Who Monitors Biobanks?
The Need for an Oversight Authority
by
Eleana Rodriguez
A thesis submitted in conformity with the requirements for the degree of Master of Laws
Graduate Department of the Faculty of Law
University of Toronto
© Copyright by Eleana Rodriguez, 2014
ii
Who Monitors Biobanks?
The Need for an Oversight Authority
Eleana Rodriguez
Master of Laws
Graduate Department of the Faculty of Law
University of Toronto
2014
Abstract
Biobanks are essential for developing innovative solutions to address human health challenges,
including disease prevention and the development of personalized medicine.
At the same time such biobanks pose unique legal and ethical challenges, and raise many as yet
unanswered questions, including how the collection of biological samples and information
should be governed. I suggest that biobanks should have a clear regulatory structure and
oversight system. I examine, in particular, the need for an oversight authority, arguing that the
self-governance trend is not sufficient enough to ensure that all biobanks have proper governance
practices, and that some formal regulation is needed to protect the integrity of research
participants and to guarantee the security and confidentiality of the participants’ information. I
examine two Canadian models: a) the authority model that requires approval from the privacy
commissioner, and b) the stewardship committee that is a statutory access committee. Both
models could exist by enacting legislation in the biobanking context. Central to my arguments is
the concept of the "authority" to monitor the biobanks. From this, I suggest that robust biobank
iii
governance mechanisms require not only their own governance system but that these must
necessarily involve a formal oversight body by the state for licensing and monitoring and which
has the power to impose sanctions. I argue for a formal “authority” model of governance.
iv
Acknowledgments
I would like to express my sincere gratitude to the Canadian Institutes of Health Research for
their financial support in awarding me a CIHR Training Program Fellowship. I would also like to
thank my supervisor Trudo Lemmens for his guidance and support during my studies and in the
preparation of this thesis. Last but not least, my deepest thanks goes to my daughters Isabella and
Sofia who inspired me every day and especially my husband Jose-Alejandro Lujan whose
unending love and support made this possible.
I would also like to thank my parents for their endless love, support and encouragement
throughout my life.
v
Table of Contents
1 Introduction ............................................................................................................................ 1
2 Biobank Issues......................................................................................................................... 8
2.1 Individual Level ............................................................................................................... 9
2.1.1 Privacy and Confidentiality......................................................................................... 9
2.1.2 Control over Samples and Data................................................................................. 11
2.2 Public Interest ................................................................................................................ 15
2.2.1 Research Interest ....................................................................................................... 16
2.2.2 Sharing of Information .............................................................................................. 18
2.2.3 Open Access .............................................................................................................. 20
3 Mechanisms to Deal with the Issues.................................................................................... 23
3.1 Governance..................................................................................................................... 29
3.1.1 Importance of Governance ........................................................................................ 30
3.1.2 Characteristics of Good Governance......................................................................... 35
3.2 Legislation ...................................................................................................................... 40
3.2.1 Common Law............................................................................................................ 43
3.2.2 Privacy Legislation.................................................................................................... 45
4 Challenges of the Existing System....................................................................................... 61
4.1 Regulatory Patchwork................................................................................................... 61
4.1.1 International............................................................................................................... 62
4.1.2 Tri-Council Policy Statement (2010) ........................................................................ 64
4.2 Research Ethics Board’s Role....................................................................................... 67
4.3 Oversight by the Privacy Commissioner ..................................................................... 70
vi
5 Strengthening the System .................................................................................................... 72
5.1 International Initiatives................................................................................................. 73
5.2 Canada Initiatives .......................................................................................................... 75
6 Conclusion ............................................................................................................................. 77
1
1 Introduction
In Canada no authority has a specific mandate to monitor the creation, management or operation
of biobanks. The central question on which I focus in this thesis is whether or not the
governance mechanisms currently in place are adequate to: (i) protect participants’ privacy, and
(ii) enforce good governance practices in the Canadian biobank context.
Since the Human Genome Project1 completed the sequencing of the human genome in 2003, the
importance and prevalence of biobanking has increased substantially. The advances made in
genome sequencing have contributed to more medical progress due to the sharing of and access
to biological material and associated data; the growing size of the collections increasing their
scientific value; and the range of applications of data banks having grown, especially in
genomics and in population genomics.
According to the Global Directory of Biobanks, Tissue Banks and Biorepositories, Canada
currently has 14 registered biobanks, while the United States of America has 155.2
But first, a definition of a biobank is required. For the purpose of this thesis a biobank is a
collection of biological material – such as tissues, blood and cells – and the associated data and
information stored in an organized system, for a population or a large subset of a population.3
These data comprise information about the donor of the material, such as demographic
characteristics, the type of disease associated with the sample, the outcome of the disease,
1 In 2003, the Human Genome Project completed the map of the human genome. This means scientists now know the full DNA sequence for humans. This information can be used to look at the way human genes interact with other factors such as lifestyle, environment and disease. See <http://www.genome.gov/>. 2 Specimen Central, Global Directory of Biobanks, Tissue Banks and Biorepositories (Minneapolis, MN: Specimen Central, LLC), online: <http://specimencentral.com/biobank-directory.aspx>. 3 The Organization for Economic Co-operation and Development (OECD) Glossary of Statistical Terms, Creation and Governance of Human Genetic Research Databases (Paris: OECD, 2006), online: <http://stats.oecd.org/glossary/detail.asp?ID=7220>.
2
treatment and information pertaining to environmental exposures, health, and life style
variables4. In addition, DNA5 and RNA represent information, which has led to the terms
“genetic database” and “population database” that are regularly used as synonyms for the term
“biobank”.6 The scientific value of a biobank lies in the possibility of collecting data or
specimens from hundreds or even thousands of individuals.
The size and sophistication of biobanks are increasing each year, and there has been an
unprecedented proliferation of them whether in terms of storage duration, quantities of banked
specimens, or the number of bank sites. In recent years biobanks have received much attention
as a new key infrastructure and resource for biomedical research and drug development7. At the
same time, there has been a boom of population biobanks, as more and more countries have
established new sample collections.8 Among the best known are: the Icelandic Health Sector
Database; the Estonian Genome Project; the UK Biobank; the CARTaGENE Project in Quebec,
Canada; the Banco Nacional de ADN in Spain; the International HapMap Project; and several
US biobanks, such as the National Children's Study. Most prominently, in 1998, the Icelandic
Ministry of Health announced its plans for the construction of a Health Sector Database
involving the entire Icelandic population. These plans, initiated by the private company
deCODE Genetics, specified how and under what conditions to assemble medical records and
4 A computer database is usually used to store the information. The database is usually called a dataset. 5 DNA is a relatively easy way to identify people because: -It is unique to each person. No one else has exactly the same DNA makeup; -It is found in almost every cell in the body including hair, sweat and skin; and -It is permanent and lasts for life. 6 Bernice S. Elger and Arthur L. Caplan, “Consent and anonymization in research involving biobanks: Differing terms and norms present serious barriers to an international framework” (Jul 2006) 7(7): 661–666 at para 3 EMBO Report [Elger & Caplan, 2006], online: <http://www.ncbi.nlm.nih.gov/pmc/articles/PMC1500833/#b19>. 7 Herbert Gottweis, “Biobanks: Success or Failure? Towards A Comparative Model” (Feb 2012) 33:199-218 Trust in Biobanking at 213 [Gottweis, 2012], Veröffentlichungen des Instituts für Deutsches, Europäisches und Internationales Medizinrecht, Gesundheitsrecht und Bioethik der Universitäten Heidelberg und Mannheim, online: <http://link.springer.com/chapter/10.1007/978-3-540-78845-4_13>. 8 Jocelyn Kaiser, “Population databases boom, from Iceland to the U.S.” (Nov 2002) 298(5596):1158-61 Science Mag., The National Center for Biotechnology Information (NCBI), [Kaiser, 2002], online: <http://www.sciencemag.org/content/298/5596/1158.short>.
3
possibly combine them with genetic data and genealogical records for the purposes of tracking
the presumed genetic bases of diseases and for furthering the goal of economizing in the
National Health Service.9 Biobanks represent a new paradigm for biomedical research,10 and
raise some ethical and legal issues. While some of these issues are not new, the increasing
breadth and scope of biobanks has amplified them even though the combination of a broader set
of genetic data and personal information in biobanks – including data banks – raises concern
about the use of such information, especially when sharing such information in a non-clinical or
non-research context.11 Other issues include the nature, scope and adequacy of consent,12
confidentiality, access to information, and privacy protection.13. For example, some issues arise
from the fact that genetic relatives’ genomes are very similar to each other, and therefore the
genotyping of one person can have informational implications for relatives.14 Each of these
issues is subject to extensive debate, and the aim is to find a balance among such considerations
as individual autonomy, public trust and the need for continued development of innovative
solutions that address human health challenges, including disease prevention and the development
of personalized medicine.
My interest in biobanks started while working in an academic hospital. Part of my work
involved preparing agreements for the sharing of data and samples. A few years ago we started
receiving more complex agreements and I had a lot of questions about the sharing of biological
materials. At that time the institute did not have a comprehensive policy regarding such sharing,
9 Gisil Palsson & Kristin Hardardóttir, "For Whom the Cell Tolls: Debates about Biomedicine" (April 2002) 43: 271-301 Curr Antropol 10 It differentiates from the single, time-limited studies with a defined research question. 11 The Organisation for Economic Co-operation and Development (OECD) Executive Summary, Creation and Governance of Human Genetic Research Databases 9-17, [OECD, Exec Sum], online: <http://www.oecd.org/health/biotech/37647338.pdf>. 12 Margaret Otlowski, “Developing an Appropriate Consent Model for Biobanks: In Defence of 'Broad' Consent”, Principles and Practice in Biobank Governance, Jane Kaye & Mark Stranger (eds) (Farnham: Ashgate, 2009) 79-92. 13 Susan MC Gibbons, “Are UK genetic databases governed adequately? A comparative legal analysis.” Leg Stud, 2007 27(2): 312-342 [Gibbons, 2007]. 14 William Lowrance, Privacy, Confidentiality, and Health Research, (Cambridge: Cambridge University Press, 2012) [Lowrance, 2012].
4
and it was challenging to find answers to those questions. I was fascinated with the future of
biobanks and decided that I wanted to have a better understanding and at least in my circle help
this extraordinary research continue to evolve. Biobanks may help scientists understand why
people have different reactions to drugs, help reduce adverse drug reactions and allow medicine
to be tailored to each person.
The appropriate structure for the governance of biobanks in Canada continues to evolve. As it
stands now, there is a lack of legislation specific to biobanks which addresses particular issues
for their governance, such as a statutory authority to monitor and oversee their creation. I
acknowledge that in Canada it is complicated to establish a national policy due to the fact that
the regulation of biobanks is shared between the federal and provincial levels of government.
Although some biobanks have begun to develop ad hoc policies and standard operating
procedures, the self-governance model is not sufficient to compensate for the absence of specific
governmental legislation. For example, the protection of health information is addressed
differently in every jurisdiction across Canada, and the federal laws that could impact biobanks
(the Privacy Act15 and PIPEDA16) have limited applicability.
Privacy protection should be extended in a way that not only protects against the misuse of the
information by researchers but also blocks inappropriate access to such information by
researchers and third parties. Third parties would include internal personnel from the biobank
who can innocently or maliciously violate confidentiality, which could result in the data being
improperly used to reveal the identity of participants. Such action could result in participants
15 Privacy Act, RSC, 1985, c P-21 [Privacy Act, 1985]. 16 The Personal Information Protection and Electronic Documents Act, S.C. 2000, c.5 [PIPEDA].
5
being harmed or appearing to be harmed. 17 18As biobanks must ensure that those who
participate in research are protected from any unwarranted harm resulting from the inadvertent
release of personal information, more attention is needed to govern and regulate the
administration of biobanks. One possible path to build a robust governance system, as proposed
in this thesis, involves legislation addressing biobank governance, particularly establishing an
oversight mechanism that permits the enforcement of good governance practices in the context
of biobanks. One of my proposals is that the Privacy Commissioner, who has specific expertise
on privacy issues, could be the authority. Privacy is indeed one of the major challenges for the
structure of biobanks. The Privacy Commissioner should review and approve rules and
procedures in accordance with national and international standards. Another approach
considered in this thesis is a stewardship committee, which consists of a committee established
by statute and which is responsible for approving who can have access to the data and for
determining the requirements for this access.
Admittedly, legislation cannot solve all of the potential privacy risks that face individuals who
participate in biobank research. For example, legislation cannot guarantee that genomic data will
remain anonymous, that it will not be identifiable19 20 21or that it will not be linked to other
17 [Lowrance, 2012] supra note 14 at 131. 18 An example of internal malicious use of personal health information is a recent case in an Ontario hospital which has admitted that two former employees sold patient information to multiple Registered Education Savings Plan (RESP) companies. The patients affected were mainly mothers who gave birth at the hospital between 2009 and 2013. The Star, published on Tuesday June 03 2014. Online: <http://www.thestar.com/news/gta/2014/06/03/major_privacy_breach_involving_thousands_of_new_mums_uncovered_at_rouge_valley_hospital.html> 19 [Lowrance, 2012] supra note 14 at 119. 20 For example, the terminology used by the European documents (CDBI, 2006; COE, 2006) is on the basis of five levels of anonymization for human samples: anonymous, unlinked anonymized, linked anonymized, coded and identified. If samples contain any trace of DNA, they are not truly anonymous, because it is always possible to identify the donor through DNA fingerprinting—comparing DNA sequences at only 30–80 statistically independent single nucleotide polymorphisms will uniquely define a single person. Anonymous is therefore an appropriate term only for archaeological samples. The term “anonymized” means that biological material is stored alongside associated information, such as the type of tumour, medical treatment, donor's age and so forth, but all information that would allow identification of the research participant or patient is stripped, either irreversibly (unlinked anonymized) or reversibly (linked anonymized). In the case of linked anonymized samples, identification is possible by a code, to which researchers or other users of the material—as part of the definition of the term ‘reversibly/linked anonymized'—do not have access. Coded samples have the same characteristics as linked (reversibly) anonymized samples, the only difference being that researchers and users have access to the code. Finally, samples are considered to be identified if the information that allows identification—
6
databases that could potentially reveal significantly personal information. However, appropriate
legislation or regulations may significantly minimize such risks. Legislation could lay the
foundation for achieving better biobank governance mechanisms. While a significant amount of
research and literature has focused on building a model for a self-governance framework to
optimize the use of biobanks, very little work has been undertaken specifically to explore firmer
regulatory options. There has been little research undertaken with respect to the implications of
the lack of formal oversight authority for biobank structures in the research context. Therefore this
thesis also aims to examine two different Canadian approaches to fill this void in oversight and
demonstrate the importance of ensuring good governance practices for minimizing some of the
current biobank challenges.
