to research varies across Canada,29 and can include the common law “mature minor” doctrine, which focuses more on the capabilities of the minor to understand, rather than a presumed age of consent to medical care or research30 (though, according to the Supreme Court, it does not mean “automatic judicial deference to the young person’s medical treatment decisions where doing so will put the adolescent’s life or health in grave danger”31).
For the purposes of this Article, a paediatric biobank is defi ned as a systematically organized and searchable collection of data and material
(Age Of Majority Act, RSNWT 1988, c A-2, s 2), Nova Scotia (Age of Majority Act, RSNS 1989, c 4, s 2(1)), Nunavut (Age Of Majority Act, RSNWT ((Nu)) 1988, c A-2, s 2) and the Yukon (Age of Majority Act, RSY 2002, c 2, s 1(1)).
29 In the medical context, the law respecting consent to medical treatment of persons who have attained the age of majority may apply to minors who have
attained an age of less than 18 years. In New Brunswick, for example, the law respecting consent to medical treatment of persons who have attained the age of majority applies, in all respects, to minors who have attained the age of 16 years in the same manner as if they had attained the age of majority: Medical Consent of Minors Act, SNB 1976, c M-6.1, s 2. Capacity to consent to research may also differ from that of medical care. For example, in Québec, the legis-lated age of consent to required care is 14 years of age, while for research, the minor must have attained 18 years of age – the legal age of majority. See arts 14 and 20 CCQ [Civil Code of Québec]. See also Karine Sénécal, Julie Samuël & Denise Avard, “Research and the Assent of the Child: Towards Harmonization?” in Denise Avard, Julie Samuël & Bartha M Knoppers, eds, Paediatric Research in Canada (Montréal: Les Éditions Thémis, 2009) 33.
30 A “mature minor” has been defi ned as “a child who is capable of giving consent to or refusing treatment and is able to appreciate the nature and consequences of the consent or refusal.” See Erin Nelson, Kathrina Haymond & Mona Sidarous, “Selected Legal and Ethical Issues Relevant to Pediatric Genetics” (1998) 6 Health LJ 83 at 91. See also AC v Manitoba (Director of Child and Family Services), 2009 SCC 30, [2009] 2 SCR 181 [AC cited to SCR], Abella J (“[t]he doctrine addresses the concern that young people should not automatically be deprived of the right to make decisions affecting their medical treatment. It provides instead that the right to make those decisions varies in accordance with the young person’s level of maturity, with the degree to which maturity is scrutinized intensifying in accordance with the severity of the potential conse-quences of the treatment or of its refusal” at 213).
31 AC, supra note 30 at 225.
Health Law Journal Volume 20 (2013)10
used for one or more research purposes, and where such data and material comprises stored human biological material and associated data on persons who have either (a) not yet reached the age of legal majority or otherwise acquired the ability to consent at the time of the contribution of such data or materials, or (b) not yet reached the age of majority to consent in accordance with the law respecting consent to medical treatment or research at the time of the contribution of such data or materials.
3.2 An Overview of the BiobanksTable 1 provides an overview of the three selected Canadian paediatric biobanks.
4. The Canadian Privacy FrameworkVarious international guidelines and legal instruments to which Canada is a signatory acknowledge an individual’s privacy interest.32 Privacy interests are also established at the national or regional level. For example, in the European Union, privacy is treated comprehensively and as a fundamental right;33 in the United States, privacy legislation is implemented in an ad hoc, sectoral manner.34 Canada has adopted somewhat of a middle ground.
32 See e.g. Convention on the Rights of the Child, 20 November 1989, 1577 UNTS 3, Can TS 1992 No 3 (entered into force 2 September 1990, accession by Canada 13 December 1991) (“[n]o child shall be subjected to arbitrary or unlawful inter-ference with his or her privacy” at art 16) [Convention on the Rights of the Child]; Universal Declaration of Human Rights, GA Res 217(III), UNGAOR, 3d Sess, Supp No 13, UN Doc A/810 (1948) 71 (“[n]o one shall be subjected to arbitrary inter-ference with his privacy” at art 12) [Universal Declaration]; International Covenant on Civil and Political Rights, 19 December 1966, 999 UNTS 171, arts 9-14, Can TS 1976 No 47, 6 ILM 368 (entered into force 23 March 76, accession by Canada 19 May 1976) (“[n]o one shall be subjected to arbitrary or unlawful interference with his privacy” at art 17); OECD 2013 Guidelines, supra note 13 “[i]ndividuals should have the right: ... to challenge data relating to them and, if the challenge is successful to have the data erased, rectifi ed, completed or amended” at art 13).
33 See e.g. EC, Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, [1995] OJ, L 281/31.
34 See e.g. Family Educational Rights and Privacy Act, 20 USC § 1232g; Health Insur-ance Portability and Accountability Act (HIPAA) Privacy Rule, 45 CFR Parts 160, 164
Dove, Black, Avard & Knoppers Paediatric Biobanks 11
Biob
ank
&Ye
ar in
Wh
ich St
udy
Comm
ence
d
Regio
nNa
ture
of
Biob
ank
Rese
arch
Goa
lsTy
pe of
Bi
oban
kRe
quire
ment
s for
Pa
rticip
ation
Parti
cipan
ts fo
r Da
ta/
Biolo
gical
Samp
le Co
llecti
on
Size
Biolo
gical
Samp
les
Colle
cted
Data
Co
llecte
d
Perio
d of
Dat
a/Sa
mple
Stora
ge
Venu
e of
Biob
ank
Biob
ank
A
2008
–
BC, A
lta.,
Man.,
Ont.
an
d Qc.
Prosp
ectiv
e(in
clude
s mo
ther, a
nd
fathe
r, if
possi
ble)
To de
termi
ne th
e rol
es of
a ran
ge of
en
viron
menta
l facto
rs an
d the
ir inte
ractio
ns
with
gene
tic an
d ho
st fac
tors i
n the
de
velop
ment
of ch
ildren
’s he
alth (
e.g.
deve
lopme
nt of
allerg
y an
d asth
ma in
child
ren)
Popu
lation
-ba
sed
(<30
wee
ks
into p
regna
ncy)
Pregn
ant w
omen
over
the ag
e of 1
8 (1
9 in
Vanc
ouve
r) wh
o are
less t
han 3
0 we
eks
into p
regna
ncy a
nd
plann
ing to
deliv
er at
one o
f the
partic
ipatin
g ho
spita
ls
Pregn
ancy
- 5
years
5000
fam
ilies &
15
,000
pa
rticipa
nts
Blood
Urine
Faec
es
Gene
ticPh
enoty
picHe
alth-r
elated
Lifes
tyle
Indefi
nite
Hosp
itals
and
Acad
emic
Institu
tions
Biob
ank
B
2010
–
Easte
rn On
t. an
d Qc.
Prosp
ectiv
e(in
clude
s mo
ther, a
nd
fathe
r, if
possi
ble)
To un
derst
and t
he
effec
ts of
perin
atal
even
ts (li
festyl
e, he
redity
, nutr
ition,
emplo
ymen
t, fam
ilial
status
, etc.
) on c
hild
deve
lopme
nt
Popu
lation
-ba
sed
(14
wee
ks
into p
regna
ncy)
Pregn
ant w
omen
who
are
at le
ast 1
4 we
eks
into p
regna
ncy a
nd
plan t
o deli
ver in
one
of the
partic
ipatin
g ho
spita
ls
Pregn
ancy
- 2
years
(pos
sibly
beyo
nd, if
fun
ding p
ermits
)
5700
pa
rticipa
ntsCo
rd blo
odPla
centa
Meco
nium
Blood
Urine
Tissu
es (h
air)
Gene
ticPh
enoty
picHe
alth-r
elated
Lifes
tyle
Indefi
nite
Hosp
itals
and
Acad
emic
Institu
tions
Biob
ank
C
2011
–
All pr
ovinc
es
and t
errito
ries
Prosp
ectiv
eTo
iden
tify th
e gen
es
that c
ause
the m
ost
chall
engin
g typ
es of
ca
ncer
and r
are di
seas
es
in ch
ildren
, and
to fi n
d ne
w tre
atmen
ts
Disea
se-ba
sed
(iden
tifying
ge
nes i
n rare
pa
ediat
ric
disea
ses)
Cana
dian p
atien
ts wi
th a d
isorde
r tha
t is
cong
enita
l or
deve
lops i
n chil
dhoo
d/ad
olesce
nce
Disord
er is
mono
genic
an
d gen
e is u
nkno
wnIf
cond
ition i
s eti
ologic
ally
heter
ogen
eous
, kno
wn
gene
tic ca
uses
have
be
en ex
clude
d
Birth
– ad
ultho
od(a
ll age
s)50
0 pa
tients
Blood
Saliv
aGe
netic
Phen
otypic
Indefi
nite
Hosp
ital a
nd
Acad
emic
Institu
tions
Tabl
e 1:
Cha
ract
eris
tics
of th
e se
lect
ed C
anad
ian
paed
iatri
c bi
oban
ks
Health Law Journal Volume 20 (2013)12
Omnibus laws have been enacted for the public and private/commercial sector, but other various federal, provincial and territorial statutes and regu-lations, professional codes of practice, human rights codes, guidelines, stan-dards, the common law, and constitutional law also determine the scope of information privacy.35 The subsections below briefl y discuss the constituent parts of the legislative privacy framework and the applicability of this frame-work to paediatric biobanks.
4.1 Constitutional ProtectionsRespect for privacy is a constitutional principle in Canada, but there is no explicit “right to privacy” in the Constitution of Canada. An early draft of the Canadian Charter of Rights and Freedoms36 (Canadian Charter) had expressly recognized a “right to be secure against arbitrary invasion of privacy,” similar to the United Nations’ Universal Declaration of Human Rights,37 but was left out of the fi nal version.38 In the absence of an explicit right, the development of the concept and categories of privacy interests have been driven largely by Canadian Charter cases. The generally accepted categories include personal, territorial and informational privacy.39
Two provisions in the Canadian Charter have been interpreted as protecting a person’s privacy. Section 7, which guarantees everyone “the right to life, liberty and security of the person,” has been interpreted to include the right to be free of the psychological stress resulting from unauthorized disclosure of one’s personal health information.40 Section 8, which grants the “right to
(2011); Genetic Privacy Act, NJ Stat § 10:5-43. See generally Paul M Schwartz, “Preemption and Privacy” (2009) 118 Yale LJ 902. But see Simitis, supra note 13 (“Europe more and more resembles the United States” at 2000).
35 Barbara McIsaac, Rick Shields & Kris Klein, The Law of Privacy in Canada, student ed (Scarborough, Ont: Carswell, 2011).
36 Canadian Charter of Rights and Freedoms, Part I of the Constitution Act, 1982, being Schedule B to the Canada Act 1982 (UK), 1982, c 11 [Canadian Charter].
37 Universal Declaration, supra note 32. 38 Allen M Linden & Bruce Feldthusen, Canada Tort Law, 8th ed (Markham, Ont:
LexisNexis Butterworths, 2006) at 61. 39 Bigstone v St. Pierre 2011 SKCA 34 at para 20, 231 CRR (2d) 181. See also Tessling,
supra note 3. 40 Canadian AIDS Society v Ontario (1995), 25 OR (3d) 388, 57 ACWS (3d) 121 (Ont
Gen Div); appeal dismissed, (1996), 31 OR (3d) 798, 67 ACWS (3d) 598 (Ont CA); leave to appeal to the Supreme Court of Canada denied, [1997] SCCA
Dove, Black, Avard & Knoppers Paediatric Biobanks 13
be secure against unreasonable search or seizure,” includes the protection of an individual’s informational privacy. The Supreme Court has stated that “[w]hat is protected by s. 8 is people, not places or things. The principal right protected by s. 8 is individual privacy, and the provision must be purposively applied to that end.”41 Québec’s Charter of human rights and freedoms42 (Québec Charter), which applies equally to the provincial government and private parties,43 also guarantees every person the right to “respect for his private life” (Article 5) and “non-disclosure of confi dential information” (Article 9).44
4.2 The Common LawUnlike the United States, Canada has yet to fully recognize a distinct common law right to privacy.45 There have been few cases where Canadian
No 33. See also R v O’Connor, [1995] 4 SCR 411, 103 CCC (3d) 1 (complainants in a sexual assault case had a right to a reasonable expectation of privacy in the records of those who had provided them counselling and medical advice); Ruby v Canada (Solicitor General), [2000] 3 FC 589, 187 DLR (4th) 675 (FCA), Létourneau and Robertson JJA (“there is an emerging view that an individual’s right to privacy is also enshrined in one’s liberty interest set out in section 7 ... because the protection of private life is considered to be at the heart of liberty in a democratic society” at para 165); British Columbia Government and Services Employees’ Union v British Columbia (Minister of Health Services), 2005 BCSC 446, 27 Admin LR (4th) 125, Melvin J (“[t]he importance of the right of privacy as it emerges for consideration in s. 7 and s. 8 of the Charter cannot be minimized” at para 68).
