Legal ethical: Australian Legal Landscape

The Australian Constitution does not specifically cover privacy, healthcare and medical research. This means that the legal landscape relating to genomic data sharing in Australia is a complex patchwork of federal, state and territory laws in combination with ethical guidelines and codes of practice. (Eckstein et al., 2018) Questions of jurisdiction of state and federal legislation are complex, especially in modern research environments that are often multi-regional and multi-national.

Consent

According to the National Statement consent may be for a specific research project, extended for similar related research in the future, or unspecified allowing for any future research. Waivers of consent may also be granted by a HREC in circumstances where consent may be impracticable to obtain or there are no known or likely reasons why someone would otherwise object to giving consent. The National Statement says that specific consent is not needed when the data was aggregated or rendered non-identifiable, or if prior consent was given for an encompassing research project or clinical context for research. HRECs may require community or group consent in addition to individual consents for genomic research involving Indigenous Australians. (Eckstein et al., 2018)

Human Research Ethics Committees

HRECs have oversight of research proposals that involve human participants to ensure that they meet ethical standards and guidelines. Approximately 200 HRECs are registered with the NHMRC.

National statement on Ethical Conduct

The main ethical code covering sharing of human genomic information for research is the National Statement for Ethical Conduct in Human Research (2007) (Australian Government National Health and Medical Research Council 2007) (2018) (NHMRC, 2018). Compliance with this ethical code is not a legal requirement in Australia. But institutions may only apply for funding from the NHMRC if they declare that all their research complies with the National Statement. Failure to meet the requirements of the National Statement could have repercussions for employment, professional misconduct claims or even an action in the tort of negligence. It is a guiding principle of the statement that participation in research must be voluntary and participants must be well informed about the research and its implications. Researchers who share genomic data must try to minimise the likelihood of re-identifying individuals from the data.

Chapters 2.2 and 2.3 of the National Statement deal with consent and qualifiers and waivers of consent. Chapter 3.3 deals with genomic data. Chapter 4.7 addresses considerations related to Aboriginal and Torres Strait Islander peoples.

The Privacy act

Consent is usually required for genomic information meeting the definition of personal information as defined under Australian privacy laws. The federal public sector and private corporations are bound by the Privacy Act 1988 (AG, 2022; OAIC, 2022)(Commonwealth). Similarly most states and territories also have their own privacy legislation. In the federal legislation personal information must not be disclosed by a regulated entity beyond its original purpose for collection, unless a person has consented to the disclosure or exemptions apply. Exemptions allowing disclosure without consent include research with an impact on public health and safety and circumstances where the research cannot proceed without the use of de-identified data. The Privacy Act does not say whether genomic sequencing data on its own constitutes personal information, and this has not been tested in court.

A recent publication by Paltiel, Taylor and Newson (Paltiel et al., 2023) provides a deeper discussion of when genomic data may or may not be considered ‘personal information’ and protected under the Privacy Act. The context of the data and how it may contribute to the reasonable identifiability is important to understanding whether the Privacy Act applies to such data (Paltiel et al., 2023).

The Privacy Act is currently under review with a report recently released with the plan for how to strengthen protection of personal information. It is open for feedback until 31 March 2023.

Some potentially relevant proposals and amendments that are part of the report:

• 4.9 Sensitive Information
  • a. Recommendation to add ‘genomic information’ as one of the categories of sensitive information
• 14 Research
  1. introduce legislative provision that permits broad consent for the purposes of research
  2. consult further on broadening scope of research permitted without consent under the Act
• 18 Rights of the individual
  • 18.1 - right to access and explanation
  • 18.2 - right to objection to use or disclosure
  • 18.3 - right to erasure
  • 18.4 - right to correction
• 22.1 Introduction of concepts of controllers and processors - This is intentionally using similar language used in international legislation such as Europe’s GDPR legislation.

References

1. Paltiel, M., Taylor, M., & Newson, A. (2023). Protection of genomic data and the Australian Privacy Act: when are genomic data ‘personal information’? International Data Privacy Law, ipad002. https://doi.org/10.1093/idpl/ipad002
2. AG. (2022). Privacy Act 1988. http://www.legislation.gov.au/Details/C2022C00199
3. OAIC. (2022). The Privacy Act informational website. In Home. https://www.oaic.gov.au/privacy/the-privacy-act
4. Eckstein, L., Chalmers, D., Critchley, C., Jeanneret, R., McWhirter, R., Nielsen, J., Otlowski, M., & Nicol, D. (2018). Australia: regulating genomic data sharing to promote public trust. Human Genetics, 137(8), 583–591. https://doi.org/10.1007/s00439-018-1914-z
5. NHMRC. (2018). National Statement on Ethical Conduct in Human Research (2007) - Updated 2018 \textbar NHMRC. https://www.nhmrc.gov.au/about-us/publications/national-statement-ethical-conduct-human-research-2007-updated-2018

Contributors