Legislation is needed in order to give statutory powers to an authority with the ability to ensure
compliance and the mechanisms for enforcement of decisions. Some can argue that it is not
necessary to have specific legislation in place to address some of the biobank issues, however
the sensitive nature of the information stored in these structures requires some level of
government protection. Legal authority would encourage adequate protection of participants in
the sensitive matter of access to personal information. Finally, having similar legislation or at
name, address and so on—is associated directly with the tissue, such as when the patient's nametag is attached to the sample. In most US and English Canadian texts, anonymized refers only to unlinked anonymized samples. Bernice S Elger and Arthur L Caplan, “Consent and anonymization in research involving biobanks: Differing terms and norms present serious barriers to an international framework”, EMBO Rep. Jul 2006; 7(7): 661–666. 21 Ibid at 119. For example genomic data can become identified using some methods such as matching genotype with identified or identifiable genotype data, or by linking genomic and associated data with external data and deducing the identity.
7
least providing similar protection to participants throughout Canada would foster the exchange
of data and biological material in a context that respects the subjects and sustains their trust.22
This thesis is divided into six chapters. It begins with an introduction to provide background
about the importance and complexity of these novel research structures vis a vis the obligation
of the state to provide some oversight mechanism to protect the participant’s interests at stake.
Chapter 2: Biobank Issues provides insight into the impact of these structures dealing with
human samples, invading individual autonomy or limiting self-control, and how they raise a
number of challenges. The chapter begins with an overview of the current ethical and legal
issues surrounding biobanks. First, it addresses issues involving individuals such as
confidentiality and privacy, control and access to data. The second part of this section provides
insights from the perspective of the public interest, namely, research interest and why it is
important for some research to use these structures, the sharing of information and the provision
of open access. Chapter 3: Mechanisms to Deal with the Issues, reviews some of the
mechanisms for dealing with biobank issues. Firstly, it addresses different forms of consent as a
way to deal with the informed consent challenge, however this does not resolve all of the issues
discussed before. The chapter will then discuss why governance is needed, and what are the
characteristics of a “good governance” system. This is followed by an overview of the common
law and the privacy legislation applicable in the biobank context, at the federal and provincial
level. This chapter also discusses how two Canadian provinces, Ontario and British Columbia,
could enact legislation to establish more specific statutory instruments for strengthening the
biobank governance system and for providing the foundation for future legislative initiatives.
22 Fonds de la Recherche en Santé du Québec (FRSQ), “Governance Framework for Data Banks and Biobanks used for Health Research” (Dec 8, 2006) Advisory Group Final Report [FRSQ, Final Report, 2006], online: <http://www.frsq.gouv.qc.ca/en/ethique/pdfs_ethique/Rapport_groupe_conseil_anglais.pdf >.
8
Chapter 4: Challenges of the Existing System, begins by analyzing the difficulties that Canadian
biobanks face within the current regulatory patchwork, at the international level, and then at the
federal and provincial levels in Canada. It then examines the role of the Research Ethics Board
(REBs) as an oversight body of biobank activities. This is followed by addressing the potential
impact of giving insufficient powers to the privacy commissioner to monitor and oversee
biobanks. Chapter 5: Strengthening the System examines international and national initiatives to
determine what steps could be taken to strengthen the Canadian system for biobanks. For
instance, what are the lessons learned from the P3G initiative? Chapter 6 provides a conclusion
to the thesis.
2 Biobank Issues
Biobanks can potentially make an endless number of contributions to health research and health
innovation, whether in the areas of prevention, diagnosis, or treatment of disease. But at the
same time, they create significant challenges. Issues that arise in the context of the establishment
and use of these biobanks can be seen at the individual level, involving concerns about consent,
confidentiality, privacy, control and access to data. Challenges also arise from the perspective
of the public interest. These concerns relate to research interest, the sharing of information and
open access. Existing legal mechanisms may not be sufficient to accommodate some of these
challenges23. In this chapter I will review the literature and discuss some legal cases that
illustrate these challenges.
23 Anne Cambon-Thomsen, Emmanuel Rial-Sebbag & Bertha Maria Knoppers, “Trends in ethical and legal frameworks for the use of human biobanks” (2007) 30: 373-82 Eur Respi J at 375, [Cambon-Thomsen, 2007], online: <http://erj.ersjournals.com/content/30/2/373.long>.
9
2.1 Individual Level
2.1.1 Privacy and Confidentiality
Advances in science come with a cost. The process of collecting, analyzing, and sharing
information in many cases invades privacy and results in the accessing of data that some people
believe should not be shared. There are two separate interests regarding the control of personal
information. The first interest is privacy, which means that people are entitled to keep certain
information private. This stems from an individual’s 24 right to be free from intrusion or
interference by others. 25 Individuals have privacy interests in relation to their bodies, personal
information, expressed thoughts and opinions, personal communications with others, and spaces
they occupy. Research affects these various domains of privacy in different ways, depending on
its objectives and methods. An important aspect of privacy is the right to control information
about oneself. The second interest is confidentiality, which means that under certain
circumstances, a person can disclose his or her private information to another with the
expectation that it will not be disseminated more broadly. The ethical duty of confidentiality
includes obligations to protect information from unauthorized access, use, disclosure,
modification, loss or theft26. For example, the participant who discloses private information to
the biobank or to her physician can expect that the physician will not reveal it to others.27
People are more likely to reveal personal information if they believe that the individuals to
24 Canadian Institutes of Health Research, Natural Sciences and Engineering Research Council of Canada, and Social Sciences and Humanities Research Council of Canada, Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans. (Ottawa: Public Works and Government Services Canada, Dec 2010), Chapter 5 [TCPS, 2010], online: <http://www.pre.ethics.gc.ca/pdf/eng/tcps2/TCPS_2_FINAL_Web.pdf>. 25 Ellen Wright Clayton, “Privacy and Confidentiality in Epidemiology: ‘Special Challenges of Using Information Obtained without Informed Consent’” in Steven S Coughlin, Tom L Beauchamp & Douglas L Weed (eds), Ethics and Epidemiology (Oxford Scholarship, September 2009) [Clayton, 2009]. 26 [TCPS, 2010], supra note 24. 27 [Clayton, 2009] supra note 25.
10
whom they reveal it will protect it.28 The concept of consent is related to the right to privacy.
Privacy is respected if an individual has an opportunity to exercise control over personal
information by consenting to, or withholding consent for, the collection, use and/or disclosure of
information. However, a basic premise of contemporary professional ethics is that privacy and
confidentiality should be compromised only to the extent necessary to achieve the desired public
goal. Health information custodians – who have custody of or control over personal health
information – and researchers have the obligation to protect the data they use, and therefore
need to provide security safeguards to protect the collected information. Another challenge for
maintaining the privacy and confidentiality of information is the current trend toward open
access to research data, which will be discussed in more detail later in this chapter.
One of the tools used to maintain the privacy of information is to de-identify the data. However,
recently, the value of de-identification of personal information as a tool to protect privacy has
come into question.29 In recent years, studies have demonstrated that it is possible to re-identify
individuals from information that has previously been claimed to be de-identified30. De-
identification continues to be a valuable and affective mechanism for protecting personal
information. Some studies have given rise to academic articles claiming that privacy cannot be
protected through de-identification. For example, Rothstein argues that the assumption that
privacy may be protected through de-identification is incorrect, since it has been demonstrated
28 Ibid. 29 Ann Cavoukian and El Eman Kahled, Dispelling the Myths Surrounding De-identification: Anonymization Remains a Strong Tool for Protecting Privacy, (Toronto: Information and Privacy Commissioner of Ontario, Jun 2011), [Cavoukian & Kahled, 2011], online: <http://www.ipc.on.ca/images/Resources/anonymization.pdf>; Djims Milius et al, “The International Cancer Genome Consortium’s evolving data-protection policies” (Jun 2014) 32(6): 519-523 Nature Biotechnology, online: <http://www.nature.com/nbt/journal/v32/n6/full/nbt.2926.html>. 30 Ibid
11
that easy re-identification is possible.31 Advances in technology have made re-identification of
personal information easier at a low cost. New databases useful for linking are now available,
with advances being made in re-identification technology. In addition, the Internet has
facilitated the collection and distribution of large amounts of information. While much of this
information may appear as non-identifying, it can be combined with information from other
sources to eventually produce data that may be linked back to specific individuals. De-
identification is particularly valuable in the context of personal health information. Health
information requires protection since it is highly sensitive and may include some of the most
intimate details associated with one’s life, such as those related to one’s physical and mental
health. Consequently, personal health information requires the strongest privacy and security
protections through a robust governance framework to prevent unauthorized collection, use and
disclosure. As mentioned before, an important aspect of privacy is the right to control
information about oneself.
2.1.2 Control over Samples and Data
According to a study in public perspectives on informed consent for biobanking,32 participants
could have some concerns over which areas of research their information and samples will be
used, and some prefer to place explicit limits on information which is particularly sensitive (e.g.
mental health and behavioural issues). 33 Participants’ preference in this study was to be asked
for their consent each time a study making use of their samples and information was proposed,
31 Mark A Rothstein, “Is De-identification Sufficient to Protect Health Privacy in Research?” (Sep 2010) 10(9): 3–11 Am J Bioeth. 32 Juli Murphy et al, “Public Perspectives on Informed Consent for Biobanking” (December 2009) 99(12): 2128-2134 Am Journal Public Health [Murphy, 2009]. 33 Ibid.
12
since with this approach they were able to maintain control over their samples and have the last
word over the kind of research in which they wished to participate.
Also, there is a debate concerning the nature of the legal interest in and rights of control over
human biological materials, as well as tensions between “vital public interest in protecting
research participants and facilitating beneficial, cutting-edge biomedical research”.34 One
question is whether individuals who donate biological materials for research purposes can
withdraw their consent to the use of their materials at any point. An issue around control over
information is the right of participants and family members to maintain the privacy of the
information.35 Another issue involving control is how to deal with the general ethical standard
which requires that each individual has “the right to know and the right not to know” the results
of research.36 The issue of return has sparked a broad debate about the ethical implications of
biobanking. Although very few articles confirm that participants actually have a substantial
level of interest in getting their personal research results back,37 it seems that most of the
authors do not advocate returning individual results.38 39 40
Another issue is the concept of “ownership” of human biospecimens and it has led to several
disputes and legal cases.41 42 The dispute at the heart of most of these cases is who has the right
34 Ubaka Ogbogu & Sarah Burningham, “Privacy protection and genetic research: where does the public interest lie?” (March 2014) 51(3): 471
Lexis Nexis [Ogbogu & Burningham, 2014], online: <https://litigation-essentials.lexisnexis.com/webcd/app?action=DocumentDisplay&crawlid=1&doctype=cite&docid=51+Alberta+L.+Rev.+471&srctype=smi&srcid=3B15&key=26f573c4ea65fb973db098f847d6660a >. 35 Loane Skene, “Feeding Back Significant Findings to Participants and Relatives”, Principles and Practice in Biobank Governance, Jane Kaye & Mark Stranger (eds), (Farnham: Ashgate, 2009) 175 [Skene, 2009]. 36 Danijela Budimir et al, “Ethical aspects of human biobanks: a systematic review” (June 2011) 52(3): 262-279 Croat Med J. 37 Juli Murphy et al, “Public expectations for return of results from large-cohort genetic research” (Nov 2008) 8(11): 36–43 Am J Bioeth. 38 See Mats G. Hansson, “The need to downregulate: a minimal ethical framework for biobank research” (2011) 675:39-59 Methods Mol Biol. 39 See Mark A. Rothstein, “Expanding the ethical analysis of biobanks” (2005) 33(1):89-101 J Law Med Ethics. 40 See Joanna S. Forsberg, Mats G. Hansson & Stephan Eriksson, “Changing perspectives in biobank research: from individual rights to concerns about public health regarding the return of results” (2009) 17(12):1544-9 Eur J Hum Genet. 41 Moore v. Regents of University of California, 793 P.2d 479 (Cal. 1990).
13
to control the use and distribution of biospecimens, and in some cases, products derived from
biospecimens. One of the questions in the biobank context is whether individuals who donate
biological materials for research purposes still have control over the samples. An Ontario court
has recently ruled that excised human tissue is private property and that it belongs not to the
person from whom it came but to the institution that holds it.43 Although this ruling has been
made, focus should be on the issue of how the sample can be used, and not who owns it.
Some of the questions that arise around “ownership” or “custodianship” are: Can participants
withdraw consent to the use of their materials at any point in time? Can the participants decide
to transfer their samples to another institution? 44 Some scholars 45argue that is not realistic or
practical to ensure that people have an actual right of control over the samples and data, since
the samples vary in their uses. The samples circulate, can be coded in many different ways, and
can be used by various researchers.