41 R v Colarusso, [1994] 1 SCR 20 at para 86, 110 DLR (4th) 297, La Forest J. See also Hunter v Southam, [1984] 2 SCR 145, 11 DLR (4th) 641; R v Dyment, [1988] 2 SCR 417, 55 DLR (4th) 503; R v Wise, [1992] 1 SCR 527, 70 CCC (3d) 193; R v Plant, [1993] 3 SCR 281, 84 CCC (3d) 203.
42 Charter of human rights and freedoms, RSQ, c C-12 [Québec Charter]. 43 The Canadian Charter and the Canadian Human Rights Act, RSC 1985, c H-6 are
also applicable in Québec. 44 See Aubry v Éditions Vice-Versa, [1998] 1SCR 591, 157 DLR (4th) 577. See also
H Patrick Glenn, “The Right to Privacy in Quebec Law” in Dale Gibson, ed, Aspects in Privacy Law: Essays in Honour of John M. Sharp (Toronto: Butterworths, 1980) 40.
45 Halsbury’s Laws of Canada – Torts (Markham: LexisNexis Canada, 2012) at s II.3(7). See also John DR Craig, “Invasion of Privacy and the Charter Values: The Common Law Tort Awakens” (1997) 42 McGill LJ 355; Lisa M Austin, “Privacy and Private Law: The Dilemma of Justifi cation” (2010) 55 McGill LJ 165.
Health Law Journal Volume 20 (2013)14
courts have recognized a common law tort action for invasion of privacy46 and there is provincial variation of the recognition.47 In 2012, the Ontario Court of Appeal recognized a tort of intrusion upon a person’s seclusion or solitude, or into his or her private affairs.48 It remains to be seen if other provinces will follow Ontario’s suit, but it is clear that there has been no coordinated, national movement as yet to establish a common law right to privacy.
4.3 Coverage of Privacy LegislationTable 2 presents an overview of the coverage of federal and provincial and territorial privacy legislation, as well as the Canadian Charter, Québec Charter, and Civil Code of Québec.
It is not possible due to space constraints to intricately analyze the contours of each privacy statute, but Table 3 lists non-exhaustively the rele-vant privacy statutes currently in force in each jurisdiction.
Table 3 only begins to illustrate the complex framework addressing privacy.49 How well does this complex framework of federal, provincial and territorial laws and regulations apply to paediatric biobanks?
46 See e.g. Roth v Roth (1991), 4 OR (3d) 740, 9 CCLT (2d) 141 (Ont Gen Div) (cause of action in invasion of privacy accepted for interference with access to
cottage and with enjoyment of property); Saccone v Orr (1981), 34 OR (2d) 317, 11 ACWS (2d) 402 (Ont Co Ct) (cause of action in invasion of privacy accepted for playing tape of private telephone conversation aloud at municipal council meeting without counsel).
47 See e.g. Parasuik v Canadian Newspapers Co (1988), 53 Man R (2d) 78, 9 ACWS (3d) 52 (MBQB), Scollin J (“[t]here is no foundation whatever for claiming that from the primeval mud of the common law in force in Manitoba there has evolved the tort of ‘false light invasion of privacy’: that concept has been fabricated in the markedly different social, constitutional and legal framework of the United States” at 30). Compare Dyne Holdings Ltd v Royal Insurance Company of Canada (1996), 138 Nfl d & PEIR 318, 135 DLR (4th) 142 (PESCAD), Carruthers CJ (“[i]t would seem to me the courts in Canada are not far from recognizing a common law right of privacy if they have not already done so. ... [and] Canadian courts do not hesi-tate to protect privacy interests under some recognized tort” at para 63). Accord MacDonnell v Halifax Herald Ltd 2009 NSSC 187, 279 NSR (2d) 217, Moir J (“[t]he plaintiff relies on what may be an emerging tort, invasion of privacy...” at para 13).
48 Jones v Tsige, 2012 ONCA 32, 108 OR (3d) 241. 49 As one example, prior to the passing of the Personal Health Information Act in
Dove, Black, Avard & Knoppers Paediatric Biobanks 15
Juris
dict
ion
Cons
titut
iona
l Re
cogn
ition
of
Priv
acy
Righ
t or
Inte
rest
Stat
utor
y To
rt
Prot
ectio
n of
“Pe
rson
al
Info
rmat
ion”
–
Publ
ic S
ecto
r
Prot
ectio
n of
“Pe
rson
al
Info
rmat
ion”
–
Priv
ate
Sect
or
Prot
ectio
n of
“P
erso
nal H
ealth
In
form
atio
n”
Can
ada
(fede
ral)
Briti
sh C
olum
bia
Alb
erta
Sask
atch
ewan
Man
itoba
Ont
ario
Qué
bec
*
Nov
a Sc
otia
New
Bru
nsw
ick
Prin
ce E
dwar
d Isl
and
New
foun
dlan
d an
d La
brad
or
Yuko
n
Nor
thw
est T
errit
orie
s
Nun
avut
Tabl
e 2:
Cov
erag
e of
fede
ral,
prov
inci
al a
nd te
rrito
rial p
rivac
y sta
tute
s.
*Th
e Q
uéb
ec C
har
ter,
su
pra
note
39, s
5 a
nd a
rts
35 a
nd 1
457 C
CQ
[C
ivil
Cod
e of
Qu
ébec
] ca
n li
kel
y be
inte
rpre
ted a
s eq
uiv
alen
t to
a s
tatu
tory
tort
.
Health Law Journal Volume 20 (2013)16
Jurisdiction Statute
Canada (federal) • Canadian Charter of Rights and Freedoms• Privacy Act• Personal Information Protection and Electronic Documents Act
British Columbia • Personal Information Protection Act• Freedom of Information and Protection of Privacy Act• Privacy Act• E-Health (Personal Health Information Access and Protection of Privacy) Act
Alberta • Personal Information Protection Act• Freedom of Information and Protection of Privacy Act• Health Information Act
Saskatchewan • Freedom of Information and Protection of Privacy Act• The Health Information Protection Act• The Local Authority Freedom of Information and Protection of Privacy Act• The Privacy Act
Manitoba • Freedom of Information and Protection of Privacy Act• The Personal Health Information Act• The Privacy Act
Ontario • Freedom of Information and Protection of Privacy Act• Personal Health Information Protection Act, 2004• Municipal Freedom of Information and Protection of Privacy Act
Québec • An Act respecting Access to documents held by public bodies and the Protection of personal information• An Act respecting the Protection of personal information in the private sector• An Act respecting health services and social services• Civil Code of Québec• Charter of human rights and freedoms
New Brunswick • Right to Information and Protection of Privacy Act• Personal Health Information Privacy and Access Act
Nova Scotia • Freedom of Information and Protection of Privacy Act• Personal Health Information Act• Municipal Government Act• Personal Information International Disclosure Protection Act
Prince Edward Island • Freedom of Information and Protection of Privacy Act
Newfoundland and Labrador
• Access to Information and Protection of Privacy Act• Personal Health Information Act• Privacy Act
Yukon • Access to Information and Protection of Privacy Act
Northwest Territories • Access to Information and Protection of Privacy Act
Nunavut • Access to Information and Protection of Privacy Act
Table 3: List of substantive privacy legislation in Canadian provinces and territories
Dove, Black, Avard & Knoppers Paediatric Biobanks 17
5. Privacy Legislation and Paediatric Biobank Applicability
5.1 A Tenuous Relationship
Our analysis of the Canadian privacy framework indicates a lack of complete and harmonized coverage, which could compromise the privacy of paediatric biobank participants. Paediatric biobanks are not necessarily inconsistent with the legislation, but much of the legislation constitutes a patchwork and variegated approach to the ever-evolving world of genomics and biobanking, and especially the issues particular to paediatric biobanking. Our fi nding is consistent with health law scholar Lorraine Sheremeta, who notes that, “there is no coherent legal framework to appropriately address the health-related privacy issues that are relevant in the context of biobanking.”50
While most privacy legislation explicitly applies to public bodies, regional health authorities, physicians, universities, or other individuals or entities, it may not cover a biobank. Much of the complexity rests on the composi-tion and governance of a biobank, a construct that challenges traditional legal principles: they are structured resources often built around the collabo-ration of distinct funders, donors, custodians and researchers (and poten-tially, one day, genomics or pharmaceutical companies and their customers). Indeed, some biobanks are public-private partnerships that receive multi-source fi nancing.51 Further, large-scale paediatric biobanks do not so much resemble discrete research projects as they do infrastructures, given their budget size, management structure and administrative support.52 It may be
2012, the Nova Scotia Department of Health reported that personal health information was governed by over 40 different pieces of legislation. See Nova Scotia, Department of Health, “Personal Health Information Legislation for
Nova Scotia: Discussion Paper” (Halifax: Department of Health, 2008) at 3, online: <www.gov.ns.ca/health/>.
50 Lorraine Sheremeta, “Population Biobanking in Canada: Ethical, Legal and Social Issues” (Paper commissioned by the Canadian Advisory Council on Biotechnology, September 2003) at 64, online:
<http://publications.gc.ca/collections/Collection/Iu44-19-2004E.pdf>. 51 Joyce Rogers et al, “Biobankonomics: A Taxonomy for Evaluating the Economic
Benefi ts of Standardized Centralized Human Biobanking for Translational Research” (2011) 42 Journal of the National Cancer Institute Monographs 32.
52 See e.g. National Children’s Study, online: <http://www.nationalchildrensstudy.gov>.
Health Law Journal Volume 20 (2013)18
that “research biobanks” are in fact complementary scientifi c infrastructures to traditional discovery science.53
There is neither legislative nor jurisprudential guidance on what deter-mines whether a biobank is a “person,” “public body,” “organization,” “institution,” or similar designation. Because a biobank has been defi ned by the Organisation for Economic Co-operation and Development (OECD) as a “structured resource”54 – a term unfamiliar to Canadian privacy legis-lation – its very composition is uncertain, especially when analyzing the geographic coverage and control of the biobank. Consequently, the water-tight, formalistic dichotomy between public sector or private sector privacy legislation fails to recognize the hybridity of many biobank structures, which often serve as resources for future, unspecifi ed research which may or may not include commercial support or use. Constitutional divisions between trade and commerce (federal jurisdiction)55 and healthcare and civil rights (provincial jurisdiction)56 also complicate the modern, mixed picture. The federal Personal Information Protection and Electronic Documents Act (PIPEDA), as a commercial activity-based statute, falls under the federal government’s trade and commerce powers.57 Additionally, it may apply to “personal health information” that crosses interprovincial borders,58 but no private or public sector privacy statute specifi cally addresses applicability to the structure of the information-holding entity in question (the biobank), rather than only some of its contents, i.e. data.59