In a recent publication by Ogbogu46 et al., they used the McInerney v MacDonald47 decision, a
leading Canadian Supreme Court decision that sets out the nature and scope of common law rights
of access to health information. With the McInerney case the authors argue that the Supreme Court
suggests a strong and ongoing right of access to and control over genetic information that is
grounded in the nature and character of genetic information, personal autonomy and fiduciary law,
42 Greenberg v. Miami Children´s Hospital Research Institute, Inc, 264 F. Supp. 2d 1064, 1075 (S.D. Fla 2003). 43 Piljak Estate v. Abraham, 2014 ONSC 2893. 44 Washington University v. William Catalona, Washington University v. Richard Ward et al, United States Court of Appeals for the Eighth Circuit, Nos. 06-2286 & 06-2301, 13 December 2006. 45 Emmanuelle Rial-Sebag and Anne Cambon-Thomsen, “The Emergence of Biobanks in the Legal Landscape: Towards a New Model of Governance” (March 2012) 39(1):113-30 Journal of Law and Society [Rial-Sebag & Cambon-Thomsen, 2012]. 46 Ubaka Ogbogu, Sarah Burningham & Timothy Cauldfield, “The right to control and access genetic research information: Does McInerney offer a way out of the consent/withdraw conundrum?” (University of Alberta, Health Law Institute, Jan 2014) [Ogbogu, Burningham & Cauldfield, 2014], online: <http://www.hli.ualberta.ca/~/media/hli/Research/Docs/2013-09-15_McInerney_website.pdf>. 47 McInerney v. MacDonald, [1992] 2 S.C.R. 138.
14
which also includes the right to withdraw consent to research use of biological material and
associated genetic information. While the McInerney decision did not deal specifically with human
tissues or with the property law issues surrounding the collection and use of tissues for research
purposes, it raises interesting questions about how a Canadian court might “characterize the legal
interests in human tissue”.48
As we noted above, the concept of “ownership” over biological samples is a complex topic
which raises concerns. Debate continues over whether participants should or should not keep
control over the samples now stored in these biobanks.
There is a case that illustrates this tension between institutions and researchers. In the U.S.
patients who donate tissues to a researcher or university may lose all rights to those tissues, even
if signed documents exist saying the patients retain rights. That is the meaning of a recent court
ruling in St. Louis, involving the internationally famous prostate surgeon William Catalona. Dr.
Catalona over many years collected thousands of biological specimens. Many of the donors
were Dr. Catalona’s patients, and many others were not. Most of the informed consent forms
signed by these research participants used the term “donation” to describe the biological
sample’s transfer from the individual to the university and noted that the samples “may be used
for research with our collaborators at [the university], other institutions, or companies.”
When Dr. Catalona left the university to join the medical faculty of another institution in 2003,
he contacted thousands of research participants, without institutional review board (IRB)
approval, and requested that they direct the University to transfer the participants’ biological
materials to him at his new institution.
48 [Ogbogu, Burningham & Cauldfield, 2014], supra note 46 at 12.
15
The Court held that Washington University “owns the biological materials and neither Dr.
Catalona nor any contributing individual has any ownership or proprietary right in the disputed
biological materials.” In sum, the U.S. Court of Appeal held that patients do not retain an
ownership interest in tissues voluntarily donated for research purposes and it did not grant them
the right to withdraw their tissues from research use. This case shows some of the tensions that
can arise between researchers and institutions, and that patients desire to keep with them some
decision-making authority or even ownership over the samples.49
2.2 Public Interest
Biobanks have become increasingly important for the study of health and disease. Also, there is
a significant public interest in the outcomes of genetic research, which include diagnostic,
therapeutic, and preventative health methods and products. Trust must be established within not
only the medical and research community but also with the general public.
However, there is also concern that genetic research – including cell therapy research and
biobanking – will foster the use and disclosure of personal health and genetic information in a
way that could undermine protected privacy interests.50 Therefore, it is necessary to find a
balance between research interests and public interest implicated in the collection, use and
disclosure of protected personal information in the biobank context. Due to the public interest
component of biobank research a biobank governance structure is necessary and has to be publicly
accountable for its actions and decisions on those affected and involved. Good governance also
49 Eighth Circuit Clarifies Ownership of Research Specimens in Washington University v. Catalona, Pharmaceutical and Biotechnology Update, July 12, 2007, 1, online: <http://documents.lexology.com/60585210-35ab-4a93-a80a-2154b41c3da7.pdf> 50 See Timothy Cautfield et al, “Research Ethics Recommendations for Whole-Genome Research: Consensus Statement” (March, 2008) 6(3):e73. doi:10.1371/journal.pbio.0060073 PloS Biology, online: <http://www.plosbiology.org/article/info%3Adoi%2F10.1371%2Fjournal.pbio.0060073>.
16
requires transparency, and since its public function, “it seems appropriate that the public should
have access to how the system is run.” 51
2.2.1 Research Interest
The collection of living organisms and tissues has been carried out for many years. Initially
centered on their educational value, collections of human biological samples have increasingly
become part of medical research protocols. This activity was started, and then structured,
primarily in the hope of developing new diagnostic or therapeutic strategies, or for identifying
new genes involved in the development of disorders, eventually leading to the possibility of
medical intervention.52 Today, biobanks have been identified “worldwide as crucial research
infrastructures of great significance for medicine and public health”.53 Investigations of public
perceptions show clearly the public acceptance of biobanks and the “willingness to participate”
in biobank research.54 However, current research55 shows that people see participation in
biobanks as a risk and they have concerns about their private medical and biological data being
used against their interests. Some concerns are whether employers or insurance companies may
have access to this information. Participants’ expectation is that their samples and information
will be respected and protected. But while it is also important in creating interest of the
participants in the research undertaken by these biobanks, some may argue56 that it is helpful if
utilizing existing “community-academic partnerships and disease organizations” to learn about
51 Trudo Lemmens and Lisa Austin, “The End of Individual Control over Health Information: Promoting Fair Information Practices and the Governance of Biobank Research”, Governing Biobanks, Jane Kaye and Mark Strange (eds), (Farnham: Ashgate, 2009) 243-66 [Lemmens & Austin, 2009]. 52 [Rial-Sebbag & Cambon-Thomsen, 2012] supra note 45. 53 Herbert Gottweis, George Gaskell & Johannes Starkbaum, “Connecting the public with biobank research: reciprocity matters” (2011) 12(11): 738-9 Nature Reviews Genetics [Gottweis, Gaskell & Satrkbaum, 2011]. 54 Ibid at 738. 55 Beatrice Godard, Jennifer Marshall & Claude M. Laberge, “Community engagement in genetic research: results of the first public consultation for the Quebec CARTaGENE Project.” (2007) 10(3):147-58 Community Genetic. 56 Amy A. Lemke et al, “Public Biobank Participant Attitudes toward Genetic Research Participation and Data Sharing” (Aug 2010) 13(6): 368-77 Pub Health Genom [Lemke et al, 2010].
17
the most appropriate methods of reviewing, developing and disseminating genetic data and
sharing educational materials with their communities. Focusing on genetic research issues that
are relevant and of interest to a community will be important in “initiating dialogues and
developing partnerships”.57 The study also suggested that additional mechanisms that may lead
to greater transparency and public understanding could include: a) an assessment of the
accessibility of existing biobank policies for data sharing to the public; and b) development of
materials that are written at a general public literacy level.58
Although initially centered on the collection of data and eventually of blood samples, research
activity has been transformed by the discovery of DNA and by the development of techniques
enabling “better harvesting, preservation, and use of such biological material”. The eventual
goal for biobanks is either to produce scientific information (in particular genetic) which can be
used without any immediate medical application (for example, in population genetics), or to
generate information useful for the development of biological tests (including genetic tests)
which can be used in medicine, or to give rise to an understanding of disease mechanisms,
leading indirectly to medical intervention.59 The participation of the public is crucial and
maintaining their trust is essential. Therefore it is necessary to respect participants’ interest in
the research and promote their desire to be part of novel discoveries.
57 Ibid at 375. 58 Ibid. 59 [Rial-Sebbag & Cambon-Thomsen, 2012] supra note 45.
18
2.2.2 Sharing of Information
The importance of sharing information for the advancement of health research has become
increasingly well recognized because it helps to maximize the public benefit to be gained from
biomedical research.
Since biobanks are mostly publicly funded, funders of biobanks impose the obligation of data
sharing. In this case, the funding agencies require that beneficiary biobanks implement either a
data management or data-sharing plan prior to the release of funds. Usually these plans may
demonstrate how sharing will increase the significance of their research and benefit society and
outline the methods that will be used to share data and results.60 At the same time, funding
agencies also recognize the importance of certain restrictions on data sharing, particularly due to
privacy. As an example, in Chapter 4 we have discussed the TCPS in greater detail.
Rapid developments in genomics are widely promoted as being dependent on such resources,
which can be accessed by many researchers for different research uses. They also reduce
duplication of work, allowing researchers to share the financial burden of generating
fundamental data and tools. However, sharing of participants’ information with biobanks and
researchers needs to balance respect for participants’ fundamental rights such as privacy and
confidentiality with the public good. Biobanks as research structures require participants to collect
all the samples and information that will translate into research. There is a debate on how the
information should be shared and who should have access. The sharing of data and samples poses a
significant privacy concern, specifically, “that placing sensitive genetic information or data derived
from these materials in the public domain increases the possibility of misuse, especially for non-
60 [Ogbogu & Burningham, 2014], supra note 34.
19
research purposes.” 61 There is a need for implementing some restrictions to access the information.
Therefore, the sharing of samples or genetic information “cannot be left completely unregulated.”62
On the one hand, open access is offered for data that cannot be linked with other data to generate a
dataset that would uniquely identify an individual, while on the other hand a more controlled access
mechanism regulates access to certain, more sensitive data (e.g. detailed phenotype and outcome
data, and genome sequencing files).63 A publication by S. Fortin et al., summarized and highlighted
the following four access practices for controlling how information is shared: (1) broadening the
focus to data sharing, (2) creating an access committee to evaluate requests, (3) using contracts
to secure relationships with researchers, and (4) developing a customer service approach.64 The
sharing of information needs mechanisms in place to protect participants’ privacy and
confidentiality.
Another challenge in the sharing of samples and information is the increase in information crossing
borders. Each jurisdiction has its own legislation and regulations, so different protections are
provided in each of these jurisdictions. This issue has awakened a movement for the harmonization
of biobanking operational procedures and best practices. The goal is harmonization rather than
uniformity, a more flexible approach seeking the effective interchange of valid information and
samples. 65 However harmonization is only one aspect; there is also a need to promote and
implement the sharing of ethical principles and procedures as they relate to biobank activities, as
61 Ibid. 62 Yann Joly et al, “Data Sharing in the Post-Genomic World: The Experience of the International Cancer Genome Consortium (ICGC) Data Access Compliance Office (DACO) (July 2012) 8(7): DOI: 10.1371/journal.pcbi.1002549 PLoS Computational Biology, [Joly et al, 2012], online: <http://www.ploscompbiol.org/article/info%3Adoi%2F10.1371%2Fjournal.pcbi.1002549>. 63 Ibid. 64 Sabrina Fortin, et al, “Access Arrangements for biobanks: A Fine Line between Facilitating and Hindering Collaboration” (2011) 14: 104-114, p106 Public Health Genomics [Fortin, 2011], online: <http://www.ncbi.nlm.nih.gov/pubmed/20689244>. 65 Jennifer R Harris, “Towards a roadmap in global biobanking for health” (Nov 2012) 20 (11): 1105-1111 Eur J Hum Genet [Harris, 2012].
20
well as building public trust.66 There is public openness and support for the sharing of information
within the research communities. However, participants are more reluctant when there is industry
involvement and the possibility of an economic benefit to the company. This leads us to the subject
of benefit sharing which is also a very sensitive issue. Benefit from research results, especially
financial benefits, could be shared among participants, communities that take part in research,
researchers, and their institutions67. There is a substantial interest from the industry in this research,
so that generation of intellectual property and benefits over time is not unlikely. In terms of benefit
sharing, biobanks must strike a balance between many competing interests from various
stakeholders in the process.68 In addition to the sharing of information, it is important to define how
the information can be accessed and by whom. After the advances in genomics there has been a
trend to be able to publicly access the information to support the research, but the openness of the
information should be seen more carefully with the advances of the technology and the possibility of
re-identifying the information.
2.2.3 Open Access
The benefits of rapid, open data sharing in health research have been most clearly illustrated by
the Human Genome Project. During the development of the entire draft human genome
sequence, the data was shared on an ongoing basis, such that each sequence of 1,000 base pairs
was generally made public within 24 hours of being read.69 As a result of this new sharing, new
information on 30 disease genes was published before the genome draft was even completed.70
66 Ibid. 67 [Cambon-Thomsen, 2007] supra note 23 at 379. 68 Ibid. 69 Toronto International Data Release Workshop Authors, “Prepublication data sharing”, Nature 461, 168-170 (10 September 2009), [TIDRWA, 2009], online: <http://www.nature.com/nature/journal/v461/n7261/full/461168a.html>. 70 Ibid.
21
The scientific community, research funders and governments have time after time recognized the
importance of open access to genomic data for scientific research and medical progress, however
at the time of its origin sometimes the “open access policies were drafted and implemented
without consideration of privacy concerns”, although later modified to take such concerns into
account.71 Moreover, it has been justified as a matter of public interest, based on the argument that
research done with this information is for the “public good”. 72 Open access is becoming a well-
established practice for large-scale, publicly funded projects, particularly in the field of
genomics.73 For example, in the United Kingdom, the Wellcome Trust requires funded research
papers to be made freely available as soon as possible, and in any event within six months of
publication.74 In Canada, the CIHR policy requires researchers to deposit research data “into the
appropriate public database…immediately upon publication of research results.”75
Open access is important in the biobank context because (i) there is the idea that research funded
by the public should be accessible to that public,76 (ii) it promotes faster and wider dissemination
of results, and (iii) it increases economic and societal opportunities.77
However, an unregulated open data access could raise important concerns, and the main concerns
are related to the protection of privacy. This is associated with the continued growth of research
71 [Ogbogu & Burningham, 2014], supra note 34. 72 Ibid. 73 Peter Suber, “Ensuring Open Access for Publicly Funded Research” (2012) 345:e5184, BMJ, online: <http://www.bmj.com/content/345/bmj.e5184>. 74 Dave Carr and Robert Kiley, “Open access to science helps us all” The New Statesman (13 April 2012), online: The New Statesman <http://www.newstatesman.com/blogs/economics/2012/04/open-access-science-helps-us-all>; The Wellcome Trust, Open Access Policy, online: The Wellcome Trust <http://www.wellcome.ac.uk/About-us/Policy/Policy-and-position-statements/WTD002766.htm.> 75 Canadian Institutes of Health Research, CIHR Open Access Policy (1 January 2013), online: CIHR <http://www.cihr-irsc.gc.ca/e/46068.html> 76 Ibid. 77 [Ogbogu & Burningham, 2014], supra note 34.
22
involving health and other personal data, but also with the increase in new forms of research such
as genetic research, where participants are exposed to a privacy risk. For example, gene
sequencing studies or research involving genetic biobanks raises particular concerns about
revealing information that can be used against the interest of the research participants and their
family members, which could cause discrimination or may harm them psychologically. Scholars,
policy-makers and researchers have identified the privacy protection of study participants as the
main challenge to open genomic data sharing.
One of the problems with open access in genomic research is that data access is available not only
within the scientific research community, but also genomic sequencing information is accessible
to people outside of this community, i.e. those who are not subject to the same safeguards,
oversight and professional codes of conduct. Likewise, authorized individuals occasionally take
classified information outside of secure environments. Human gene data seems to be amazingly
useful and to be in huge demand, and is capable of being studied from a vast number of angles.
Sometimes there is a need for the sharing of such information with more people. Research projects
are frequently global in nature, involving teams with different types of expertise, such as
clinicians, laboratory staff and researchers. And the more people granted access to datasets, the
more likely it is that someone will decide that it is ethically imperative to share the data with
researchers outside of the secure vault.78
Requirements for the ethical management of research data have sought to balance the privacy of
data subjects with the benefits of research, utilizing anonymization and informed consent.
However, it is now unrealistic to promise participants in research projects absolute confidentiality
78 George Church et al, “Public access to genome-wide data: Five views on balancing research with privacy and protection”, (Oct. 2009) 5(10) PloS Genet, [Church et al, 2009], online: <http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2749921/>.
23
in relation to genomic data.79 The rise in the sheer number of available data sources, in both the
commercial and public sectors, coupled with the ease with which an individual’s DNA can be
(and is) analyzed, suggests that the context for released data has changed. Disregarding this takes
for granted the support of participants and the wider public for genomic research in a way that
could have damaging consequences for future scientific endeavors.80
Making data available maximizes the likelihood that the benefits of research will rapidly be
returned to society, but also maximizes the opportunity for breaching the duty of privacy to
research participants. One way in which people have attempted to reconcile these objectives has
been by making only aggregated genotype data publicly accessible on the Internet while
restricting access to data that reveals individual participants' genotypes.81
3 Mechanisms to Deal with the Issues
Informed consent remains a fundamental legal and ethical principle in health research and
historically has been used as the main tool to protect participants’ interests. The requirement that
researchers obtain informed consent from potential participants before research commences is a
fundamental principle of medical research, enshrined in the Declaration of Helsinki82 and
subsequent legal instruments. Informed consent engages the foundational principle of respect for
persons. As a legal principle, “it finds roots in common law as a waiver to the tort of battery
and negligence in medical, and in human rights law, as an express manifestation of the
79 Patric Taylor, “Personal genomes: when consent gets in the way”, Nature 456, (November 2008); 32-33. [Taylor, 2008] 80 [Church et al, 2009], supra note 78. 81 Ibid. 82 [Taylor, 2008], supra note 79
24
individual right to autonomy, liberty and human dignity.” 83 The consent of participants is
usually required before biobank samples can be used in research. But the nature of this consent,
and how it is obtained, vary widely.84 Informed consent requires individuals to know,
understand, and appreciate the nature and consequences of their inclusion in research, including
all the risks involved, before deciding whether or not to participate. While this concept may be
practicable in the context of individual research projects, such as clinical trials for example,
where the specific details of the trial must be firmly set out in the study design and protocol, it is
considerably more difficult to apply in the context of biobanks. Biological samples are not
persons but human materials, and a sample stored in a biobank involves no direct physical risk
to the donor once the sample has been obtained. However, biological samples without data 85
attached to them, such as medical records and social and environmental information, are not
very useful for research.86 The research time frame87 for projects using biobanks is much longer
than that of any individual project, and multiple uses – some still unknown – of biological
samples has become an expectation of biobank samples.88 Therefore, there is a need to adjust
the traditional consent to the specificity of biobanks. General information about the governance
of the biobank may be described at the time of recruitment and prospective data collection, but
one cannot predict with certainty how the biobank may evolve over the years or even decades,
83 Patricia Kosseim & Dara Jospe, “Banking for the Future: ‘Informing’ Consent in the Context of Biobanks”, paper submitted at the IV International Seminar on the UNESCO Universal Declaration on Bioethics and Human Rights, organized by the UNESCO Chair of Bioethics in the University of Barcelona and the Catalan Data Protection Authority, Jan 21, 2011, Barcelona, Spain, [Kosseim & Jospe, 2011] online: <http://www.priv.gc.ca/media/sp-d/2011/sp-d_20110121_pk_e.asp >. 84 [Kaiser, 2002], supra note 8 85 This information attached to the samples, which could include personal health information, raised questions related to the protection of the privacy and confidentiality of the donor. 86
The data might relate to a given individual (clinical data), to a family (genealogy information or ethnic origin) or to a group (geographical location of a population, or its language). 87 Some biobanks store the samples and the data for projects longer than 10-20 years, or for the lifetime of the individual, inclusive of after donors deceased. 88 [Rial-Sebbag & Cambon-Thomsen, 2012] supra note 45.
25
and specifics about future research projects that will make use of the biosamples and data in the
biobank are not yet known.89 90
Increasingly, academics, policy-makers and even legislatures have come to acknowledge the
practical difficulties of transposing a specific informed consent requirement from the traditional
medical research paradigm into the contexts of biobanks. As a result, “there has been a growing
movement away from a model of specific informed consent to one of broad consent.” 91 Broad
consent is a more general form of consent where individuals agree to have their biosamples and
personal information collected and stored in the biobank and used for future, unspecified
research. An example of how a broad consent may be inappropriate can be understood by
examining the case of the Havasupai tribe of Arizona who sued Arizona State University over a
genetic study conducted by its researchers. In this case, although the tribe had consented to the
collection of their DNA for research, they understood the purpose of such research was to
investigate the high incidence of type-2 diabetes among their tribe. It was only years later that
they learned their DNA samples were also being used to research other conditions, including
schizophrenia (a condition which they considered socially stigmatizing) and the geographic
origins of their tribe (research they found objectionable given their own traditional beliefs of
their ancestral origins). In this case, participants had signed a broad consent form, which
stipulated that their blood could be used to "study the causes of behavioral/medical disorders".
Using samples without complete informed consent and without permission from tribal members
was a major concern in the Havasupai lawsuit. However, most participants did not understand
89 [Kosseim & Jospe, 2011] supra note 83. 90 Mats G. Hansson, et al, “Should donors be allowed to give broad consent to future biobank research?” (Mar 2006) 7(3):266-9 Lancet Oncology, [Hansson et al, 2006] online: <http://www.ncbi.nlm.nih.gov/pubmed/16510336> 91 Bertha Maria Knoppers and Ma’n Abdul-Rahman, “Biobanks in the Literature”, Chapter 2 in Berenice Elger et al, (eds), Ethical Issues in Governing Biobanks, (Oxford: Asgate Publishing, 2008) 13-22.
26
this to mean research beyond diabetes. Stigmatization of the tribe was also a risk to the
Havasupai community, especially with respect to a component of the research focused on
“inbreeding”. Scientists used a statistical measurement called the “inbreeding coefficient” to
estimate how individuals within a population are similar to each other genetically.92 Ultimately
the university settled the suit for millions of dollars.93
Despite the challenge outlined above, broad consent has become a practical solution and is now
the norm for biobank recruitment. Participants are asked to consent to the use of samples and
data within a biobank at the time of collection 94 rather than to specific project types of research
as specified in traditional formulations of informed consent. However, some jurisdictions are
adopting laws or policies in support of broad consent, although subject to some conditions such
as: controlled access, anonymization of data, and approval by a research ethics board. The use
of broad consent has led to a heated debate within the bioethics community as to whether this is
ethically appropriate. Others suggest “layering the consent”. In this approach, a participant
could make choices, agreeing to allow a sample to be used in research on a specific disease or
requesting recontact for consent to any other research.95
General information about the governance of the biobank may be described at the time of
recruitment and prospective data collection. However, certainty about how the biobank may
evolve over the years or even decades cannot be predicted and specifics about future research
projects that will make use of the biosamples and data in the biobank are not yet known.
92 Therese Markow et al, “HLA polymorphisms in the Havasupai: evidence for balancing selection” (Oct, 1993) 53(4): 943-52 Am J Hum Gen, online: <http://www.ncbi.nlm.nih.gov/pmc/articles/PMC1682387/>. 93
American Indian & Alaska Native, Genetics Resource Center, “Havasupai Tribe and the lawsuit settlement aftermath”, online: <http://genetics.ncai.org/case-study/havasupai-Tribe.cfm>. 94 Herbert Hotweiss & Jane Kaye, “Biobanks for Europe- A challenge for governance”, Report of the Expert Group on Dealing with Ethical and Regulatory Challenges of International Biobank Research (European Commission, 2012) 45, [Hotweiss & Kaye, 2012], online: <http://ec.europa.eu/research/science-society/document_library/pdf_06/biobanks-for-europe_en.p>. 95 Caroline Trouet, “Informed consent for the research use of human biological materials” (2003) 22(3): 411-19 Medicine in Law [Trouet, 2003]
27
Consent should be regarded as valid until further notice. There should be a realistic opportunity
for withdrawal of consent for those who have donated identifiable samples and data, which can
be an issue with biobank-based research that can last for many decades. 96 The right to withdraw
consent does not imply a right to withdraw results that have already accumulated, rather it
implies that new data cannot be obtained and that existing data must be maintained in an
impersonalized form. When the right to withdraw consent at any time includes a realistic
practical possibility to exert this right, perhaps many decades after the original consent, no time
limits are needed in the original consent. 97 A person’s autonomy should remain a guiding
principle at the stage of informing individuals about the possible risks and benefits of their
participation in biobank-based research. Broad consent and consent to future research studies
are valid ethically and should be recommended for biobank research, provided that three criteria
are met: personal information related to the research is handled safely, donors of biological
samples are granted the right to withdraw consent, and every new study is approved by the
ethics review board.
There is a growing focus on the return of either research results or incidental findings to
participants in biobank research.98 This is based on the idea that advances within genome
sequencing increase the potential for producing data that research participants would find
valuable to access. Therefore it would be important to inform participants about such data and
to continuously provide them with the choice of whether or not to receive it. However, others
may argue that a “disclosure policy may easily shift the focus and expectations of research from
no direct personal gain to making return of individual research results the primary motivation
96 [Hansson, et al, 2006] supra note 90. 97 Ibid. 98 Susan M. Wolf et al: “Managing incidental findings and research results in genomic research involving biobanks and archived data sets” (2012) 14: 361–384 Genet Med.
28
for participation.” This might then enforce ideas of individualism and of “what’s in it for me”
even in aspects of human conduct relating to contributing to biomedical research.99 In any case,
from the perspective of “good governance practices” it will be desirable to leave to the
participant the decision of whether or not to receive back the results or any incidental
findings.100
A new informed consent approach is the “dynamic consent” model proposed by Jane Kaye.101
Dynamic consent seeks “engaging individuals about the use of their personal information”. It is
also an interactive personalized interface through a technology-based platform that allows
participants to engage as much or as little as they choose and to alter their consent in real time.
Rather than being restricted to the opportunity only to give broad consent to the use of their
samples and data, individuals could provide different types of consent depending upon the kind
of study.102 This approach as explained by Jane Kaye is “dynamic” because it allows
interactions over time; it enables participants to consent to new projects or to alter their consent
choices in real time as their circumstances change and to have confidence that these changed
choices will take effect.103 However, this new model requires overcoming some challenges
such as: (i) cultural change for both health-care professionals and individuals, and (ii)
development of new policies, standards and ways of working that can accompany this approach.
In addition, it must have the technical capacity to interface with the systems of the biobanks and
research organizations so it can provide information and feedback to participants. This requires
investment of resources such as time, money, and expertise. This model has been developed for
99 Kristin Solum Steinsbekk, Bjørn Kare Myskja & Berge Solberg, “Broad consent versus dynamic consent in biobank research: Is passive participation an ethical problem?” (Sep 2013) 21(9): 897–902 Eur J Hum Genet [Steinsbekk, Myskja & Solberg, 2013]. 100 Ibid. 101 Jane Kaye et al, “Dynamic consent: A patient interface for twenty-first century research networks”, (Epub ahead of print, May 2014) Eur J Hum Gen, online: <http://www.nature.com/ejhg/journal/vaop/ncurrent/pdf/ejhg201471a.pdf >. 102 Ibid. 103 Ibid.
29
biobanking in the EnCoRe104 and CHRIS105 projects for biobanks. Informed consent cannot on
its own provide complete protection for participants. However, some dilemmas related to the
above consents can be addressed through a good governance system. Governance mechanisms
and legal concepts are needed to deal with the issues described above. It is critical for the future
of biobanks to establish governance regimes and a regulatory framework that will appropriately
link research with societal concerns and politics.
3.1 Governance
Biobank governance may not be seen as an ethical or legal issue as such, but it can be an
effective way to address ethical, social and political issues.106 Biobanks need a governance
framework that will help to establish order to accommodate the wide range of individual and
infrastructure concerns. Biobank governance is still evolving and it is critical for the future of
biobanks to establish governance regimes that appropriately connect research with society and
politics. The main challenge in the creation and operation of biobanks seems mainly in how to
deal adequately with potential issues involving informed consent, personal integrity, self-
determination, confidentiality and non-discrimination,107 as well as the need to have in place
adequate scientific and ethical oversight at the time of the creation of a biobank. Also it is
important that throughout the project there is ongoing monitoring, independence of the oversight
authority and efficiency of its control powers including sanctions.108 The “success and failure”
104 EnCoRe/Oxford Radcliffe Biobank (UK), online: <http://www.publichealth.ox.ac.uk/helex/projects/about/research-projects-1/dynamic-consent-project> 105 CHRIS- Cooperative Health Research in South Tyrol (Italy). Online: <http://www.eurac.edu/en/research/institutes/centerofbiomedicine/CHRISstudy/default.html> 106 Herbert Gotweiss, “Biobank governance: Trends and perspectives” (2007) 74(4):206-11 Pathobiology [Gotweiss, 2007]. 107 Ibid. 108 [Cambon-Thomsen , 2007] supra note 23 at 379.