53 Paul N Schofi eld et al, “Sustaining the Data and Bioresource Commons” (2010) 330 Science 592.
54 OECD, OECD Guidelines for Human Biobanks and Genetic Research Databases (Paris: OECD, 2009) at Annotations, para 2.
55 Constitution Act, 1867 (UK), 30 & 31 Vict, c 3, s 91(2), reprinted in RSC 1985, App II, No 5 [Constitution Act].
56 Ibid, ss 92(7), (13), (16). 57 Mahmud Jamal, “Is PIPEDA Constitutional?” (2006) 43:3 Can Bus LJ 434. 58 Personal Information Protection and Electronic Documents Act, SC 2000, c 5 s 30(2.1)
[PIPEDA]. 59 Privacy legislation generally defi nes “personal information” or “health infor-
mation” as “recorded information about an identifi able individual” or “iden-tifying information about an individual in oral or recorded form.” A contrario, information about non-identifi able individuals, e.g. anonymous or anonymized information, does not fall under the purview of the legislation. See e.g. Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A, s 4(2) (“‘identifying
Dove, Black, Avard & Knoppers Paediatric Biobanks 19
Unless a biobank’s governance framework clearly divides roles and responsibilities and creates an unambiguous management structure, and a well-documented funding apparatus, determining whether a paediatric biobank falls under public sector or private sector privacy legislation will prove challenging. This challenge has not gone unnoticed by CIHR, which in the context of PIPEDA has remarked the following:
[t]he activities of health researchers themselves will be diffi cult to categorize as either commercial or non-commercial in nature. Increasingly, academia, private sector, voluntary charitable organi-zations and government are joining forces to engage in innovative research partnerships and to transform this new knowledge into forms which are benefi cial to the population. In an era where such partnerships are actively encouraged, a whole spectrum of public-private arrangements have begun to emerge.60
information’ means information that identifi es an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual”) [Ontario PHIPA]. A plain and ordinary meaning of “information” demonstrates that biological samples are not recorded information – only information extracted from those biological samples can be interpreted as recorded information (assuming it is documented in paper or electronic format and linked to an identifi able individual). Thus, most privacy statutes will not prima facie apply to genetic material or other biological samples collected for a biobank, though given DNA can be digital-ized, a broad interpretation could apply. The current bi-modal legislative frame-work (i.e. “identifi able” information affords legal protection, “non-identifi able” information does not) affords clarity and predictability but little justifi cation. Residual privacy interests may exist even in anonymized genetic information or biospecimens, given that Canadian Charter jurisprudence views privacy as forming a part of one’s fundamental right to dignity, integrity and autonomy. See generally R v Mills, [1999] 3 SCR 668, 180 DLR (4th) 1; R v O’Connor, [1995] 4 SCR 411, 130 DLR (4th) 235; R v Plant. [1993] 3 SCR 281, 84 CCC (3d) 203. Identifi ability, especially in the genomics fi eld, exists on a continuum, and ever-evolving de- and re-identifi cation techniques will continue to challenge and undermine the bi-modal model.
60 Canadian Institutes of Health Research (CIHR), Personal Information Protection and Electronic Documents Act: Questions and Answers for Health Researchers (Ottawa: Public Works and Government Services Canada, 2001) at 8.
Health Law Journal Volume 20 (2013)20
This limitation is demonstrated in privacy statutes that apply only to “commercial activity,” “federal government institutions” or “the legisla-ture and government of each province.” For example, it is unclear whether PIPEDA, as a commercial activity-based statute, applies to a paediatric biobank stored in a hospital or university since the paramount purpose is research-related and is not commercial in character.61 Yet, the requirement by many federal funding agencies (e.g. Genome Canada62) to have matching funds from the private sector (or non-government organizations or provin-cial governments) could implicate PIPEDA. Indeed, researchers who request genetic data or biological samples from a biobank as part of a commercially funded study may, in fact, be directly or indirectly participating in a commer-cial activity.
The recent slate of health information privacy legislation appears more applicable, as it applies to “health information custodians,”63 who are individ-uals or organizations having custody or control of personal health informa-tion. This would likely apply to researchers or managers who exercise some control over a biobank participant’s personal health information, though it is not always the case that biobanks contain “personal health information” (for example, the collection and use of anonymized or anonymous samples and data would not constitute health information). There is wide variation, however, regarding the interaction of health information privacy legislation with federal and provincial public and private sector privacy legislation.64
61 Unlike s 2 of PIPEDA, supra note 58, which states that the statute will apply to “any particular transaction, act or conduct...that is of a commercial character” [emphasis added], Industry Canada has indicated that PIPEDA will only apply if the commercial transaction, act or conduct is part of the “core activities” of an entity. See “PIPEDA Awareness Raising Tools (PARTs) Initiative for the Health Sector”, online: Industry Canada <http://www.ic.gc.ca/>.
62 “Co-Funding”, online: Genome Canada <http://www.genomecanada.ca/>. 63 In Saskatchewan and Manitoba, the health information privacy legislation
governs entities designated “trustees”; in British Columbia, it governs an “administrator” of a “health information bank”; in Alberta, Newfoundland and Labrador, Nova Scotia, and New Brunswick, it governs a “custodian”; and in Ontario, it governs “health information custodians.”
64 McIsaac, Shields & Klein, supra note 35 (“[f]or example, while British Colum-bia’s Freedom of Information and Protection of Privacy Act binds hospitals, Ontario’s statute of the same name does not” at 6-30).
Dove, Black, Avard & Knoppers Paediatric Biobanks 21
In Ontario, it is voluntary for biobanks to register as “prescribed persons” under the province’s Personal Health Information Protection Act, 2004 (Ontario’s PHIPA) in order to receive personal health information from health infor-mation custodians. The Ontario Institute for Cancer Research’s Ontario Tumour Bank (OTB) is a “prescribed person” under paragraph 39(1)(c) of Ontario’s PHIPA.65 As a result, the OTB is entitled to collect, use and disclose personal health information without consent strictly “for the purposes of facilitating or improving the provision of health care, or that relates to the storage or donation of body parts or bodily substances.”66 The “prescribed person” status makes it easier for the OTB to enrich its database with valu-able follow-up information such as patient treatment and vital statistics by linking into other data holdings, such as those held at Cancer Care Ontario.67 To maintain the “prescribed person” status, the OTB is required to have policies that describe how it collects, retains and protects personal health information and anonymized data, as well as circumstances under which personal health information and anonymized data may be disclosed and to whom. Participants in the OTB fully consent to the provision of samples and are informed of their status as an individual within Ontario’s PHIPA and as to the intended use(s) of the data.
In sum, while health information privacy legislation applies to some biobanks, voluntary self-regulation, uncertainty and variant coverage colour the overall Canadian privacy framework. There remains no relevant case law in Canada to help map the contours. Public bodies have called on legis-latures to amend current laws to specifi cally address biobanks and infra-structure science.68 For example, the Fonds de recherche du Québec – Santé
65 Ontario PHIPA, supra note 59, s 39(1)(c); O Reg 329/04, s 13(1). 66 Halyna Perun, Michael Orr & Fannie Dimitriadis, Guide to the Ontario Personal
Health Information Protection Act (Toronto: Irwin Law, 2005) at 362. 67 Interview of Monique Albert, Manager, Ontario Tumour Bank, by Edward S
Dove (5 May 2011). 68 Infrastructure science embodies the emerging “fi rst experiment-then-hypoth-
esize” framework that stands in contrast to discovery science, which embodies the traditional “fi rst hypothesize-then-experiment” framework. Biobanks represent a new dual reconfi guration of 21st century science whereby infra-structure science and individual discovery science now co-exist. See generally Edward S Dove, Vural Özdemir & Yann Joly, “Harnessing Omics Sciences, Popu-lation Databases, and Open Innovation Models for Theranostics-guided Drug Discovery and Development” (2012) 73 Drug Development Research 439.
Health Law Journal Volume 20 (2013)22
has recommended that “laws making provision for personal information protection be adapted to the emerging trends in health research so that such laws recognize the legal validity of data banks and biobanks and of research exploring themes rather than specifi c hypotheses.”69
5.2 Exploring the Case StudiesThis section explores the privacy landscape in the selected paediatric biobanks by focusing on the three issues that particularly highlight the tension between the scientifi c promises of research and the legal obligations to protect a child’s privacy: (1) the access, use and transfer of the child’s data and samples; (2) the risks of unauthorized access by third parties; and (3) the nature of the shared relationship between the child, the parents and the researcher.70 This section also discusses how the biobank policies differ quite dramatically with respect to the coverage of these three issues, causing concern about the level of privacy protection afforded to children in the absence of comprehensive and clear legislation.
1) Access, Use and Transfer of the Child’s Data and SamplesWhile informed consent is recognized as a legal and ethical obligation of primary importance to protect and respect privacy and the person, its effect is detrimentally impacted by legislative gaps in protecting access, use and transfer of data and samples. A core obligation of most privacy legislation is that individuals or organizations can access or use personal information only for purposes that a reasonable person would consider appropriate in the circumstances,71 or for the primary purpose for which it was collected or for directly related secondary purposes.72 Many statutes also combine “fair information principles”73 (i.e. internationally accepted principles regarding the collection, use and disclosure of personal information) with research
69 Fonds de la recherche en santé du Québec, Final Report Advisory Group on a Governance Framework for Data Banks and Biobanks Used for Health Research (Québec: Fonds de la recherche en santé du Québec, 2006) at 14.
70 There are also multiple socio-ethical issues to explore, but space constraints limit our discussion to legal issues. See generally Best Practices; Dove et al, “Emerging Issues”, supra note 20.
71 PIPEDA, supra note 58, s 5(3). 72 Privacy Act, RSC 1985, c P-21, s 8(2)(a). 73 Fair information principles, also known as fair information practices, gener-
ally revolve around eight core principles, as espoused in OECD, Guidelines
Dove, Black, Avard & Knoppers Paediatric Biobanks 23
ethics norms to govern the access to personal health information for research purposes. Depending on the source, these accepted principles may not include an independent consent principle, which is why some statutes (e.g. the federal Privacy Act) generally allow the collection of personal information without consent, whereas others (e.g. PIPEDA) mandate consent unless there is an explicit exception.74 Those statutes that do not operate on this combined fair information principles/research ethics model nonetheless contain excep-tions to consent for research purposes. Those provinces with personal health information protection legislation also have particular rules governing disclo-sure of personal health information without the individual’s consent.75 None of the privacy statutes address the issue of consent in biobanks as a broad, ongoing process rather than a discrete, one-off transaction.76
on the Protection of Privacy and Transborder Flows of Personal Data (Paris: OECD, 1980): 1) collection limitation; 2) data quality; 3) purpose specifi cation;
4) use limitation; 5) security safeguards; 6) openness; 7) individual participa-tion; and 8) accountability. The fair information principles included in Schedule 1 of PIPEDA, supra note 58, which are enunciated in the Canadian Standards Association Model Code for the Protection of Personal Information, are some-what broader: 1) accountability; 2) identifying purposes; 3) consent; 4) limited collection; 5) limiting use, disclosure and retention; 6) accuracy; 7) safeguards; 8) openness; 9) individual access; and 10) challenging compliance. The United States’ Code of Fair Information Principles (Washington, DC: US Department of Health, Education and Welfare, 1973) fi rst elaborated some of these principles out of concerns related to computerization.
74 See generally Trudo Lemmens & Lisa M Austin, “The End of Individual Control Over Health Information: Governing Biobanks and Promoting Fair Information Practices” in Jane Kaye & Mark Stranger, eds, Principles and Practice in Biobank Governance (Farnham: Ashgate, 2009) 243.
75 See e.g. E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c 38, ss 14-15 [BC E-Health Act]; Health Information Act, RSA 2000, c H-5, ss 49-54 [Alberta HIA]; Ontario PHIPA, supra note 59, s 44.
76 Timothy Caulfi eld, “Biobanks and Blanket Consent: The Proper Place of the Public Good and Public Perception Rationales” (2007) 18:2 King’s Law Journal 209; Timothy Caulfi eld & Bartha M Knoppers, Consent, Privacy & Research Biobanks: Policy Brief No. 1 (Ottawa: Genome Canada, 2010); Søren Holm, “Informed Consent and the Bio-banking of Material from Children” (2005) 1:1 Genomics, Society and Policy 16; Aaron J Goldenberg et al, “Pediatric Biobanks: Approaching Informed Consent for Continuing Research After Children Grow Up” (2009) 155:4 The Journal of Pediatrics 578.
Health Law Journal Volume 20 (2013)24
Moreover, unlike (arguably) in Europe, there is no clear privacy law coverage applicable to access, use or transfer of biological materials.77 This means that while privacy statutes prohibit persons from using or transfer-ring information derived from or related to an identifi able biological sample without the individual’s consent (subject to limited exceptions),78 there may not be an explicit prohibition to the access, use or transfer of the identifi able biological sample itself. The access, use and transfer dimension is further
77 S and Harper v the United Kingdom, No 30562/04 [2008] ECHR 1581, 48 EHRR 50 (retention per se of DNA samples are suffi cient as having the potential to inter-fere with the right to private life of an individual). See also Matteo Macilotti, “Reshaping Informed Consent in the Biobanking Context” (2012) 19:3 Eur J Health L 271 (“[t]he right of the protection of personal data invests in the person a continuing power of control over the tissue, even after the transfer of the tissue to a biobank” at 281-282); EC, Directorate-General for Research and Innovation, Biobanks for Europe: A Challenge for Governance. Report of the Expert Group on Dealing with Ethical and Regulatory Challenges of International Biobank Research (Luxembourg: EC, 2012) (“[t]he principles applying to the retention and circulation of biological samples should not differ signifi cantly from personal data protection principles even if the legal framework devised for personal data were not found to be directly applicable” at 38).
78 See e.g. Ontario PHIPA, supra note 59, s 4(1)(e) (“[i]n this Act, ‘personal health information’ ... means identifying information about an individual in oral or recorded form, if the information ... relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance...”). Similar defi nitions are found in Alberta HIA, supra note 75, s 1(1)(i)(iii); The Health Information Protection Act, SS 1999, c H-0.021, s 2(m)(iii) [Saskatchewan HIPA]; Personal Health Information Act, SNL 2008, c P-7.01, s 5(1)(c) [Newfoundland and Labrador PHIA]; Personal Health Information Privacy and Access Act, SNB 2009, c P-7.05, s 1(e) in defi nition of “personal health information” [New Brunswick PHIPAA]. It is intriguing that the word “donation” is used in this context as it can imply that an individual has given away a body part or bodily substance qua gift and expects nothing owed in return. Yet, by virtue of the legislation, an ongoing legal obligation is created between the health information custodian and the individual. This suggests that the individual may not be “donating” as much as “contributing” a body part or bodily substance. The BC E-Health Act, supra note 75 and The Personal Health Information Act CCSM c P33.5 [Manitoba PHIA] do not contain a similar provision.
Dove, Black, Avard & Knoppers Paediatric Biobanks 25
compounded by the continuing legal uncertainty regarding property rights and ownership of biological materials held in a biobank.79
Not only does this issue challenge the traditional legal distinction between “information” and “biological samples,” it also has a profound impact on the scope of informed consent. A biobank may face regulatory, contractual, or other consequences for disclosing or transferring the samples without prop-erly informed consent, but under privacy legislation the access to, use and transfer of materials is not covered (although human tissue-related legisla-tion can require consent for the taking of tissue80), thereby limiting the effec-tiveness of consent provisions. Similarly, privacy legislation generally allows an individual to access their own information, but the legislation does not explicitly permit individuals to access their biological materials containing information. It may be argued that individuals do not need access because they can provide another sample. However, the amount of biological mate-rials stored is limited and certain types of materials, such as cancer tumour tissue, may be special, rare and diffi cult or painful to extract.81 Cell lines can be made, but this is expensive. The paediatric context exacerbates the problem since a child may wish to have access to their (identifi able) biolog-ical materials when they reach maturity for purposes of medical testing, diagnosis or treatment.
79 Jasper A Bovenberg, Property Rights in Blood, Genes & Data: Naturally Yours? (Leiden, Neth: Martinus Nijhoff Publishers, 2006); Radhika Rao, “Genes and Spleens: Property, Contract, or Privacy Rights in the Human Body?” (2007) 35:3 JL Med & Ethics 371; Muireann Quigley, “Property: the Future of Human Tissue?” (2009) 17:3 Med L Rev 457; Lars Øystein Ursin, “Privacy and Property in the Biobank Context” (2010) 22:3 HEC Forum 211.
80 See e.g. Human Tissue and Organ Donation Act, SA 2006, c H-14.5. Human tissue donation acts generally do not apply to tissues that are replaceable by natural process of repair, such as blood, hair and skin. Most biological samples provided to biobanks are self-replicating. Ontario’s Trillium Gift of Life Network Act, RSO 1990, c H-20 applies to skin but not blood, yet its scope for living persons is limited to transplantation.
81 Eric Vermeulen et al, “Connective Tissue: Cancer Patients’ Attitudes towards Medical Research Using Excised (Tumour) Tissue” (2011) 6 BioSocieties 466.
Health Law Journal Volume 20 (2013)26
Biobank PracticesIn summary, the three paediatric biobanks analyzed have varying prac-
tices with respect to access, use and transfer of a child’s samples and data. Biobank C82 and Biobank B83 provide disclosure in their consent forms about the processes involved in access, use and transfer, including obligatory REB approval and a data/material transfer agreement, while Biobank A’s consent forms provide little information about the issue.84 None of the biobanks employ the “honest broker” model, seen by some as a best practice, where
82 The Biobank C consent forms state that, following institution-specifi c REB approval, all data and samples will be shared with Canadian investigators who are members of the Canadian Pediatric Genetic Disorders Sequencing Consor-tium (CPGDS). Before such sharing, however, the data and samples will be coded. Researchers outside of Canada may access the coded data (in a controlled access database) and samples following the approval of the CPGDS scientifi c committee and relevant REBs. General research results and anonymized data (i.e. data that cannot be linked back to the patient or the patient’s child) will be available to all researchers in an open access database. See Biobank C, “Children/Minors: Information and Consent Form” at 2; Biobank C, “Affected/Unaffected/Incompetent Adults: Information and Consent Form” at 2 [unpublished, on fi le with authors] [Biobank C consent forms].
83 Researchers who wish to obtain access to data or biological materials from Biobank B must obtain their institutional REB and Board of Principal Investiga-tors authorizations. Even if such authorizations are given, further conditions may be imposed, including an obligation to obtain specifi c consent for a project (from an adult for him- or herself or in a child’s stead) or the assent of a child, or the anonymization of the data or biological material before they are sent to an investigator (rather than sending them encoded). Additionally, Biobank B specifi es that a Data/Biomaterial Transfer Agreement is also required, which obligates the researchers to, inter alia, not transmit data or biological material to unauthorized recipients, respect the participants’ confi dentiality and not attempt to re-identify participants, and destroy all the data obtained at the end of the research and destroy or return to the biobank any biological material that remains unused. See Biobank B, “Databank and Bank of Biological Material Management Policy”, at 20-21 [unpublished, on fi le with authors].
84 The Biobank A policies and consent forms provide no information about use by external researchers. The consent forms state only that, “[r]esearchers involved in the study might be interested in follow-up after the fi ve year time period, and participants may be asked in the future about their interest in participating in further studies.” See Biobank A, Study Information and Consent Form [unpub-lished, on fi le with authors].
Dove, Black, Avard & Knoppers Paediatric Biobanks 27
an individual or entity serves as a trusted intermediary to provide de-identi-fi ed biospecimens and/or data to approved researchers.85
Table 4 illustrates the biobank practices relating to access, use and transfer.
2) Risks of Unauthorized Access by Third PartiesUnauthorized access to personal health information, including genetic information, is a traditional concern of research. Biobanks collect a substan-tial amount of information on children that might be stored and used for prolonged periods – or indefi nitely. Access to data and samples by third parties such as the government, law enforcement agencies, employers, insurers and educational institutions raises particular privacy concerns since the informa-tion could be incorporated in a decision affecting a child’s future employ-ment, insurance coverage and education. The increasing use of banked biological materials and data augments the prospect of a breach of privacy by virtue of its wide availability and distribution. The special circumstance of children – generally non-consenting participants in research – requires additional consideration.
Canada’s privacy statutes generally prohibit disclosure of personal infor-mation to third parties, subject to mandatory reporting requirements, unless the person concerned consents to such disclosure or if the information has been de-identifi ed (i.e. coded).86 But there are several shortcomings. The statutes focus entirely on the (identifi able) individual; they do not address the broader community and social implications of unauthorized access or disclosure of medical information that can comprise information beyond the privacy of the individual.87 Also, it is unclear what happens in the context of
85 Jim Vaught & Nicole C Lockhart, “The Evolution of Biobanking Best Practices” (2012) 413 Clinica Chimica Acta 1569.
86 See e.g. New Brunswick PHIPAA, supra note 78, s 36 (“[a] custodian may disclose personal health information that has been de-identifi ed for any purpose”). The standard or nature of de-identifi cation referenced in Canadian privacy statutes may not align with the standards imposed in the US federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, 45 CFR § 164.514(b)(2) (2011) (allowing covered entities to use and disclose data without obtaining authorization via the “safe harbor” de-identifi cation method, which requires the removal of all of the identifi ers enumerated in the section).
87 Joan L McGregor, “Population Genomics and Research Ethics with Socially Identifi able Groups” (2007) 35:3 JL Med & Ethics 356; Katherine Drabiak-Syed,
Health Law Journal Volume 20 (2013)28
Biob
ank
Acc
ess
or u
se b
y ch
ild a
nd/o
r pa
rent
s to
dat
a an
d sa
mpl
esTr
ansf
er o
f dat
a an
d sa
mpl
es/s
econ
dary
use
Leng
th o
f sto
rage
of d
ata
and
sam
ples
Biob
ank
A•
No
disc
ussi
on o
f pos
sibi
lity
to
acce
ss o
r use
dat
a an
d
sam
ples
by
eith
er p
aren
t or
ch
ild, b
ut if
par
ent d
ecid
es to
w
ithdr
aw fr
om s
tudy
, par
ent
w
ill n
ot b
e in
clud
ed in
follo
w-u
p da
ta c
olle
ctio
ns a
nd
stu
dy w
ill o
nly
use
data
pare
nt/c
hild
pro
vide
d du
ring
stu
dy p
artic
ipat
ion
• C
onse
nt fo
rm m
entio
ns th
at re
sear
cher
s in
volv
ed in
study
may
be
inte
reste
d in
long
er te
rm fo
llow
-up
afte
r
the
fi ve-
year
tim
e pe
riod,
and
par
ent m
ay b
e as
ked
ab
out i
nter
est i
n pa
rtici
patin
g in
add
ition
al s
tudi
es in
the
futu
re•
Dat
a or
sam
ple-
requ
estin
g in
divi
dual
or g
roup
of
in
vesti
gato
rs m
ust s
ubm
it a
lette
r of r
eque
st to
the
D
irect
or a
t the
Nat
iona
l Coo
rdin
atin
g C
entre
,
statin
g: 1
) pur
pose
of t
he re
ques
t; 2)
dat
a w
hich
are
requ
este
d as
pre
cise
ly a
s po
ssib
le; 3
) pop
ulat
ion
for
w
hom
dat
a ar
e re
ques
ted;
4) u
se w
hich
will
be
m
ade
of th
e da
ta in
clud
ing
statis
tical
app
roac
h to
anal
ysis
whe
re a
ppro
pria
te; 5
) how
the
data
sho
uld
be
bes
t for
mat
ted;
and
6) w
hen
the
data
are
requ
ired
• Sa
mpl
es w
ill u
sual
ly b
e
proc
esse
d in
a lo
cal l
abor
ator
y
for l
ong-
term
sto
rage
in a
cent
raliz
ed li
quid
nitr
ogen
faci
lity,
pen
ding
det
erm
inat
ion
of
bes
t met
hods
and
faci
litie
s fo
r
anal
ysis
, and
acq
uirin
g
nece
ssar
y fu
ndin
g•
Proc
ess
is o
vers
een
by a
Biol
ogic
al S
ampl
es C
omm
ittee
• D
ata
will
be
used
for s
tudy
only
and
will
be
kept
as
long
as re
quire
d, th
en d
estro
yed
as
requ
ired
by lo
cal s
tudy
cen
tre
po
licie
s
Biob
ank
B•
No
disc
ussi
on o
f pos
sibi
lity
to
ac
cess
or u
se d
ata
and
sa
mpl
es b
y ei
ther
par
ent o
r
child
, but
par
ent m
ay re
ques
t
that
all
data
and
sam
ples
prov
ided
be
destr
oyed
• Bi
oban
k w
ill b
e re
sour
ce fo
r var
ious
rese
arch
ers
co
nduc
ting
rese
arch
on
the
cour
se o
f pre
gnan
cy
an
d th
e im
pact
s of
mot
her’s
and
fath
er’s
heal
th o
n
the
child
’s he
alth
and
dev
elop
men
t•
Aut
horiz
atio
n re
quire
d•
Poss
ibili
ty o
f obl
igat
ion
of s
eeki
ng c
hild
’s as
sent
• D
ata
or b
iolo
gica
l mat
eria
l sen
t to
rese
arch
ers
are
id
entifi
ed
with
a c
ode
• D
ata/
Biom
ater
ial T
rans
fer A
gree
men
t also
requ
ired
• In
defi n
ite, u
nles
s pa
rent
requ
ests
de
struc
tion
Biob
ank
C•
No
disc
ussi
on o
f pos
sibi
lity
to
ac
cess
or u
se d
ata
and
sam
ples
by e
ither
par
ent o
r chi
ld, b
ut if
ther
e is
with
draw
al fr
om th
e
study
com
plet
ely,
sam
ples
and
data
will
be
destr
oyed
whe
re
po
ssib
le (a
lread
y pu
blis
hed
data
and
alre
ady
used
sam
ples
can
not
be
des
troye
d)
• A
ll co
ded
data
and
sam
ples
are
sha
red
with
Can
adia
n in
vesti
gato
rs w
ho a
re m
embe
rs o
f the
Can
adia
n Pe
diat
ric G
enet
ic D
isor
ders
Seq
uenc
ing
C
onso
rtium
• C
oded
dat
a an
d sa
mpl
es w
ill b
e sh
ared
ext
erna
lly
fo
r res
earc
h re
late
d to
the
study
of r
are
gene
tic
di
sord
ers,
follo
win
g ap
prov
al fr
om th
e C
onso
rtium
scie
ntifi
c co
mm
ittee
and
the
rele
vant
REB
• In
defi n
ite (d
ata)
• D
NA
sam
ples
and
any
cel
l lin
es
w
ill b
e ke
pt u
ntil
the
gene
for t
he
ra
re g
enet
ic d
isea
se in
pat
ient
’s
fam
ily h
as b
een
iden
tifi e
d
and
the
mec
hani
sms
lead
ing
to
the
heal
th is
sues
rela
ted
to th
e
diso
rder
are
und
ersto
od
Tabl
e 4:
Bio
bank
pra
ctic
es re
latin
g to
acc
ess,
use
and
tran
sfer
of t
he c
hild
’s da
ta a
nd s
ampl
es.