30
of biobank projects will depend on “their integration into the social and political sphere.”109
Therefore, biobank governance offers more than just technical challenges.110 “Biobank
governance is a key aspect: (a) to protect the rights and welfare of research participants, (b) to
demonstrate respect for research participants and (c) to promote ethically responsible
research.”111 The importance of a good governance system lies in how it helps to weigh the risk
to privacy or the difficulty in obtaining consent against the potential benefits.
3.1.1 Importance of Governance
Historically the academic debate tends to focus on informed consent as the mechanism to
protect the participants, leaving most of the participants’ concerns unattended. An emerging
dilemma that has arisen in the context of biobanks is whether the technological advances that
threaten the participants’ privacy can be addressed through informed consent, or whether there
is a need to shift the concentration in the informed consent – as the only vehicle to protect
participants’ privacy to achieve proper biobank governance– to the establishment of proper
governance systems for this research infrastructure. Scholars like Lisa M. Austin and Trudo
Lemmens have argued that:
“…specific research uses of research samples and associated data in the biobank do not necessarily require informed consent but do require a governance structure that can regulate privacy risks such as the risk of re-identification… In our conclusion we suggest that the legal and ethical debates regarding biobanking must shift from an obsession with consent and focus more closely on the elements of good governance in order to move away from compromises and back to the principled protection of research subjects.”112
109 [Gottweis, 2012] supra note 7. 110 [FRSQ, Final Report, 2006] supra note 22. 111 Jim Vaught & Nicole C. Lockhart, “The Evolution of Biobanking Best Practices”, (Oct 2012) 413(19-20):1569-75 Clinica Chimica Acta at 1571 [Vaught & Lockhart, 2012]. 112 Lisa Austin and Trudo Lemmens, “Privacy, Consent and Governance”, New Challenges for Biobanks: Ethics, Law and Governance, in Kris Dierickx, Pascal Borry (eds) (Antwerp: Intersentia, 2009), chapter 9, 111-21 [Austin & Lemmens, 2009].
31
In addition to the participants’ informed consent, for biobanks to give access to their data and
biological materials to researchers, each biobank needs to develop and implement through their
governance a set of conditions in order to protect the information and biological materials
deposited. These conditions must include any requirement necessary to: i) comply with the
applicable law; ii) promote the availability of scientific results to the widest audience, and iii)
facilitate access to samples and data for research purposes. While biobanks are based in a given
jurisdiction, the researchers who use them might be located elsewhere. Increasingly, research is
conducted at a global level, often involving large international research collaborations that pool
and share samples and data. As a result, the exchange of data and samples can be done with
different levels of protection. Biobanks can emerge out of such collaboration, or be used as a
basis for research carried out by these consortia.113
The design and development of policies and procedures play important roles in biobank
governance, since the SOPs develop in more detail the governance of the biobank. Some
biobanks may use Standard Operating Procedures (SOPs), however the following are
further policies used for biobank governance:
(i) Policies and processes that seek to monitor and respond to re-identification
risks, including but not limited to, controlled access mechanisms;
(ii) Institutional sharing policies addressing privacy protections for associated
clinical health information collected with human biological material;
(iii) Information access control; and
113 [Hotweiss & Kaye, 2012], supra note 94.
32
(iv) Developing and revising consent forms, obtaining and withdrawing
consent.114
In the absence of a regulatory system, one common and effective solution has been to use SOPs.
For example a comprehensive set of biobanking SOPs was developed by the Canadian Tumour
Repository Network (CTRNet).115 These SOPs are intended to ensure its member
biorepositories maintain compliance with the ethical principles and standards outlined in
CTRNet’s policies, as well as meet international norms, policies, and guidelines in order to be
able to participate in research abroad (e.g. Declaration of Helsinki116, Food and Drug
Administration117, and International Conference of Harmonization118).
Some may argue that the policy-driven phenomenon is an effective approach and can be used as
an alternative to law. Graeme Laurie argues that a policy of reflexive governance can best meet
the challenges faced by many biobanks and does not require the use of legal instruments.119 The
reflexive governance is premised on the principles of integrity of purpose, proportionality of
action and reflexivity of approach, whereby mechanisms are developed to permit biobanks to
operate despite uncertainty and to adapt with time to ensure “good governance”, defined as:
i) designing in interoperability with respect to scientific and governance approaches;
ii) designing-out approaches that are restrictive of sharing, cooperation, flexibility and
mutuality;
iii) establishing policies and procedures to promote actively the use of the resource in
keeping with its original purpose;
114 Canadian Tumour Repository Network, Standard Operating Procedures, online:< http://www.ctrnet.ca/operating-procedures>
115 Rebecca Barnes et al, “Generating a comprehensive set of standard operating procedures for a biorepository network-The CTRNet Experience (Dec 2013)11(6): 387-96 Biopreservation and Biobanking. 116 World Medical Association. Declaration of Helsinki; 1964 (with 1975,1983,1989,1996,2000,2002,2004 and 2008 amendments). 117
USA Food and Drug Administration. FDA Code of Federal Regulations, Title 21, Part 50: Protection of Human Subjects;1981. 118 International Conference on Harmonisation (ICH). Good Clinical Practice (GCP) Guidelines; 1995. 119 Laurie Graeme, Reflexive governance in biobanking: on the value of policy led approaches and the need to recognize the limits of law. Hum Genet (2011) 130: 347-356. [Graeme, 2011], Online: <http://www.ncbi.nlm.nih.gov/pubmed/21766192>
33
iv) ensuring the longevity of the biobank through carefully managed access policies and
arrangements and stewardship of the resource; and
v) ensuring that governance policies and mechanisms remain fit for their purposes over
time.120
This proposed approach considers within its operation the development of scientific endeavor
while encouraging cooperation and compliance, and it is dependent on those governed and those
governing being receptive and open.121
Although these initiatives, whether SOPs or other policy approaches, are intended to develop
a comprehensive set of rules for self-governance, not all Canadian biobanks have been able to
take this approach. There are still incomplete and/or informal biobanking procedures that do not
meet applicable laws and international standards to secure the privacy of participants.122
Furthermore, such incomplete and/or informal biobanking procedures are not usually available
or disseminated publicly, and currently there is no statutory obligation to do so. The reason for
this lack of policies and procedures is sometimes because the development of policies and SOPs
requires a commitment to invest large amounts of time and resources, including often unstable
funding, that not all biobanks can manage.
Governance plays a crucial role in addressing the social and ethical challenges of biobanking. It
remains pivotal to maintaining public support and financing, and ensuring the security and
protection of participants, respect for cultural perspectives and the availability of biospecimens
and data for research. Moreover, proper governance is a key aspect to the success of a biobank,
120 Ibid.
121 Ariane Mallette & Anne Marie Tasse, P3G Model Framework for Biobank Access Policy: Core Elements, (Public Population Project in
Genomics and Society, 2013), [Mallete & Tasse, 2013], online: <http://www.p3g.org/system/files/biobank_toolkit_documents/P3G%20Core%20Elements%20Access%20Policy%20Final%20Dec%202013.pdf> 122 Ibid.
34
and one important and vital avenue for biobanks to maintain and honor public trust.123Also
governance is important to connect biobanks with individuals in a socially, politically and
ethically acceptable manner.124 Nonetheless, few efforts have defined what constitutes a proper
governance framework in practice. Without a proper governance framework, population
biobanks may unduly add multiple layers of oversight125, limiting their ability to conduct
research and their overall utility as well as their ability to ensure the privacy of participants.
Various theoretical approaches to governance have been advanced, considering the changing
nature of post-genomic medical research and the growing need for global research networks,
notably e-governance, reflexive governance and anticipatory governance.126
As stated by Jane Kaye, the benefit of a relevant and appropriate governance system is in tune
with social expectations if:
“It promotes certainty and efficiency as people know what the rules are, what
happens, and when. It can ensure uniformity and equality- that things are done in a
uniform way with everyone and the same issues being treated the same. Such a
system enables problems to be anticipated as there are mechanisms to deal with
the routine issues but unanticipated situations can also be resolved efficiently.
Having a governance system in place ensures that ethical and lawful research is
supported through accountable and transparent decision-making. This not only
protects the integrity of the research community but also has the promoting public
confidence and trust.” 127
123 [Gottweis, 2012] supra note 7. 124 Ibid. 125 Susan Wallace et al, “Governance Mechanisms and Population Biobanks: Building a Framework for Trust” (2008) 6(2): 1-11 at 3 GenEdit [Wallace et al, 2008]. 126 [Mallete, Tasse & Knoppers, 2013] supra note 121. 127Jane Kaye, “From single biobanks to international networks: developing e-governance” (2011) 130(3): 377-382 Hum Genet [Kaye, 2011], online: < http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3155683/>.
35
Providing clear and transparent procedures makes biobanks more accountable for their work. In
addition, the public and participants are more involved in the process and have a better
understanding of what biobanks are doing with their samples and information. But we may ask
ourselves, why is it so important to have good governance practices within these research
structures?
3.1.2 Characteristics of Good Governance
For the purpose of this thesis it is important to understand the principles that should apply to a
“good governance” system to assess the adequacy of the current biobanking regulatory
framework, and for formulating defensible, pragmatically acceptable recommendations for
future reform.
Therefore, the main purpose of this chapter is to respond to the question: What are the principal
qualities or attributes that “good” regulatory systems, policies and practices should have?
Numerous sets of principles have been proposed around the world, for example at the
international level those prepared by the Organization for Economic Co-operation and
Development (OECD).128 In Canada the Fonds de la Recherche en Sante du Quebec (FRSQ)
Advisory Group, through a final report for the “Governance Framework for Data Banks and
Biobanks used for Health Research”, 129 recommended among others the following principles:
128 See, eg: The Organisation for Economic Co-operation and Development (OECD), “Recommendation of the Council of the OECD on Improving the Quality of Government Regulation”, Creation and Governance of Human Genetic Research Databases (Paris: OECD, 1995), online: <http://www.oecd.org/officialdocuments/publicdisplaydocumentpdf/?doclanguage=en&cote=OCDE/GD(95)95>.; The Organisation for Economic Co-operation and Development (OECD), “Guiding Principles for Regulatory Quality and Performance”, Creation and Governance of Human Genetic Research Databases, (Paris: OECD, 2005), [OECD, 2005], online: < http://www.oecd.org/fr/reformereg/34976533.pdf >. 129 [FRSQ, Final Report, 2006] supra note 22.
36
(i) Accountability: The biobank shall guarantee that data and biological material entrusted to it
will be handled properly.
(ii) Continuing staff training: Biobank staff receive continuing training that covers
confidentiality, free and informed consent, secure storage methods, relevant technological
innovations, legitimate access to data and biological material, governing laws, existing
administrative standards, internal bank policies, and so on. That training is intended chiefly to
produce and sustain a vibrant ethics culture among bank staff.
(iii) Mandatory approval by a competent REB
The competent REB works within its designated jurisdiction to approve and monitor the
creation of all new banks. An REB’s terms of reference embrace both research projects and the
creation of banks as research infrastructures. Every research project involving human subjects
must have the prior approval of an REB.
(iv) Determining the research objectives
When applying for funding, researchers should present a proposal, a written description of the
purpose of the research to be done. This research proposal will require ethics approval from the
respective REB, and in some cases other biobank committees will assess and approve the
project in order to gain access to the samples and information. The objectives may be specific as
well as general. Researchers must justify the desired access based on the expressed objectives.
(v) Determining the need for a free and informed consent
Free and informed consent is a basic instrument for the protection of research subjects.
It should be considered of paramount importance where data banks and biobanks are concerned.
37
(vi) Obtaining free and informed consent, as needed
Consent must be obtained in a way that respects the freedom and enlightened decision of the
potential subject. The practical conditions for expressing consent determine whether the
potential subject espouses the proposed objective.
Consent is a continuing process and includes the right to withdraw. However, the potential
subject must be informed that it is impossible in practice to withdraw data or biological material
which is anonymous or has been anonymized.
Consent must be renewed in the event of significant changes in the research initiative, banking
agreement or bank governance framework.
(vii) Storage of data and biological material, and confidentiality protection.
The storage of data and biological material requires appropriate human skills and technology.
Organizational, technological and physical security measures are used to safeguard the
confidentiality of data and biological material. The bank establishes clear policies to manage
collection, storage and access.
(viii) Access to personal information
All individuals have the right to access information which pertains to them. They can challenge
the accuracy of such data and make any changes they deem appropriate. At their request, the
bank is bound to inform them of the use being made of their data, e.g. the fact that their
information has been communicated to other persons.
(ix) Transparent management of data and biological material
The general public, and research subjects in particular, must have easy access to information
concerning the principles, policies and practices of the bank.
38
(x) Grievances
The bank appoints a person to enforce the laws, as well as the bank’s principles and policies.
Grievance management is straightforward and readily available. Anyone connected with the
bank is entitled to lodge a grievance alleging non-compliance with those laws, principles or
policies.
(xi) Sharing and confidentiality protection
Banks that entrust data or biological material to organizations outside their province must ensure
that those organizations can match the confidentiality protection provided in their province. The
banks shall also ensure that data and biological material are used in accordance with the
conditions indicated in the consent form.
As mentioned in the previous chapter the protection of information is one of the most sensitive
issues and remains an issue of great concern for the public and their attitudes towards biobanks.
When we talk about a good governance system, of particular importance is how biobanks
prevent possible misuse of data, and protect the privacy of the participants. As outlined above
one example of good governance practice is continuing staff training. In the Canadian context
there is a recent initiative by the Canadian Tumour Repository Network (CTRNet). The CTRNet
has implemented a certification program to communicate common standards to harmonize
biospecimen quality and approaches to governance, in conjunction with simultaneous exposure
to education focusing on the rationale and foundations underlying these standards.130 The
CTRNet certification program comprises registration and certification steps as two linked
130 Elizabeth AM Matzke et al, “Certification for Biobanks: The Program Developed by the Canadian Tumour Repository Network (CTRNet)” (Oct 2012) 10(5): 426-32 Biopreserv Biobank.