Dove, Black, Avard & Knoppers Paediatric Biobanks 29
paediatric biobanks where consent is provided by the parents and where the competent child may oppose disclosure. Given the tenuous applicability of privacy legislation to biobanks, its applicability to biobank policies regarding unauthorized access is also unclear, especially in light of consent and the opinions of the parents and child.88 Many paediatric biobanks rely on private ordering via access or transfer agreements to determine the scope of third party access and sanctions for violations. Whether this operates under the backdrop of privacy legislation – wherein consent of the parent or the competent child is required to permit disclosure – or in spite of it, following rules developed through ethical norms, remains unknown.
Protection against unauthorized third party access to personal infor-mation held in biobanks should be coupled with meaningful penalties for privacy violations, though it is worth noting that to date, there is no evidence of an individual having been harmed by unauthorized use or disclosure of a genome research dataset.89 Some foreign jurisdictions contain specifi c and strict penalties for genetic privacy violations.90 While the absence of such specifi c legislation in Canada is not problematic in and of itself, the absence of meaningful, enforceable penalties for privacy violations may be. Genotypic and phenotypic data or material contained in biobanks may not be “exceptional,” but concerns associated with them (especially with rare genetic conditions associated with highly penetrant genes) are often ampli-fi ed in comparison to other health information. For example, obtaining a
“Lessons from Havasupai Tribe v. Arizona State University Board of Regents: Recognizing Group, Cultural, and Dignitary Harms as Legitimate Risks Warranting Integration into Research Practice” (2010) 6 Journal of Health & Biomedical Law 175; Stephanie M Fullerton & Sandra S-J Lee, “Secondary Uses and the Governance of De-Identifi ed Data: Lessons from the Human Genome Diversity Panel” (2011) 12 BMC Medical Ethics 16 (fi nding that potential risks to communities cannot be wholly eliminated by anonymization of individual data).
88 Compare International Declaration on Human Genetic Data, UNESCOR, 32nd Sess, UN Doc SHS/BIO/04/1 (2003) art 14 (generally forbidding biological samples linked to an identifi able person from being disclosed to third parties).
89 Pilar N Ossorio, “Bodies of Data: Genomic Data and Bioscience Data Sharing” (2011) 78:3 Social Research: An International Quarterly 907.
90 See e.g. NJ Stat § 10:5-49 (2012); Genetic Information Nondiscrimination Act of 2008, Pub L 110-233, 122 Stat 881; The Genetic Integrity Act, (Swed), SFS 2006:351, ch 8.
Health Law Journal Volume 20 (2013)30
child’s genetic material without properly informed parental consent and (ideally) child assent violates basic human dignity and autonomy and also breaches the child’s privacy. Non-consensual disclosure of information related to the biological material can affect a plethora of areas, including the child’s (future) health, kinship, parentage, relationships and employment.
Provincial health information legislation contains penalty provisions, but they are narrowly drafted. Ontario’s PHIPA, for instance, requires an individual seeking damages to prove “actual harm” for a breach of privacy, but only after the information and privacy commissioner has made an order, or a person has been convicted of an offence under the legislation that has become fi nal as the result of there being no further right of appeal.91 Further, damages for mental anguish are capped at $10,000 and applicable only if the violation was wilful or reckless.92 A person may be fi ned for collecting, using or disclosing personal health information in contravention of the statute or its regulations, but only if it is “wilful,”93 thus imposing a higher evidentiary burden.
In sum, the lack of strict, meaningful and obtainable penalties for privacy violations concerning personal health information and biological materials in the context of paediatric biobanks fails to address the potentially unique and detrimental harms that arise from non-consensual third party collec-tion, use, and disclosure of such information or material.
Biobank PracticesIn summary, the paediatric biobank policies and consent forms generally
disclose obligations and measures taken to safely store and secure partici-pants’ data and samples from unauthorized access, but once again there is noticeable variation in the amount and type of disclosure, refl ecting variable practices in the absence of prescriptive legislation or regulations. Biobank C’s consent forms, for example, state that “[i]nformation will not be disclosed to insurance companies or employers”94 and that “no information that discloses your/your child’s identity will be shared or published without your specifi c consent to the disclosure.”95 It does disclose risks regarding unauthorized
91 Ontario PHIPA, supra note 59, ss 65(1)-(2). 92 Ibid, s 65(3). 93 Ibid, s 72(1)(a). 94 Biobank C consent forms, supra note 82 at 2. 95 Ibid.
Dove, Black, Avard & Knoppers Paediatric Biobanks 31
third party access, however. Biobank A’s consent forms mention that in rare instances it will not be possible to ensure confi dentiality because of manda-tory reporting laws, while Biobank B’s consent form does not – but the latter form does state that there is a risk of disclosure of results to third parties, which may compromise or decrease the parent, child or family’s chance of insurability.
Table 5 illustrates the biobank practices relating to unauthorized third party access.
3) The Nature of the Shared Relationship between the Child, Parents and ResearcherBecause most children lack full maturity and competency, they have not been treated ethically and legally as having the capacity to consent to their own participation in health research.96 Consequently, authorization for chil-dren’s participation in research generally must come from the parent(s). Such an arrangement complicates the privacy of children as they are no longer the only person aside from the researcher involved in decision-making and with access to sensitive information related to or derived from research.97 Relevant dimensions include information that may be disclosed only to the parents, information that may be disclosed only to the child when he or she is mature, and the possibility that a competent child can request some information to remain private.98 The interaction between a child’s privacy
96 See e.g. TCPS, supra note 20, art 3.3; art 21 CCQ. See also PIPEDA, supra note 58, Principle 4.3 of Schedule 1; Ontario PHIPA, supra note 59, s 23(1). See also Hens et al, “Principles”, supra note 27.
97 Kristien Hens et al, “Children, Biobanks and the Scope of Parental Consent” (2011) 19 European Journal of Human Genetics 735 [Hens et al, “Scope of Parental Consent”].
98 Helen L Gilbert, “Minors’ Constitutional Right to Informational Privacy” (2007) 74 U Chicago L Rev 1375. See also Mireille Lacroix et al, “Should Physicians Warn Patients’ Relatives of Genetic Risks?” (2008) 178:5 Can Med Assoc J 593; Benjamin S Wilfond & Katherine J Carpenter, “Incidental Findings in Pediatric Research” (2008) 36:2 JL Med & Ethics 332; Denise Avard et al, “Pediatric Research and the Return of Individual Research Results” (2011) 39:4 JL Med & Ethics 593; Bartha M Knoppers, “Paediatric Research and the Communication of Not-So Incidental Findings” (2012) 17:4 Paediatrics & Child Health 190; Ruqayyah Abdul-Karim et al, “Disclosure of Incidental Findings From Next-Generation Sequencing in Pedi-atric Genomic Research” (2013) 131:3 Pediatrics 564.
Health Law Journal Volume 20 (2013)32Bi
oban
kH
andl
ing
of p
rivac
y an
d co
nfi d
entia
lity/
prot
ectio
n ag
ains
t un
auth
oriz
ed a
cces
s by
third
par
ties
Pote
ntia
l ris
ks
rega
rdin
g un
auth
oriz
ed
third
par
ty a
cces
s
Ass
ent o
r co
nsen
t of t
he c
hild
rega
rdin
g ac
cess
by
third
par
ties
to
data
/sam
ples
Biob
ank
A•
Pers
onal
dat
a, in
clud
ing
nam
e of
eac
h pa
rtici
pant
, is
avai
labl
e
only
to th
e re
spec
tive
loca
l stu
dy c
entre
coo
rdin
ator
s an
d co
-PI
at
eac
h si
te, f
or p
urpo
ses
of c
onta
ctin
g fa
mili
es, a
nd e
nsur
ing
ap
prop
riate
follo
w-u
p. A
ll ot
her a
cces
s to
indi
vidu
al d
ata
is
ba
sed
on ID
num
bers
and
not
nam
es•
Mul
tiple
leve
ls of
acc
ess
to th
e bi
oban
k’s
data
(fro
m fu
ll ac
cess
by e
.g. D
ata
Man
ager
to e
xtre
mel
y lim
ited
acce
ss b
y e.
g. d
ata
en
try p
erso
nnel
)•
Cop
ies
of a
ll da
ta s
ets
are
held
at s
ecur
e si
tes
by th
e bi
oban
k,
w
ith b
acku
p at
alte
rnat
e se
cure
site
s•
Rese
arch
reco
rds
and
med
ical
reco
rds
may
be
insp
ecte
d in
the
pr
esen
ce o
f the
inve
stiga
tor o
r his
/her
del
egat
e by
repr
esen
-
tativ
es o
f Hea
lth C
anad
a an
d th
e ho
spita
l’s R
EB fo
r aud
iting
purp
oses
• C
onse
nt fo
rm m
entio
ns
th
at in
rare
insta
nces
it w
ill n
ot b
e po
ssib
le
to
ens
ure
confi
den
t-
ialit
y be
caus
e of
man
dato
ry re
porti
ng
la
ws
• N
o di
scus
sion
of p
ossi
bilit
y fo
r
child
’s as
sent
Biob
ank
B•
Nam
e of
par
ticip
ants
are
code
d; li
nkin
g ke
y is
pla
ced
unde
r the
resp
onsi
bilit
y of
the
proj
ect’s
prin
cipa
l res
earc
hers
• Re
sear
ch re
cord
s an
d m
edic
al re
cord
s m
ay b
e in
spec
ted
in th
e
pres
ence
of t
he in
vesti
gato
r or h
is/h
er d
eleg
ate
by
re
pres
enta
tives
of C
IHR
and
the
hosp
ital’s
REB
for a
uditi
ng
pu
rpos
es
• C
onse
nt fo
rm m
entio
ns
th
at th
ere
is a
risk
of
di
sclo
sure
of r
esul
ts to
third
par
ties,
whi
ch
m
ay c
ompr
omis
e or
decr
ease
the
pare
nt,
ch
ild o
r fam
ily’s
ch
ance
of i
nsur
abili
ty
(li
fe, h
ealth
, inv
alid
ity,
et
c.)