39
phases. In the registration phase, launched in November 2011, biobanks are registered in the
system and individuals complete an introductory educational module. In the subsequent
certification phase, the type of biobank is classified and assigned relevant educational modules
and adoption of relevant standards of practice is confirmed through review of documentation
including policies and protocols that address the CTRNet Required Operational Practices
(ROPs). An important feature of the program is that it is intended for all types of tumor
biobanks, so the scope and extent of assessment is scaled to the type of biobank. This program
aims to provide an easily adoptable and flexible mechanism to communicate common standards
through education and address both quality assurance and governance across the broad spectrum
of biobanks.
Furthermore, good governance practices should require informing participants in detail about
the mission of a particular biobank, its funding and governance structures, and what it hopes to
achieve. While such an initial disclosure statement on the side of the biobank would regularly
include disclosure of research questions and contexts that the biobank supports at the time of
recruitment, it should also include a statement that the biobank – and thus the samples and data
of the participant – may be used to serve research that cannot yet be envisaged, and that
appropriate research ethics approval will be obtained wherever laws and regulations require
this.131 The process of recruiting consenting participants of biobanks context needs to be
adapted to these kinds of novel structures. While biobanks are aware that the future uses of the
information and samples collected are not fully determined by the time of consent being given,
participants need to be informed as much as possible of the possibilities that the biobank can
foresee. As well, they need to provide full disclosure to participants that include enough
131 Barbara Prainsack & Alena Buyx, “Solidarity: Reflections on an emerging concept in bioethics”, (London: Nuffield Council on Bioethics, 2011) 331-344.
40
information to enable participants to make the decision, with an explicit note that the list may
not be exhaustive. If we recall the case presented in this chapter, the conflict between the
Havasupai Indians and Arizona State University, where the participants had signed a broad
consent form, this type of lack of information could be resolved in the manner as stated above,
i.e., by providing more context to the participants of the scope of research that can be done, and
moreover explaining the possibility of unknown future research uses, so the participants can
make informed decisions. However, consent must be renewed in the event of significant
changes in the research initiative, or the bank governance framework.
Informed consent has been a core element in the area of research, but it cannot stand alone
anymore. Informed consent needs a governance system that as a whole supports and protects
the donors’ interests and rights at stake.
3.2 Legislation
In order to lay the foundation for understanding and critically evaluating the current legal
framework applicable to biobanks in Canada, I have divided this section into two subsections:
(i) an identifying and examining of applicable common law; and (ii) providing a review of
applicable privacy legislation in the biobank context.
There is an absence of biobank specific federal law in Canada. No federal law addresses either
the collection of biological material for biobank activities or the secondary use of biological
material. In contrast, privacy legislation that could address some aspects of biobanks comprises
various federal, provincial, and territorial statutes and regulations, professional codes of
41
conduct, guidelines, standards, common law, and constitutional law.132 Indeed, the protection of
health information is addressed differently in every provincial jurisdiction across Canada, and
the federal laws that could impact biobanks (e.g., the Privacy Act and the Personal Information
Protection and Electronic Documents Act (PIPEDA)) offer limited applicability.133
In Canada, due to the constitutional division of powers, jurisdiction over health and information
is shared between the federal government and the provinces/territories. The Constitution Act,
1867 allocated marine hospitals and quarantine to the federal government134, whereas the
provinces were assigned power over “the Establishment, Maintenance, and Management of
Hospitals, Asylums, Charities, and Eleemosynary Institutions in and for the Province, other than
Marine Hospitals”.135 The provinces pursuant to this power assumed most health matters over
hospitals as well as power over poverty and civil rights and matters of a local or private nature.
This division still exists, with federal jurisdiction over quarantine being interpreted to apply only
to ingress and egress into and out of Canada.136 The Canada Health Act137was not an assertion
of federal jurisdiction over health matters; rather, it invoked federal spending power to gain the
participation of the provinces/territories in a program of Medicare for hospitals and medically
necessary physician services.
Respect for privacy is a constitutional principle in Canada. The development of the concept and
categories of privacy interests have been largely driven by the Canadian Charter of Rights and
132 Edward S. Dove, et al, “Privacy in Canadian Paediatric Biobanks: A Changing Landscape. A Report Delivered to the Office of the Privacy
Commissioner of Canada”, Centre of Genomics and Policy (REVISED 1 August 2011), [Paediatric Report, 2011], online: <http://www.pediagen.org/ressources/Privacy_in_Canadian_Paediatric_Biobanks.pdf>. 133 [PIPEDA] supra note 16. 134 (U.K.), 30 & 31 Vict., c. 3, s 91(11). 135
Ibid, s 92 (7). 136
See, e.g., Quarantine Act, s.c. 2005, c. 20. 137
Canada Health Act, R.S.C 1985, c C-6.
42
Freedoms (Canadian Charter).138 Two provisions in the Canadian Charter have been interpreted
as protecting a person’s privacy. Firstly, in section 7, which guarantees everyone “the right to
life, liberty and security of the person”, has been interpreted to include the right to be free of the
psychological stress resulting from unauthorized disclosure of one’s personal health
information. Secondly, section 8, which grants the “right to be secure against unreasonable
search or seizure”, includes the protection of an individual’s informational privacy. In this
regard, the Supreme Court of Canada has stated, “…what is protected by s. 8 is people not
places or things. The principal right protected by s. 8 is individual privacy, and the provision
must be purposively applied to that end.”139 However, to date there has not been presented in
the Canadians courts any challenge to the Canadian Charter invoking the privacy principle in the
biobank context.
In addition to the constitutional principle of respect for privacy, two federal privacy laws protect
Canadians. The Privacy Act, which covers the personal information-handling practices of the
federal government, and the Personal Information Protection and Electronic Documents Act
(PIPEDA) is Canada’s private sector privacy law.
Then, every province and territory also has privacy legislation governing the collection, use and
disclosure of personal information held by government agencies. These acts provide individuals
with a general right to access and correct their personal information. Oversight is through either
an independent commissioner or ombudsman authorized to receive and investigate
complaints.140 Although health information is based in statute, some significant areas are carved
138 Canadian Charter of Rights and Freedoms, Part 1 of the Constitution Act, 1982, being Schedule B to the Canada Act 1982 (UK) 1982, c. 11. 139 R v Colarusso [1994] 1 SCR 20 at 60, see also R. v Plant [1993] 3 SCR 281 at 293. 140 Office of the Privacy Commissioner of Canada official website.< https://www.priv.gc.ca/faqs/index_e.asp#q002>
43
out in common law. In the next section I will give an overview of some concepts related to the
biobank context as addressed in common law.
3.2.1 Common Law
Common law is well beyond the scope of this thesis, but while it is worth noting that no Canadian
court has ruled directly on biobank activities, we may find some important aspects and concepts
related to these research structures within the Canadian common law, such as privacy,
ownership and informed consent.
Canada has yet to fully recognize a distinct common law right to privacy.141 There have been
courts recognizing a common law tort action for invasion of privacy but also there is provincial
variation of the recognition. Common law in Canada has been reticent to establish a right to
privacy protection more generally. At present, a handful of trial level decisions in Ontario have
found the existence of a common law tort of invasion of privacy.142 Thus far, these cases have
primarily concerned invasions that may be described as forms of harassment as opposed to
violations of the protection of information.143
Regarding personal health information, both common law and statutes have adopted the concept
of custodianship or trusteeship when a patient’s health information is being held by another
party whether by a healthcare provider, hospital, long term care facility, research centre or
department of health. The property or ownership model has been considered at common law and
ultimately rejected by the Supreme Court of Canada.
141 Lisa M. Austin, Privacy and Private Law: The Dilemma of Justification, (Montreal: McGill LJ, 2010) at 55. 142 MacKay v. Buelow, [1995] O.J. No. 867 (Gen. Div.) (QL). 143 Elaine Gibson, Is There a Privacy Interest in Anonymized Personal Health Information (University of Alberta, Health Law Institute, Special Edition 2003), 97.
44
The Supreme Court weighed into the matter of ownership and custodianship of health
information in its 1992 judgment in McInnery v. Mac Donald,144 a case involving a patient’s
right to access her own health information. This case was decided in the absence of New
Brunswick legislation addressing the issue of access. With respect to informed consent being a
physician’s duty, the Supreme Court of Canada established the obligation of disclosure that
required physicians to provide the information necessary for patients to act as autonomous
decision-makers. The decision reflected an advance in the patients’ role in having more control
over their own health care and a desire to move away from the paternalistic approach that had
previously characterized the doctor-patient relationship.
The issue of informed consent in a medical negligence action was addressed by the Supreme
Court of Canada in the landmark cases of Hopp v. Lepp145 and Reibl v. Hughes.146
Empowerment of patients through disclosure was the foundation of the Supreme Court’s
decision. Patients must possess sufficient information about their treatment to enable them to
decide whether or not to participate, thereby exercising autonomy. Patients require a full
understanding to be able to assess the proposed treatment in light of their values, beliefs, goals
and circumstances.
It was the Reibl judgment that introduced the doctrine of informed consent into Canadian law.
Building on his reasons in Hopp v. Lepp, Laskin C.J., writing for a unanimous court, confirmed
that the relationship between a doctor and a patient undoubtedly gives rise to a duty of the
doctor to disclose material risks associated with a procedure, without having to be questioned by
the patient. Thus, the traditional standard of disclosure, that is, what a reasonable physician
144 [1992] 2 S.C.R. 138 [McInerney]. This case was also discussed in section 1.1.3 Control over the data and samples. 145 Hopp v. Lepp, [1980] 2 S.C.R. 192. 146 Reibl v. Hughes, [1980] 2 S.C.R. 880.
45
would disclose, was replaced with the standard of what a reasonable patient would want to
know.
However, these cases refer more particularly to the context of a specific procedure, but we may
ask if this interpretation can be extended to the individual’s right to determine what shall be
done with his own body.
3.2.2 Privacy Legislation
Since personal health information is legislated in Canada on a provincial/territorial level,
significant differences in coverage arise, depending on one’s jurisdiction. However, not all
legislation is provincial. Since 1983 there has been federal legislation governing personal
information held by the federal government and its agencies. Also there is PIPEDA, which will
be discussed later on in this chapter.
3.2.2.1 Federal
(i) The Privacy Act147and its companion Access to Information Act apply to personal
information collected, used, retained or disclosed by the federal public sector. In this Act,
personal information is defined as “information about an identifiable individual that is recorded
in any form”.148
(ii) Personal Information Protection and Electronic Documents Act149 (PIPEDA)
The fact that jurisdiction over both health and information rests primarily with the provincial
governments has not prevented the federal government from enacting legislation governing
147 [Privacy Act, 1985] supra note 15. 148 Ibid, s. 3. 149 [PIPEDA] supra note 16 at s. 2(1).
46
information management, most notably PIPEDA, to give individuals control over the collection,
use and disclosure of their personal information. The federal government had to rely on its trade
and commerce clause, so the legislation only applies to the commercial sector.
Since January 1st, 2004, PIPEDA has regulated information crossing provincial boundaries and
also intra-provincially in provinces that do not have legislation declared by the Governor in
Council to be “substantially similar”150 to PIPEDA in providing information protection. In
summary, in provinces with legislation declared “substantially similar”, PIPEDA applies only to
information going into and out of the province and to information collected, used or disclosed in
connection with the operation of a federal work, undertaking or business, but not to other
information kept within the province. 151 Then, organizations that are subject to provincial
legislation deemed substantially similar are exempt from PIPEDA with respect to the collection,
use or disclosure of personal information occurring within the respective province. Some
provincial laws that have been deemed substantially similar include British Columbia‘s
Personal Information Protection Act152 and Ontario’s Personal Health Information Protection
Act (In the case of Ontario only with respect to health information).153
Since January 1st, 2004, it has been in force for information crossing provincial boundaries and
also intra-provincially in provinces that do not have legislation declared by the Governor in
Council to be “substantially similar” to PIPEDA in providing information protection. In
150 On August 3, 2002, Industry Canada published the Process for the Determination of “Substantially Similar Provincial Legislation by the Governor in Council. Under the policy, laws that are substantially similar: provide privacy protection that is consistent with and equivalent to that found under PIPEDA; incorporate the ten principles in Schedule 1 of PIPEDA; provide for an independent and effective oversight and redress mechanism with powers to investigate; and restrict the collection, use and disclosure of personal information to purposes that are appropriate or legitimate. 151 [Elaine Gibson, 2007] supra note 154 at 233. 152 Personal Information Protection Act [SBC 2003] Chapter 63. 153 Personal Health Information Protection Act. S.O. 2004,[PHIPA].
47
summary, in provinces with legislation declared “substantially similar”, PIPEDA applies only to
information going into and out of the province and to information collected, used or disclosed in
connection with the operation of a federal work, undertaking or business, but not to other
information kept within the province. 154
PIPEDA covers solely personal information, defined as “information about an identifiable
individual, but does not include the name, title or business address or telephone number of an
employee of an organization”.155
However, this Act also includes a detailed definition of personal health information.156 For the
biobank context it is important to note that the definition of personal health information is broad
enough to apply to a deceased individual, and information relating to body parts or substances,
but does not include the samples themselves.157 This will be in effect as long as the collection
used or disclosed is “in the course of commercial activity.”
As noted by some scholars,158 unless the governance model clearly divides roles and
responsibilities and creates a clear management structure, and a well-documented funding
source, determining whether a biobank falls under public sector or private sector privacy
154 Elaine Gibson, “Health Information: Confidentiality and Access,” in T. Caulfield, J. Downie, and C. Flood (eds), Canadian Health Law and Policy, 3rd ed., (Canada: LexisNexis, 2007) Chapter 5, 233 [Elaine Gibson, 2007] at. 233. 155 [PIPEDA] supra note 16 at s. 2(1). 156 In [PIPEDA] supra note 16 at s. 2(1) is defined “personal health information'', with respect to an individual, whether living or deceased, means: (a) information concerning the physical or mental health of the individual; (b) information concerning any health service provided to the individual; (c) information concerning the donation by the individual of any body part or any bodily substance of the individual or information derived from the testing or examination of a body part or bodily substance of the individual; (d) information that is collected in the course of providing health services to the individual; or (e) information that is collected incidentally to the provision of health services to the individual. 157 [Elaine Gibson, 2007] supra note 154 at 234. 158 [Paediatric Report, 2011], supra note 132.