• Bi
oban
k B
Dat
aban
k an
d Ba
nk
of
Bio
logi
cal M
ater
ial M
anag
e-
men
t Pol
icy
addr
esse
s po
ssib
ility
of o
btai
ning
ass
ent o
f chi
ldre
n
“whe
n th
ey a
re o
ld e
noug
h to
unde
rsta
nd”
and
cons
ent w
hen
th
ey b
ecom
e ad
ults
• Po
licy
state
s th
at n
eed
for a
ssen
t
is b
ased
on
mat
urity
and
inte
llige
nce
of th
e ch
ild
Biob
ank
C•
All
data
and
sam
ples
will
be
kept
sec
urel
y at
the
rese
arch
faci
lity
• A
ny re
cord
that
iden
tifi e
s pa
tient
by
nam
e or
initi
als
not a
llow
ed
to
leav
e in
vesti
gato
r’s o
ffi ce
s•
Dat
a an
d sa
mpl
es th
at w
ill b
e sh
ared
with
oth
er re
sear
cher
s
will
fi rs
t be
code
d (c
oded
dat
a w
ill a
lso b
e sto
red
in a
con
trolle
d
acce
ss d
atab
ase)
• Re
sear
ch re
cord
s an
d m
edic
al re
cord
s m
ay b
e in
spec
ted
in th
e
pres
ence
of t
he in
vesti
gato
r or h
is/h
er d
eleg
ate
by
re
pres
enta
tives
of H
ealth
Can
ada
and
the
hosp
ital’s
REB
for
au
ditin
g pu
rpos
es
• N
o ris
k re
gard
ing
un
auth
oriz
ed th
ird
pa
rty a
cces
s di
scus
sed
• C
hild
ren
aged
14-
18 s
peci
fi cal
ly
as
ked
to p
rovi
de a
ssen
t (or
con
-
sent
whe
n fo
rese
en u
nder
legi
slatio
n) to
par
ticip
ate
• C
hild
ren
unde
r age
14
mus
t
have
stu
dy e
xpla
ined
to th
em a
t a
le
vel t
hat i
s ap
prop
riate
and
if
th
ey c
an u
nder
stand
, the
y m
ust
pr
ovid
e as
sent
to p
artic
ipat
e
Tabl
e 5:
Bio
bank
pra
ctic
es re
latin
g to
una
utho
rized
third
par
ty a
cces
s
Dove, Black, Avard & Knoppers Paediatric Biobanks 33
interests and the authority legally and ethically granted to parents creates unique risks given that the need for privacy increases as a child matures, and a competent child’s perspective on what is private may vary considerably from an adult’s perspective.99
The legally binding 1989 UN Convention on the Rights of the Child enshrines a child’s right to express a view “in all matters affecting the child” and for “due weight to be taken” of these views.100 Yet, Canadian privacy legisla-tion does not address concerns about sensitive information that competent children may not want themselves or their parents to know, i.e. a right not to know. Nor does it clearly mandate the right of children to know informa-tion that may be necessary to protect or promote their health. Several stat-utes stipulate who may give proxy consent on behalf of minors, including incorporating, by reference, surrogate decision-makers appointed for related purposes under other statutes.101 Ontario’s PHIPA details capacity issues
99 Kristien Hens et al, “Biological Sample Collections from Minors for Genetic Research: A Systematic Review of Guidelines and Position Papers” (2009) 17:8 European Journal of Human Genetics 979 [Hens et al, “Biological Samples Collections”]; Emma Williamson et al, “Children’s Participation in Genetic Epidemiology: Consent and Control”, in Richard Tutton & Oonagh Corrigan, eds, Genetic Databases: Socio-Ethical Issues in the Collection and Use of DNA (London, UK: Routledge, 2004) 139. See also Roberta L Woodgate & Marie Edwards, “Children in Health Research: A Matter of Trust” (2010) 36:4 Journal of Medical Ethics 211.
100 Convention on the Rights of the Child, supra note 32, art 12.101 Alberta HIA, supra note 75, ss 104(1)(b)-(c); Manitoba PHIA, supra note 78, s
60(1)(e); Saskatchewan HIPA, supra note 78, ss 56(c)-(d); Newfoundland and Labrador PHIA, supra note 78, s 7(d); New Brunswick PHIPAA, supra note 78, s 5. See also arts 19, 21, 22, 24, 25, 35 CCQ (whereby Québec contemplates that a person’s privacy may only be invaded upon consent or authorization by law, and such consent, in a paediatric biobank context, may be given by a parent). Note that Québec distinguishes the age of consent for research and does not employ the doctrine of the “mature minor.” In Québec, the age of consent to research is 18 years (art 21 CCQ), unless the child is fully emancipated, while the age of consent to required medical care is 14 (art 14 CCQ). While specifying an age avoids potentially arbitrary decisions concerning capacity and creates certainty, the attribution of different statuses to children and adults is contro-versial because it assumes stark differences in kind between the two groups, rather than differences in degree, including the level of maturity of members of each age-based group. See Lucinda Ferguson, “The End of an Age: Beyond Age
Health Law Journal Volume 20 (2013)34
related to consent and stipulates certain factors that a parent must take into consideration before providing or refusing consent, withdrawing consent, or providing an express instruction.102
Privacy legislation also does not adequately address issues surrounding maturing children and the varying nature of the information to be collected and its possible disclosure, suggesting that privacy has a different meaning when the individual is not accorded full legal rights because of age or competency.103 While we generally acknowledge that as between parent and
Restrictions for Minors’ Medical Treatment Decisions” (Research paper prepared for Law Commission of Canada, 2004) at 1, online: <http://papers.ssrn.com/sol3/papers.cfm?abstract_id=998227> (noting that neuroscience and psycho-logical research suggests that it is unwise to generalize about the development of decision-making maturity).
102 Ontario PHIPA, supra note 59, ss 23(1), 24. Consent by minors under age 16 to the collection, use or disclosure of information relating to treatment within the meaning of the Health Care Consent Act, 1996, SO 1996, c 2, Sch A (wherein the age of consent to medical care is 16) is permitted. Otherwise, children under age 16 must have a surrogate decision-maker irrespective of actual maturity or competence. A child who is at least age 16 can consent to the collection, use or disclosure by a health information custodian of personal health information (including for research purposes), provided he or she is capable of consenting.
103 R v RMB, [2006] MJ no 173 (QL) (MBPC), Garfi nkel J (“[a] minor of three years of age, for example, has less right to privacy than a minor aged nine or one aged 13 ... because the minor is so young ... [and] [a] nine-year-old may be entitled to a greater degree of privacy, but it is not absolute” at para 20). See also Benjamin Shmueli & Ayelet Blecher, “Privacy for Children” (2011) 42:3 Colum HRL Rev 759 (concluding after a survey of American jurisprudence that “privacy is recognized for adults but less so for children, and does not exist for children vis-à-vis parents” at 763); South Carolina v Samuel Whitner, (2012) 732 SE2d 861 (SC Sup Ct), Pleicones J (“a minor’s interest in privacy has barely been accorded legal recognition” at 869). But see Children’s Aid Society of Haldimand-Norfolk v CC (2004), 131 ACWS (3d) 453, 7 RFL (6th) 235 (ONCJ), Thibideau J (upholding the desire of a 12-year-old to not introduce the contents of a private journal and an autobiography she prepared for a school project into evidence in a child protection hearing, as “[e]xamination of the motivation for the position of the child with respect to privacy and a subsequent balancing of interests gives validity to the philosophy that the child in question is a person before the court whose views and preferences, when appropriate, have some meaning” at para 31).
Dove, Black, Avard & Knoppers Paediatric Biobanks 35
child, the child cannot expect to exercise self-determination or security to the same degree as an adult because society expects parents to “act in the best interests of” their maturing child, we also generally acknowledge that a complete abrogation of privacy by the parents would sacrifi ce both the child’s fl ourishing and autonomy and also destroy the inter-connected, familial trust relationship.104 As a society, most of us want children to develop their personhood, self-reliance and creativity. Thus, as they mature and become competent, their involvement in the expansion of their privacy interests should be refl ected in various activities, including research studies.
There is little consensus about the privacy dynamic between parents and children, and even less between children and researchers. Neither privacy legislation nor policy guidelines on research address the position that the benefi ts or harms of infringing upon the child’s privacy, from both self-determination and security perspectives, should be taken into account. Consequently, both the abstract, theoretical issues of a child’s autonomy and self-determination, and the practical issues of information control, return of research results and incidental fi ndings, and consent or assent are left unanswered.
Biobank PracticesAll three paediatric biobanks require the authorization of parents prior
to collecting, storing and using the biological material and data of their child. There is variation, however, in the level of disclosure regarding poten-tial risks, the scope of the right to withdraw, potential re-contact, and the types of material or data to be collected, even within the same biobank (e.g. Biobank A), suggesting that providing guidance to REBs is as important as regulating biobanks. The biobank policy variation also indicates that the “soft law” nature of international and national norms and guidelines does not suffi ciently compel paediatric biobanks to explicitly address privacy and autonomy issues for competent children or parents in the consent forms.
104 See e.g. Bruce Hafen, “Children’s Liberation and the New Egalitarianism: Some Reservations about Abandoning Children to Their ‘Rights’” (1976) BYUL Rev 605; Angela Campbell, “Stretching the Limits of ‘Rights Talk’: Securing Health Care Entitlements for Children” (2003) 27 Vt L Rev 399; Emily Buss, “Allo-cating Developmental Control Among Parent, Child and the State” (2004) U Chicago Legal F 27.
Health Law Journal Volume 20 (2013)36
Table 6 illustrates the biobank practices relating to the nature of the shared relationship between the child, the parents and the researcher.
5.3 SummaryAnalysis of the above three issues in the context of the case studies suggests that legislative standards and biobank practices are inconsistent (across and within each) when it comes to the privacy of paediatric biobank partici-pants. Legislation cannot remedy all of the potential risks and benefi ts to children, but the case studies demonstrate that, in the absence of clear statu-tory structures, researchers and institutions may act in disparate ways. For example, largely absent from the policies and consent forms is information regarding the ongoing control and use of the biological material and infor-mation collected. Further, the “potential risks and benefi ts” sections of the forms focus exclusively on the clinical risks, i.e. reactions to venipuncture or heart rate variability tests, rather than the ethical or informational risks, namely, autonomy and privacy concerns. Finally, beyond laws or paedi-atric guidelines determining competency for participation in research (i.e. the “mature minor” doctrine), these various legislative responses to health information privacy do not reach the issue of parental and researcher versus child privacy interests.
6. RecommendationsProtecting personal information privacy in the context of paediatric biobanks is an exigent endeavour compounded by complex, mismatching and incom-plete legislation. A partial explanation for this may lie in the constitutional constraints that complicate the ability to enact harmonized legislative rules on paediatric biobanking. Specifi cally, civil rights and health are provincial matters.105 While Canada’s National DNA Bank is federally regulated because criminal law is constitutionally a federal matter,106 paediatric biobanks largely revolve around (provincial) health matters that refl ect regional contexts, even if some are national in scope. The Supreme Court reference decision in 2010 on the Assisted Human Reproduction Act107 demonstrates that attempts by the federal government to address concerns that are health legislation
105 Constitution Act, supra note 55, ss 92(7), (13), (16).106 Ibid, s 91(27).107 Assisted Human Reproduction Act, SC 2004, c 2.
Dove, Black, Avard & Knoppers Paediatric Biobanks 37
Biob
ank
Ass
ent o
r co
nsen
t of
the
child
Retu
rn o
f ind
ivid
ual r
esul
ts (a
nd in
cide
ntal
fi nd
ings
) to
the
pare
nts
and/
or c
hild
With
draw
al
Biob
ank
A•
No
disc
ussi
on o
f
asse
nt o
r con
sent
of
th
e ch
ild
• N
o re
turn
of i
ndiv
idua
l stu
dy re
sear
ch re
sults
to p
aren
t or c
hild
, but
if re
quire
d by
par
ent,
he
alth
test
resu
lts m
ay b
e di
sclo
sed
(e.g
. par
ent m
ay re
ques
t tha
t ski
n te
st re
sults
or l
ung
fu
nctio
n te
st re
sults
be
sent
to fa
mily
phy
sici
an o
r pae
diat
ricia
n)•
No
disc
ussi
on o
f han
dlin
g of
inci
dent
al fi
ndin
gs, b
ut c
onse
nt fo
rm s
tate
s th
at “
If ne
w
in
form
atio
n ar
ises
that
may
affe
ct y
our w
illin
gnes
s to
rem
ain
in th
is s
tudy
, you
will
be
ad
vise
d of
this
info
rmat
ion
prom
ptly
”.
• Pa
rent
may
with
draw
at a
ny ti
me
• If
pare
nt d
ecid
es to
with
draw
from
stu
dy, p
aren
t will
not
be
in
clud
ed in
follo
w-u
p da
ta c
ol-
le
ctio
ns a
nd s
tudy
will
onl
y us
e
data
par
ent/
child
pro
vide
d
durin
g stu
dy p
artic
ipat
ion
• U
ncle
ar w
heth
er c
hild
has
righ
t
of w
ithdr
awal
Biob
ank
B•
Biob
ank
B D
atab
ank
an
d Ba
nk o
f Bio
logi
cal
M
ater
ial M
anag
emen
t
Polic
y ad
dres
ses
pos-
si
bilit
y of
obt
aini
ng
as
sent
of c
hild
ren
“w
hen
they
are
old
enou
gh to
und
ersta
nd”
an
d co
nsen
t whe
n th
ey
be
com
e ad
ults
• Po
licy
state
s th
at n
eed
fo
r ass
ent i
s ba
sed
on
m
atur
ity a
nd
in
telli
genc
e of
the
child
• Pa
rent
will
not
rece
ive
indi
vidu
al re
sults
• If
resu
lts re
veal
a s
igni
fi can
t hea
lth o
r dev
elop
men
tal p
robl
em th
at p
aren
t’s d
octo
r
shou
ld b
e aw
are
of in
ord
er to
follo
w u
p th
e pr
egna
ncy,
the
mot
her,
the
fath
er o
r the
chi
ld
ap
prop
riate
ly, th
e pa
rent
’s do
ctor
will
be
info
rmed
in o
rder
to ta
ke c
harg
e of
the
follo
w-
up
. The
se re
sults
cou
ld b
e ad
ded
to th
e m
edic
al fi
les
• Pa
rent
may
with
draw
at a
ny
tim
e, a
s m
ay c
hild
who
se
m
atur
ity a
llow
s hi
m/h
er to
unde
rsta
nd th
e im
plic
atio
ns o
f
with
draw
ing
Biob
ank
C•
Chi
ldre
n ag
ed 1
4-
18 s
peci
fi cal
ly a
sked
to p
rovi
de a
ssen
t to
pa
rtici
pate
• C
hild
ren
unde
r age
14
m
ust h
ave
study
expl
aine
d to
them
at a
leve
l tha
t is
ppro
pria
te
an
d th
ey m
ust p
rovi
de
as
sent
to p
artic
ipat
e
• N
ot a
ll in
form
atio
n re
gard
ing
patie
nt’s
entir
e se
quen
ced
geno
me
will
be
revi
ewed
in
deta
il•
Chi
ldre
n/M
inor
s co
nsen
t for
m:
•
Pare
nt h
as th
e op
tion
to b
e in
form
ed o
f the
resu
lts o
f the
stu
dy o
f the
rare
dis
ease
in
fa
mily
by
patie
nt’s
doct
or w
ho is
par
t of t
he s
tudy
. With
out o
ptio
n, p
aren
t will
be
info
rmed
of th
e id
entifi
cat
ion
of o
ther
dis
ease
-cau
sing
mut
atio
ns th
at c
ould
alte
r the
man
agem
ent o
f
the
child
’s he
alth
dur
ing
child
hood
by
patie
nt’s
doct
or w
ho is
par
t of t
he s
tudy
•
Info
rmat
ion
rela
ting
to n
on-p
ater
nity
or a
dult
onse
t dis
orde
rs m
ay b
e di
scov
ered
but
will
not
be
disc
lose
d in
the
cont
ext o
f the
stu
dy•
Affe
cted
/Una
ffect
ed/I
ncom
pete
nt A
dults
con
sent
form
:
• Pa
tient
will
be
info
rmed
of t
he re
sults
of t
he s
tudy
of t
he ra
re d
isea
se in
fam
ily b
y
patie
nt’s/
war
d’s
doct
or w
ho is
par
t of t
he s
tudy
. Pat
ient
has
the
optio
n to
be
info
rmed
by
pe
rson
al p
hysi
cian
abo
ut th
e id
entifi
cat
ion
of a
dditi
onal
dis
ease
-cau
sing
mut
atio
ns th
at
ha
ve c
linic
al s
igni
fi can
ce, a
nd w
here
pre
vent
ion
and
treat
men
t are
ava
ilabl
e
• Pa
rent
may
with
draw
at a
ny ti
me
an
d w
ithdr
aw th
eir c
hild
at a
ny
tim
e•
Chi
ldre
n ag
ed 1
4-18
yea
rs m
ay
w
ithdr
aw a
t any
tim
e•
Unc
lear
whe
ther
chi
ld u
nder
14 y
ears
of a
ge h
as ri
ght o
f
with
draw
al
Tabl
e 6:
Bio
bank
pra
ctic
es re
latin
g to
the
natu
re o
f the
sha
red
rela
tions
hip
of th
e ch
ild, p
aren
ts an
d re
sear
cher
Health Law Journal Volume 20 (2013)38
in pith and substance could well be ruled unconstitutional.108 Thus, the development of federal (paediatric) biobank privacy legislation could face multiple legal and political impediments, and so reliance on ethical norms and guidelines, professional codes of conduct, and provincial and territorial health and privacy laws will likely continue. Moreover, differing views as to the proper balance between privacy and the sharing of data and samples also make the formulation of a broadly accepted biobank governance structure a challenging undertaking.
Nonetheless, while Canada’s forensic National DNA Data Bank, created to collect DNA from certain criminals, is afforded explicit biobank legislation, oversight bodies, and a variety of safeguards, research biobanks suffer from a patchwork of under-inclusive regulatory provisions. Accountability and transparency could be affected in the face of such regulatory discrepancy, and international scientifi c collaboration could suffer if Canada’s privacy laws are found to be out of tune with international regulatory trends. Inter-national comparative analysis reveals that some countries adopt specifi c biobank professional guidance or even legislation to address the issues iden-tifi ed above,109 yet the legislation is silent on addressing the needs of biobank research involving children. That privacy protections available to Canadians vary from one province or territory to another, and from one sector (public) to another (private or hybrid), adds a further cumbersome, outdated and inadequate structural dimension to paediatric biobanks.
While professional guidance may be the best way forward, consid-ering emerging technologies such as next-generation sequencing used by
108 Reference re Assisted Human Reproduction Act, 2010 SCC 61, [2010] 3 SCR 457. See also Dave Snow, “The Judicialization of Assisted Reproductive Technology Policy in Canada: Decentralization, Medicalization, and Mandatory Regulation” (2012) 27:2 CJLS 169.
109 See e.g. Biobanks in Medical Care Act, (Swed), SFS 2002:297 (2002); Human Genes Research Act 2000, (Est), RT I 2000, 104, 685; Human Biobank Management Act, (Taiwan), Hua-Zong-Yi-Yi-Tzu No 09900022481 (2010). See also Edward S Dove, “The Genetic Privacy Carousel: A Discourse on Proposed Genetic Privacy Bills and the Co-Evolution of Law and Science” (2011) 9:4 Current Pharma-cogenomics and Personalized Medicine 252; Ma’n H Zawati, Bartha M Knop-pers & Adrian Thorogood, “Biobanking and International Collaboration” (2013) [unpublished, on fi le with authors].
Dove, Black, Avard & Knoppers Paediatric Biobanks 39
researchers accessing paediatric biobanks,110 and while many of the gaps in legislative protection are remedied in the ethical norms of the TCPS, this guidance suffers from its own fl aws. The TCPS is applicable only to insti-tutions eligible to receive and administer research funding from the three agencies that authored the document or certain health and social service institutions in provinces that have policies endorsing it. Furthermore, penal-ties for violation of TCPS provisions are limited to the ineligibility to receive or suspension of agency funding, unless the breach constitutes a criminal act.111 Reliance on ethical guidance alone, therefore, may not ensure the adequate protection of children.
We briefl y offer fi ve recommendations as possible avenues to bridge the gap between norms, laws and practice. This guidance, which should be further explored and tested in future articles and studies (especially within the broader, complex fi eld of biobank governance112), is intended to assist agencies, legislators, researchers and REBs when developing and inter-preting privacy laws and regulations pertaining to paediatric biobanks.
Recommendation 1: Privacy legislation should be harmonized across Canada.The lack of harmonization is a recurring problem for biobank stakeholders as it is an additional cost and administrative burden. As Canadian policy-makers and politicians have acknowledged, legal dissimilarity creates the risk of distorting the equivalent level of protection that the privacy laws are supposed to achieve and ensure.113 It also inhibits the interoperability of
110 Adrian Thorogood et al, “Whole-Genome Sequencing and the Physician” (2012) 81 Clinical Genetics 511.
111 “Schedule 8: Investigation and Resolution of Breaches of Agency Policies,” online: Natural Sciences and Engineering Research Council of Canada <http://www.nserc-crsng.gc.ca>. See also “Draft Agreement on the Administration of Agency Grants and Awards by Research Institutions,” online:
<http://www.cihr-irsc.gc.ca>.112 See e.g. Kaye et al, Governing Biobanks, supra note 27.113 Commission on the Future of Health Care in Canada, Building on Values: The
Future of Health Care in Canada – Final Report (Ottawa: Commission on the Future of Health Care in Canada, 2002) (“Canada Health Infoway should take the lead in promoting harmonized privacy rules across the country...” at xxvi).
Health Law Journal Volume 20 (2013)40
biobanks.114 Australia, which also has various levels of privacy laws (federal, state and territorial), has advocated harmonization of its privacy legislation. In 2002, the Offi ce of the Privacy Commission of New South Wales noted (in the specifi c context of genetic information) that:
A uniform approach to genetic information privacy is essential to ensure that all persons have equal protection regardless of where they live and who handles their genetic information. Widely differing standards of protection not only undermine human rights, they also undermine public confi dence in the way that institutions handle their personal information, especially in an increasingly networked information environment. Lack of uniformity can also add to confu-sion for those responsible for handling personal information, as well as obstruct cross-border fl ows of information.115
We do not advocate a particular avenue to achieve harmonized privacy legislation. Various models can be envisioned, such as new, uniform federal and provincial privacy or biobank legislation, or a regulatory framework specifi cally for biobanks that applies to all sectors. We note two qualifi cations, however. First, as discussed above, there are legal and political roadblocks to achieving sweeping legislative reform. In the short term, piecemeal legisla-tive amendments or regulations through intergovernmental cooperation are more likely. Second, much success is already being achieved through health information protection legislation, such as Ontario’s PHIPA. Amending these statutes to better incorporate international privacy regulatory trends and specifi c biobank-related issues, and encouraging the remaining provinces and territories that have yet to enact health information protection legis-lation to do so (on a harmonized plane), may be suitable paths to protect privacy in paediatric biobanks. Regardless, a recalibration of current legisla-tion is needed so that it adequately and harmoniously addresses paediatric biobanks and associated privacy concerns.