48
legislation is a challenge. This challenge has not gone unnoticed by CIHR159, which has
remarked:
“...the activities of health researchers themselves will be difficult to categorize as either commercial or non-commercial in nature. Increasingly, academia, private sector, voluntary charitable organizations and government are joining forces to engage in innovative research partnerships and to transform this new knowledge into forms, which are beneficial to the population. In an era where such partnerships are actively encouraged, a whole spectrum of public-private arrangements have begun to emerge.” 160
For example, it is unclear whether PIPEDA, a commercial activity statute, applies to biobanks in
hospitals or universities since the main purpose of such institutions is research which is not
commercial in character. 161
3.2.2.2 Provincial
There are a number of different kinds of provincial/ territorial legislation impacting directly on
health information. Some provinces have enacted health-information-specific legislation. Others
have legislation that covers personal information in the private sector, including health
information. All have legislation governing information in the public sector, which may include
hospitals and extended care facilities.162
A number of provinces have enacted legislation that deals exclusively with health information.
These provinces are Manitoba163, Alberta164, Saskatchewan165, Ontario166, Newfoundland and
Labrador167, and New Brunswick168.
159 Ibid. 160 Canadian Institutes of Health Research, Personal Information Protection and Electronic Documents Act: Questions and Answers for Health Researchers (Ottawa: Public Works and Government Services Canada, 2001) at 8. 161 [Paediatric Report, 2011] supra note 134 at 19. 162 [Elaine Gibson, 2007] supra note 154 at 236. 163
Personal Health Information Act, CCSM 1997 c P33.5. 164 Personal Information Protection Act, SA 2003, c P-6.5 and Health Information Act, RSA 2000, c H-5. 165 Health Information Protection Act, SS 1999, c H-0.021.
49
The primary aim of these statutes is to provide for the protection of personal health information
being collected, used, stored or disclosed by an entity other than the individual who is the
information source. Personal health information or, in the case of Alberta, individually
identifying information, is defined in various ways in the legislation. Some, including the
Ontario Act dealing with personal health information, may include information with respect to
the donation of body parts or body substances. In Manitoba, the Manitoba Act limits personal
health information only to recorded information.169 An example of health information privacy
legislation that has been used in the context of biobanks is the Ontario PHIPA. Under this act it
is voluntary for biobanks to register as “prescribed persons” in order to receive personal health
information from health information custodians.170 For example, one “prescribed person” is the
Ontario Institute for Cancer Research’s Ontario Tumour Bank (OTB) under paragraph 39(1)(c)
of Ontario’s PHIPA. As a result, the OTB is entitled to collect, use, and disclose personal health
information171 without consent strictly “for the purpose of facilitating or improving the
provision of health care, or that relates to the storage of donation of body parts or bodily
substances.” The “prescribed person” statutes make it easier for the OTB to enrich its databases
166 [PHIPA] supra note at 153. 167 Personal Health Information Act, SNL 2008, c P-7.01. 168 Personal Health Information Privacy and Access Act, SNB 2009, c P-7.05. 169 Personal Health Information Act, C.C.S.M. c P33.5, S 1(1). 170 Defined in section 3 of the Ontario’s PHIPA as a person or organization described in s. 3 who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work, such as a health care practitioner or a hospital. 171 In accordance with s. 4 Ontario’s PHIPA means: identifying information about an individual in oral or recorded form, if the information,
(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family, (b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual, (c) is a plan of service within the meaning of the Home Care and Community Services Act, 1994 for the individual, (d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual, (e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance, (f) is the individual’s health number, or (g) identifies an individual’s substitute decision-maker. 2004, c. 3, Sched. A, s. 4 (1); 2007, c. 8, s. 224 (6); 2007, c. 10, Sched. H, s. 2.
50
with valuable follow-up information such as patient treatment and vital statistics by linking it to
other data holdings, such as those held at Cancer Care Ontario. To maintain the “prescribed
person” status, the OTB is required to have policies approved by the Ontario Privacy
Commissioner, that describe how it collects, retains, and protects health information and how
anonymized data may be disclosed and to whom. Participants in the OTB fully consent to the
provision of samples and are informed of their status within the Ontario PHIPA and the intended
use.172 This regulated entity will be discussed in more detail in Chapter 4.
The legislative landscape in Canada for biobank activities is a patchwork of different legislation
and regulations where in some circumstances applicability remains uncertain as will be
discussed in Chapter 4. In addition legislation does not contemplate the ever-evolving world of
genomics and biobanking. These complexities are leading some research structures to resolve
the issues through the governance of the biobank.
3.2.2.2.1 Ontario and British Columbia Models
1) Ontario Authority Model
Firstly, it is important to highlight that one of the Ontario PHIPA advantages is that it
includes within the definition of personal health information, any information that relates to the
donation by an individual of any body part or bodily substance of the individual or that is
derived from the testing or examination of any such body part or bodily substance.173 It means
that the personal identifying information that accompanied the body part or bodily substance is
considered personal health information. Secondly, another benefit of the PHIPA is that it
172 Ann Cavoukian, Review of the Ontario Institute for Cancer Research in Respect of the Ontario Tumour Bank: A Prescribed Person under the Personal Health Information Act (Toronto: Information and Privacy Commissioner, Feb 2011), [Cavoukian, 2011], online: <http://www.ipc.on.ca/images/Resources/hfaq-e.pdf>. 173 [PHIPA] supra note 153 at Section 4.
51
established the prescribed person entity that permits prescribed persons such as institutions and
hospitals – health information custodians (HIC) – to disclose personal health information
without consent. The prescribed person who compiles or maintains a registry of personal health
information for purposes of facilitating or improving the provision of health care or that relates
to the storage or donation of body parts or bodily substances will be permitted to receive
personal health information without consent. This model permits the flow of personal health
information between HICs and biobanks within the parameters permitted by PHIPA and the
protections provided by PHIPA.
Ontario has its own specific health information legislation and has taken the unique approach in
its health information legislation of designating some health entities such as the Ontario Institute
of Cancer Research (OICR) in respect of the Ontario Tumour Bank (OTB) and its registries as a
“prescribed entity” that is authorized to collect health information.
Who is a Prescribed Health Registry?
Although subsection 39(1)(c) in174PHIPA does not define the term “registry”, in combination
with Regulation 329/04175 these together provide insight into the scope of this type of registry:
1) The purpose of the prescribed person is to facilitate or improve the provision of health
care or carrying out functions relating to the donation or storage of body parts or bodily
substances. [emphasis added]
2) It is specified that in order to be “prescribed”, a person must compile or maintain a
registry.
174 Halyna Perun, Michael Orr & Fannie Dimitriadis, Guide to the Ontario Personal Health Information Protection Act, (Toronto: Irwin Law Inc., 2005) 467-485. 175 Personal Health Information Protection Act, O.Reg. 329/04, s. 13 (1).
52
3) A person who compiles or maintains a registry of personal health information of this
type may or not be a health information custodian.
4) Where the prescribed health registry is not a health information custodian but receives
personal health information from a health information custodian, such as a hospital, the
registry shall put into place practices and procedures approved by the Information and
Privacy Commissioner of Ontario (PCO), and it is subject to the recipient rules set out in
OPHIPA.
5) The registry must make publicly available a description of its functions, including a
summary of the practices and procedures approved by the PCO.
While some biobanks collect biological materials directly from participants, other
entities perform other biobank activities. For example, cancer agencies conduct large-scale
longitudinal studies. In order for these types of entities to conduct their studies, they require
collaboration and cooperation from hospitals or other institutions to receive larger numbers of
samples and personal health information. The PHIPA prescribed entity covers this aspect of
biobanking and could be used by these entities to facilitate the flow of the data as well as
securing and protecting the personal health information.
Another benefit of the prescribed person is that in order for a health information custodian to be
permitted to disclose personal health information to a prescribed person without consent, the
prescribed person must have practices and procedures in place which are approved by PCO.176
This is to protect the privacy of individuals whose personal health information is being received.
In addition, PCO approved practices and procedures maintain the confidentiality of the personal
176 [PHIPA] supra note 153.
53
health information pursuant to subsection 13 (2) of Regulation 329/04.177 This approach can
be used as a model for good governance practice since it addresses the need for biobank
governance and imposes the obligation of biobanks to create procedures and policies to protect
the privacy of the participants, with the oversight of the PCO. In addition, this kind of initiative
will be translated in the long run towards the design and establishment of robust biobank
structures. Also the fact that these practices and procedures must also be reviewed by the PCO
every three years from the date of their initial approval provides assurance that there is oversight
by privacy experts who will assess the security mechanisms implemented and review it again in
a reasonable time period to validate the policies and procedures in place. The involvement of the
PCO also includes recommendations made by scholars such as Knoppers et al.178 since one of
their recommendations is that in general privacy commissioner should have the oversight over
biobanks.
The PHIPA approach with respect to the prescribed person is a step forward for what is needed
in Canada in relation to biobank governance, and to ensure that the biobank has in place
procedures and mechanisms to protect the personal information it holds. Also these procedures
and mechanisms provide certainty and efficiency, as people know what the rules are and what to
expect. As Kaye said, “Having a governance system in place ensures that ethical and lawful
research is supported through accountable and transparent decision-making. This not only
protects the integrity of the research community “but also has the effect of promoting public
confidence and trust”.179 The biobank governance structure is necessary and has to be publicly
177 Ibid. 178 [Cavoukian, 2011] supra note 172. 179 [Kaye, 2011], supra note 127.
54
accountable for its actions and decisions to those affected and involved.180
Participants are willing to participate and collaborate by donating their samples and data for
research. At the same time the public expects that all their rights will be respected. Biobanking
activities are different from traditional research with subjects where the studies are specific,
certain and some even interventional. However, the studies that will be done with the samples
and data deposited in the biobanks will not necessarily be done directly on the participants, so
there is no possible harm to the individual in the same way that could happen in a clinical trial
study; for example, where a company is testing a new drug. From the perspective of the
participants, the major risk with biobanks centers around the autonomy and privacy of the
participants/donors.
i) Advantages of the Authority Model
As explained above, biobanks require an external oversight – a body over which biobanks have
no influence – preferably by mandated statutes that cover the structure of all biobanks. The
prescribed person is based in the licensing of a biobank. This model requires that biobanks have
in place practices and procedures approved by the Privacy Commissioner to protect the privacy
of individuals whose personal health information the biobank receives and to maintain the
confidentiality of that information.181 Another authority example is in the UK where a specific
biobank legislation is the Human Tissue Act 2004.182 This Act established the Human Tissue
Authority (HTA), an oversight authority, and guidance through codes of practice183, for the
180 [Lemmens & Austin, 2009], supra note 51. 181 Subsection 13(2) of Regulation 329/04 of [PHIPA]. 182 Human Tissue Act 2004 (c 30), UK. 183 [Gibbons, 2007] supra note 13.
55
storage and use of human tissue, among other purposes used for research. This body gives
approval by licensing organizations for the store and use of human tissue.
The governance of biobanks is also about regulating the relationships among participants
(donors), researchers and the biobank itself. The next section will examine the advantages that
are encountered in the prescribed person as an authority model, including some good
governance practices, and it will also address some limitations.
a) From the perspective of the participants
(i) Advantages
It is made certain that there is a clear purpose for the biobank.
Transparency of practices are put into place in respect of handling personal
health information.
The protection of the participants is safeguarded to protect participants from
unauthorized disclosure, as the prescribed person is required to implement
procedures to improve the privacy and data security of health information.
It extends the coverage from health information custodians (HIC) to non-
health information custodians that receive personally identifiable health
information from a HIC, for example the prescribed person. Thus, the privacy
protections follow the data.
All the data is required to be de-identified prior to distribution to researchers.
An authority oversight (through the privacy commissioner) is in place to
protect the privacy of the participants. The authority has clear public
accountability in the privacy area and is interested in the protection of the
information held by these structures.
Limitations
Although the data and samples are primarily collected under participants’
consent, sometimes secondary use and disclosure by the HIC to a prescribed
person can be done without consent.
56
The Ontario Authority Model does not provide clear sanctions or privacy
commissioner enforcement powers for unauthorized access and disclosure of
personal health information.
b) From the Biobank perspective:
(i) Advantages:
The Ontario Authority Model provides clear guidance for the design and
establishment of biobanks.
Biobanks may receive without consent personally identifiable health
information from health information custodians (HIC).
In certain circumstances, with a research plan approved by a research ethics
board, these prescribed entities are permitted to use and disclose personal
health information for research purposes as if they were health information
custodians.
A prescribed person is also permitted to disclose personal health information
to another prescribed person that compiles or maintains a registry of personal
health information, and for purposes related to the planning, management and
analysis of the health care system.
The model provides for oversight of the PCO (a three year renewal period
ensures that the governance policies and mechanism remain fit for the
purpose over time).
It makes strong measures mandatory to safeguard the security of health data.
Under this model the biobanks could also aggregate personally identifiable
data from multiple sources, and then provide data to researchers with direct
identifiers removed, under strict security requirements.
The Ontario Authority Model permits the free flow of personal health
information between custodians and biobanks.
ii) Limitations of the Ontario Authority Model:
The burden of developing the policies and procedures rests on the biobank.
57
Although the Ontario Authority will need to implement policies and
procedures, the prescribed person model does not address the need for
creating other committees such as scientific or access committees that we see
more today as part of the biobank governance.
c) Researchers (gaining access to the biobanks)
i) Advantages of the Authority Model
More samples and information are available for research, as well as a more
comprehensive database through data linkages.
Researchers will have access to samples and information stored by regulated
entities, which can offer acceptable standards.
Structures are well organized with specific procedures and rules in place.
ii) Limitations of the Authority Model
Diversity: Researchers will find differences among different prescribed
persons.
Sometimes the policies and procedures are more complex, and access to data
and samples could also be more complex.