114 Michael Kiehntopf & Michael Krawczak, “Biobanking and International Inter-operability: Samples” (2011) 130:3 Human Genetics 369.
115 Offi ce of the Privacy Commission (New South Wales), Submission G118 (18 March 2002), in Australia Law Reform Commission and Australian Health Ethics Committee, Essentially Yours: The Protection of Human Genetic Information in Australia, ALRC Report 96 (Sydney: Commonwealth of Australia, 2003) at 245-246 [Essentially Yours].
Dove, Black, Avard & Knoppers Paediatric Biobanks 41
Recommendation 2: Applicable privacy legislation should specify that genetic information and biological materials are considered personal (health) information.Privacy legislation should specify that personal or health information includes genetic information about an individual in a form which is or could be predictive of the health (at any time) of the individual or a biological relative, and whether or not the information is collected in relation to the health of, or the provision of a health service to, the individual or a biological relative.116 Biological material should also be included in the defi nition of personal information or health information. Noting the particular paediatric context, the legislation should provide legally enforceable privacy standards for the collection, storage, use and transfer of biological material. Making explicit that genetic information and biological material is health informa-tion covered by privacy legislation would better protect the privacy interests of all individuals, including children. We do note, however, the particular issues that can arise in this context, such as confl icts between a parent and a child in accessing such health information.
As a corollary, privacy legislation should grant a competent individual, including a child, conditional access to his or her own biological material and data. Because of logistical and scientifi c constraints, such access should be made only for the purpose of medical testing, diagnosis or treatment. Further, the right to access can be refused where: (a) it is not physically possible; (b) providing access contradicts the purposes of the biobank; or (c) its release to an individual raises familial or other concerns. We distin-guish access from withdrawal from research, which should continue to follow norms and guidelines concerning the coding of data and samples or their destruction or removal from further research, as per the wishes of the research participant.
Recommendation 3: Privacy legislation should provide clear sanctions and privacy commission enforcement powers for unauthorized access and disclosure of personal (health) information.The Privacy Commissioner of Canada has called for amendments to PIPEDA to allow for greater sanctions against those who violate privacy.117 Looking abroad to our Commonwealth cousins, the United Kingdom’s Informa-
116 Adapted from Essentially Yours, ibid at 255.117 See e.g. “Fines needed to help stem growing data breaches, Privacy Commis-
Health Law Journal Volume 20 (2013)42
tion Commissioner’s Offi ce can enforce fi nes of up to £500,000,118 and the Parliament of Australia introduced legislation that allows its federal privacy commissioner to apply to the federal court to levy fi nes on indi-viduals and organizations for privacy breaches.119 Similarly, in Canada, each of the federal and provincial privacy commissioners should have the power to impose meaningful and signifi cant fi nes on individuals and enti-ties (including biobanks, respecting constitutional parameters) that breach privacy. In addition, all privacy commissioners should have order-making powers and the ability to compel entities to report privacy breaches to their offi ce. This could mitigate possible public backlash and resultant diminish-ment in trust that could stem from privacy breaches in paediatric biobanks. More meaningful penalties, combined with sanctioning and enforcement powers, would encourage biobanks to take a proactive and preventive approach to protecting privacy.
Recommendation 4: Privacy legislation should allow privacy commissioners to play an integral part in the regulatory framework for paediatric biobanks created for research. Privacy commissioners should incorporate in their regulatory scrutiny a bottom-up approach through ongoing dialogue with REBs and the broader biobanking community.Many REBs lack specifi c expertise, are under-regulated and cannot be expected to perform the kind of coherent, effective and effi cient privacy-related review and oversight that is needed for paediatric biobanks.120
sioner says” (4 May 2011), online: Offi ce of the Privacy Commissioner of Canada <http://www.priv.gc.ca>; “Social media websites ignoring privacy laws, watchdog says” CBC News (29 May 2012), online: CBC <http://www.cbc.ca>.
118 Data Protection Act 1998 (UK), c 29, s 55A; The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010, SI 2010/31, s 2.
119 Privacy Amendment (Enhancing Privacy Protection) Bill 2012 (Cth), passed 29 Nov -ember 2012 and received Assent 12 December 2012.
120 Lemmens & Austin, supra note 74 (noting that REBs are accustomed to reviewing consent in the context of traditional medical research, and that while statutes require REBs to consider whether adequate safeguards are in place to protect the privacy and confi dentiality of the health information in question, “to do so requires specialized knowledge regarding information systems and anonymisation protocols that is unclear REB members possess” at 32); Lisa M Austin & Trudo Lemmens, “Privacy, Consent, and Governance”, in Kris Dierickx
Dove, Black, Avard & Knoppers Paediatric Biobanks 43
Indeed, research indicates that Canadian REB members fi nd they lack clear guidance as to whether they should play an overseeing role of biobanks, and if so, what that role should be.121 It is doubtful that most REB members are apprised of the multiple privacy issues impacting biobanks, much less paediatric biobanks, and current regulatory responses to those issues. Cana-da’s National DNA Data Bank is overseen by the National DNA Data Bank Advisory Committee, on which a representative of the Offi ce of the Privacy Commissioner of Canada (OPC) sits to ensure that the Data Bank has access to expert advice in the fi eld of individual privacy in the criminal law context. The Data Bank is also subject to auditing by the OPC at any time. Paediatric biobanks, like other biobanks, should be subject to similar regulatory scru-tiny and oversight by privacy commissioners.
This policy recommendation should not be constrained by constitutional parameters per se, as we do not advocate the creation of a federal personal health information or biobanking law. Provincial privacy commissions and the OPC can work collaboratively with provincial and federal policymakers and REBs to improve competency in biobank oversight. This recommen-dation, therefore, is bidirectional: privacy commissions should inject more regulatory scrutiny into the REB process (a top-down approach), while REBs and other stakeholders, such as researchers, privacy experts and the general public, should provide privacy commissions with comments and recommen-dations regarding privacy and biobanking issues (a bottom-up approach). This is not to diminish or eliminate the role of REBs. Rather, it is to better
& Pascal Borry, eds, New Challenges for Biobanks: Ethics, Law and Governance (Antwerpen, Belg: Intersentia, 2009) 111 (“[t]he problem is not so much that [REBs] do not know what research will be undertaken, but that they cannot be sure that the risk of privacy violation is adequately, or consistently, dealt with” at 116); Michael Yeo, “Looking Out from Inside the Panopticon: A Privacy Perspective on Biobanking” (Analytic paper commissioned by the Offi ce of the Privacy Commissioner of Canada for the 29th International Conference of Data Protection and Privacy Commissioners, 2007) [unpublished] (“[e]thics review is hardly an appropriately democratic and accountable locus of responsibility and authority for resolving the signifi cant privacy issues posed by biobanking, nor for ensuring that our privacy rights and interests are adequately represented and weighed” at 33).
121 Elaine Gibson et al, “Who’s Minding the Shop? The Role of Canadian Research Ethics Boards in the Creation and Uses of Registries and Biobanks” (2008) 9 BMC Medical Ethics 17.
Health Law Journal Volume 20 (2013)44
protect the privacy interests of children by including in the review and over-sight by REBs competent and experienced experts, who themselves have been informed by a broad community of various biobanking stakeholders.
Recommendation 5: The provincial and federal governments should work towards developing a web-based, open access, federally administered database of all Canadian paediatric biobanks.Open access databases exist for clinical trials.122 These databases offer up-to-date information on both publicly and privately supported clinical trials for a variety of diseases and conditions. Given their success and the exponential growth of biobanks, federal and provincial privacy commissions, in collab-oration with Health Canada, should explore the possibility of preparing a transparent, federally administered, web-based, open access database of all Canadian paediatric biobanks.123
This long term recommendation124 can improve the protection of privacy in paediatric biobanks by allowing regulators and the public to have a better Canadian biobank “map,” thereby improving knowledge about the scope and content of Canadian paediatric biobanking. It would also allow poten-tial future biobank participants to inform themselves about the nature of biobanks and perhaps guide them in deciding whether to participate in a
122 See e.g. International Clinical Trials Research Platform Search Portal, online: World Health Organization <http://apps.who.int/trialsearch/>; ClinicalTrials.gov, online: National Institutes of Health <http://www.clinicaltrials.gov/>.
123 C.f. Health Canada, Guidance for Health Canada: Biobanking of Human Biological Material (Ottawa: Minister of Public Works and Government Services Canada, 2011) [draft unpublished, on fi le with authors]. Each record in the database could include information on the following (similar to ClinicalTrials.gov): 1) underlying research purposes/intended use; 2) title, description and design of the study (if clinical or research-based); 3) requirements for participation (if clinical or research-based); 4) location(s) of the biobank; and 5) contact infor-mation.
124 Such an undertaking would involve, at a minimum, prior comprehensive research, cost-benefi t analysis, discussions with various stakeholders, careful planning, and years of dedicated political and policymaking will. To facilitate this endeavour, the Public Population Project in Genomics (P3G) and Society, an organization supporting the networking of biobanks, has launched an inter-national paediatric research biobanking platform. See P3G, online:
<http://www.p3g.org>.
Dove, Black, Avard & Knoppers Paediatric Biobanks 45
particular research or clinical biobank. Furthermore, a database would likely improve transparency and public engagement, and allow regulators and policymakers to keep track of biobanks’ adherence to external and internal policies (legislative or otherwise) that impact privacy, among other matters. In turn, this would strengthen the value and validity of paediatric biobank research and clinical outcomes.
7. ConclusionCanadian paediatric biobanks face multiple privacy issues that are not adequately addressed in the current legislation. This is hardly a problem unique to Canada,125 but one that this country should take a lead in reme-dying so as to preserve its deserved reputation in cutting edge biomedical research and progressive privacy protection. The positive recent spate of provincial personal health information legislation provides much greater privacy protection for personal health information, and also now covers aspects of biobanking, but the degree to which it covers all aspects, partic-ularly with samples and in the paediatric context, is an open question. We therefore conclude that the formulation of laws recognizing the legal validity of biobanks remains an issue that Canadian policymakers should address. Amending current legislation or working towards new legislation in the specifi c context of biobanking may not be an ideal solution, however; many bespoke legal frameworks for biobanks have not been successful at effectively protecting participants’ interests.126 At the same time, paediatric researchers, biobank managers and participants may fi nd that “soft law,” be it in the form of localized (best) practices and guidelines or otherwise, allows them desirable fl exibility and is suffi cient to protect a child’s privacy inter-ests. Flexible though the status quo arrangement may be, it does not appear to be suffi ciently protecting privacy. Rather, the case studies indicate that statutory and regulatory gaps are not being adequately fi lled by standards of practice, raising the spectre of future privacy violations with inadequate legal remedies.
125 See Salvaterra, supra note 21 (fi nding that researchers in Europe involved in paediatric biobanking cite a lack of specifi c policies for paediatric biobanking and the need to adopt regulations dedicated to this fi eld).
126 Shawn HE Harmon, Graeme Laurie & Gill Haddow, “Governing Risk, Engaging Publics and Engendering Trust: New Horizons for Law and Social Science?” (2013) 40 Science and Public Policy 25.
Health Law Journal Volume 20 (2013)46
But navigating between the Scylla and Charybdis of biobank and privacy laws and policies is mitigated by recognizing that the privacy land-scape is knowable and capable of improvement. Thus, to come full circle and answer the question posed at the beginning of this Article, charting the privacy landscape in Canadian paediatric biobanks is not a Sisyphean ordeal, but it is a Herculean challenge. This Article has initiated the discussion by identifying the contours of the challenge. Now, more work must be done by ethical, legal and social science researchers and policymakers to determine specifi c solutions, including how best to address the privacy challenges in paediatric biobanking (e.g. through regulation, policies, standard operating procedures, or refl exive modes of governance), as well to determine how paediatric biobank researchers and participants – parents and children alike – view privacy issues. Only through an acknowledgment of the extant gaps in privacy legislation and a collective will to remedy these gaps can Canada ultimately move towards creating a privacy legal framework that both adequately protects children’s privacy and also advances scientifi c research and translational outcomes. This Article hopefully sets the beginning stages of necessary reform in paediatric biobanking, which perhaps will pave the way for “adult” biobanking as well.
Top Related