Although the Ontario Authority Model does not resolve all the biobank issues, it is a step
towards enacting provincial legislation that gives power to the Privacy Commissioner to license
and approve biobank structures, and that helps to build good governance practices. One
important aspect lacking in the Ontario Authority Model is providing more sanction powers to
the Privacy Commissioner. The Ontario Authority Model gives power to the Privacy
Commissioner every three years during the renewal process to revoke the license given.
However, the legislation should include more power to monitor, investigate and, if necessary,
take formal steps to compel compliance.
2) British Columbia: The Stewardship Committee Model
There are different oversight models to gain access to biobank samples and data. The
Authority Model (through the Privacy Commissioner) has been examined above. Another
model involves setting up either (i) an internal committee (such as a scientific advisory
58
committee) or a data/sample access committee (sometimes a single committee or various
committees) or an external committee such as a stewardship committee which will be discussed
below when examining the British Columbia Stewardship Committee. A stewardship committee
would review access requests made by researchers.
Internal committees are in charge of evaluating the biobank project as a whole and the research
projects submitted that require its use. These committees scrutinize the ethics with regard to
access of research scientists to sample and data.184 External committees – where the biobank
does not have control – are created by statutory mandate. Both types of committees will be
explored.
British Columbia launched an e-health system in 2009. Under the E-Health (Personal Health
Information and Protection Privacy) Act, S.B.C. 2008, c. 38 (E-Health Act), the minister of
health can create health information banks (HIBs). The personal health information in this
system is known as an Electronic Health Record (EHR).
One of the main characteristics of this system is that the E-Health Act gives an HIB
administrator the power to collect identifiable patient information from both public- and private
sector sources.
In addition, this E-Health Act introduced a governance model through the “Data Stewardship
Committee.” This Stewardship Committee is responsible for managing the disclosure of
information (both personal health information and de-identified information derived from
personal health information) for planning or research purposes from Health Information Banks
and prescribed Ministry databases. The composition of the committee is wide and varied with
184 [Rial-Sebbag & Cambon-Thomsen, 2012] supra note 45.
59
members from different disciplines – including the public - and others appointed by the Minister
of Health. The committee is responsible for managing the disclosure of information contained in
a health information bank or a prescribed Ministry of Health database. The committee must
include at least:
• one person from within the Ministry of Health Services;
• one person chosen as a representative of the health authorities;
• one person nominated from the Council of the College of Physicians & Surgeons of British
Columbia;
• one person nominated from the Council of the College of Pharmacists;
• one person nominated from the Board of the College of Registered Nurses;
• one person engaged in health research generally;
• one person engaged in pharmaceutical research;
• three persons chosen as representative of the general public; and
• Ministry of Health Chief Data Steward as a non-voting member.
Anyone seeking data contained in PharmaNet, a health information bank or a prescribed
ministry database for research purposes, must submit a request to the Data Stewardship
Committee through the Data Stewardship Secretariat. If the committee approves the request, the
health information bank or the prescribed database administrator may disclose the requested
information, subject to any conditions set by the Data Stewardship Committee or the
administrator.
This stewardship committee model can be assimilated to the “controlled-access” used by the
60
International Cancer Genome Consortium (ICGC),185 an international initiative which
established two bodies to oversee controlled access to data.
As mentioned previously part of good governance involves controlling data access to protect the
privacy and misuse of the data.
One of the defining features of biobanks is that they are established for the purpose of sharing for
research purposes, and there is a public interest in biobanks being available for medical research.
Access for research purposes should thus be facilitated as much as possible, while respecting any
constraint imposed by participants’ consent and protection of their privacy and confidentiality.
Open access is becoming a well-established practice for large-scale projects, particularly in the
field of genomics. Joly et al. have suggested, “[o]ne possible way to reconcile open data sharing
with privacy concerns is to use a tiered access system to separate access into ‘open’ and
‘controlled’”. Controlled access mechanisms regulate access to certain, more sensitive data (e.g.
genome sequencing files) by requiring an independent body or committee, and complete an access
application that contains privacy safeguards.186
One of the major contributions of the stewardship committee model is the involvement of the
public with the data bank. Just as it is important to pay attention to the scientific project, or the
legal and ethical challenges faced, it is also important to link biobanks to society. Biobanks must
not just be linked to participants but to society in general.187 Therefore, it is vital for biobanks to
maintain and honour public trust through the creation and use of governance mechanisms. The
185 See International Cancer Genome Consortium (ICGC) Goals, Structure, Policies and Guidelines at < http://icgc.org/icgc/goals-structure-policies-guidelines> [ICGC Policies]. 186 Yann Joly et al, "Data Sharing in the Post-Genomic World: The Experience of the International Cancer Genome Consortium (ICGC) Data Access Compliance Office (DACO)" (July 2012) 8(7): e1002549. Doi: 10.1371/journal.pcbi.1002549. PLoS Comput Bio, online: <http://www.ploscompbiol.org/article/info%3Adoi%2F10.1371%2Fjournal.pcbi.1002549 >. 187 [Gottweis, 2012] supra note 7.
61
stewardship committee model is a top-down approach where the state intervenes and requires the
participation of the general public – as a decision maker - who form part of the committee who
will decide who can have access to the data.
4 Challenges of the Existing System
Currently Canada faces few challenges in the context of the existing system in the context of
biobanks. Although biobank activities are not new, their evolution in the last ten years has been
enormous. Research biobanks suffer from a patchwork of regulatory and policy provisions.
Overall, according to a study conducted by Knoppers et al., there is lack of regulation of many
aspects of research biobanks.188
4.1 Regulatory Patchwork
In Canada, privacy legislation comprises various federal, provincial, and territorial statutes and
regulations, professional codes of conduct, guidelines, standards, common law and
constitutional law. Privacy protections available to Canadians vary from one province or
territory to another, and from one sector (public) to another (private or hybrid).
According to an analysis made by Edward Dove et al., the Canadian privacy framework lacks
rationalized and harmonized privacy coverage. In addition, much of our legislation does not
contemplate the novel world of genomics and biobanking.189 Each province has relevant health
information legislation that would need to be satisfied whenever health information is accessed
– which will often be the case. In each province, slightly different rules and standards apply.
188 [Paediatric Report, 2011], supra note at 132. 189 Ibid.
62
Another challenge is the lack of any legislation or jurisprudence for determining whether a
biobank is a “person”, “public body”, “organization”, “institution”, or a similar designation.
This is in addition to the fact that some biobanks have a combination of public and private
funding, and there is no clarity as to how public sector or private sector privacy legislation may
apply in the case of combined funding. This limitation can be foreseen in statutes that apply
only to “commercial activity” as in the case of PIPEDA. The legal landscape is not uniform
across Canada and applicability remains uncertain.190
4.1.1 International
As has been described by Knoppers191 et al., there are currently multiple international bodies
suggesting legal and ethical frameworks for regulating international biobank research. UNESCO
issued its universal declaration on human genome and human rights in 1997. The European
Council agreed on a convention on biomedicine and human rights in 1996, a document that has
been a beacon to many legislators. A follow-up came in 2006 regarding research on biological
material. In 2003 WHO issued a report on genetic databases. The OECD and its working party
on biotechnology provided a draft of guidelines for human genetic research databases in July
2007.
One will for obvious reasons find inconsistencies in terminology and differences in procedures
suggested for biobank research among all those guidelines, emanating from many different
moral and legal traditions.
190 Ibid. 191 Bertha Maria Knoppers, Ma’n Abdul-Rahman & Karine Bédard, "Genomic databases and international collaboration" (2007) 18: 291–311 KLJ [Knoppers, Abdul-Rahman & Bédard, 2007].
63
As discussed in Chapter 3, there are a number of different kinds of provincial/ territorial
legislation impacting directly on health information. Some provinces have enacted health-
information-specific legislation. Others have legislation that covers personal information in the
private sector, including health information. All have legislation governing information in the
public sector, which may include hospitals and extended care facilities.192 This situation makes
the Canadian regulatory landscape for biobank activities a patchwork of different legislation and
regulations that in some circumstances have uncertain applicability.
On the one hand, although PIPEDA applies to federally- and provincially-regulated
organizations alike, it does not extend to the provinces unconditionally. If the federal
government is satisfied that a province has enacted “substantially similar” legislation to PIPEDA,
then the relevant organizations, activities and classes will be exempt from Part 1 with respect to
the collection, use and disclosure of personal information that occurs within that province.
However, even where provincial privacy legislation is deemed “substantially similar,” PIPEDA
will continue to apply to the extra-provincial collection, use and disclosure of personal
information in the course of commercial activities, as well as to any organization that collects,
uses or discloses personal information in connection with the operation of a federal work,
undertaking, or business. In short, only non-federal intraprovincial activities will be exempt
from PIPEDA, although they will remain subject to the substantially similar provincial
legislation.
On the other hand, some provinces started enacting their own health information privacy
legislation that has been declared to be substantially similar to PIPEDA. Currently then, we have
192 [Elaine Gibson, 2007] supra note 154 at 236.
64
a complex legislative map, although each province has enacted its own privacy legislation
modeled upon “Fair Information Practices”193, and not all the statutes have provisions relating
specifically to biobank activities.
4.1.2 Tri-Council Policy Statement (2010)
Funding bodies can have substantial control over those who receive grants from them, since the
grant holders must comply with their funders’ policies and conditions. This means that funders
can prescribe certain norms and conditions as to how research should be carried out by
researchers and biobank operators.
In December 2010, the Canadian Institutes of Health Research (CIHR), the Nature Sciences and
Engineering Research Council of Canada (NSCER), and the Social Sciences and Humanities
Research Council of Canada (SSHRC), three major federal research funding agencies (the Tri-
Agencies), issued a second edition of the Tri-Council Policy Statement (TCPS2). Similar to the
first edition, this document establishes an ethical framework for the conduct of human
participant research, including studies involving human participants and “research involving
human biological materials and stem cells”, whether or not this material is derived from living
or deceased persons.194
However, being a policy statement, the TCPS2 lacks the legal authority of legislative
instruments. Instead, the scope and extent of its regulatory impact rests on other factors. One
such factor is that in order to be eligible to receive and administer funding from the Tri-
Agencies, an institution must agree to abide by a number of Tri-Agency policies referenced in a
193 A concept well established in privacy law, in the context of medical research. More at Office of the Privacy Commissioner of Canada. Online: < http://www.priv.gc.ca/resource/tool-outil/english/fair-info-practices.asp> 194 [TCPS, 2010], supra note 24 at s. 2.1.
65
Memorandum of Understanding (MOU) that each institution enters into with the Tri-Agencies.
Included within these policies is the TCPS2. In addition, the Tri-Agencies grant applications
requiring applicant researchers to certify compliance with all of the Tri-Agencies’ policies
regarding the ethical conduct of research, including the TCPS2, if the research will involve
human participants. As a result, Tri-Agency-funded researchers and their institutions must
comply with the TCPS2.
For example the TCPS2, within the biobank context, obligates researchers to provide research
ethics boards (REBs) with details concerning “their proposed measures for safeguarding
information, for the full life cycle of information: its collection, use, dissemination, retention
and/or disposal.”195
Also, the TCPS2 defines the term “secondary use” as “the use in research of information
originally collected for a purpose other than the current research purpose”. Therefore,
researchers setting out to conduct research using health care records compiled in the clinical
context or biological specimens collected for therapeutic purposes are engaging in secondary
activities. The TCPS2 in Chapter 12 (Human Biological Materials Including Materials Related to
Human Reproduction), and Chapter 13 (Human Genetic Research), contains guidelines on
biobank activities, human tissue samples and human genetics. On the one hand, it recognizes the
importance of biobank structures to help researchers understand diseases as well as their
interactions with our genetic composition. On the other hand, it recognizes that these biological
materials may also present risks to individuals whose biological materials and other personal
information is stored, accessed, used, retained and disclosed through a biobank. Although the
195 Ibid at s. 2.1.
66
TCPS2 alone does not address all aspects of biobank activity, it is very influential in Canada and it
is incorporated by reference into a variety of other regulations. It is worth noting that in section
12.5 two principles were identified that could be considered the core elements that every biobank
shall consider. Specifically, institutions and researchers that maintain biobanks:
a) shall ensure that they have or use appropriate facilities, equipment, policies and
procedures to store human biological materials safely, and in accordance with
applicable standards; and
b) shall establish appropriate physical, administrative and technical safeguards to
protect human biological materials and any information about participants from
unauthorized handling.196
Therefore, in compliance with the TCPS2 every biobank funded by the Tri-agencies shall
develop its own governance through procedures and rules in accordance with applicable
standards. In addition, it is expected that these procedures and rules shall address the
protection, access and use of the information stored by these research structures. Although
it should be mandatory to all universities and institutions funded by the tri-agencies to
establish their own policies and rules, while there is no formal oversight mechanism it is
hard to ensure not only that the institutions/universities have in place comprehensive
procedures and rules, but also to ensure that these rules and procedures are in compliance
with applicable privacy laws and international standards.
Similar to the TCPS, at the international level there are soft laws which include, for example: (i)
National Cancer Institute (NCI) Best Practices for Biospecimen Resources, US197, and the
Organization for Economic Co-operation and Development’s Guidelines on Human Genetic
196 Ibid at s. 2.1. 197 National Cancer Institute (NCI) Best Practices for Biospecimen Resources, U.S. Office of Biorepositories and Biospecimen Research, National Cancer Institute, National Institutes of Health, U.S. Department of Health and Human Services online: http://biospecimens.cancer.gov/bestpractices/2011-NCIBestPractices.pdf.
67
Research Databases (OECD -HBGRD).198 These instruments serve as a reference for biobanks,
researchers and public authorities. Although their violation cannot in any way cause a direct
sanction, they can influence the adoption of more stringent texts.
4.2 Research Ethics Board’s Role
In Canada, Research Ethics Boards (REBs), also known as Research Ethics Committees
(RECs), Institutional Review Boards (IRBs), and Ethical Review Boards (ERBs), have the
mandate to approve, reject, propose modifications to, or terminate any proposed or ongoing
research involving human subjects which is conducted within, or by members of, the institution,
using the considerations set forth according to the Tri-Council Policy as the minimum standard.
The basic principles of medical research governance (following the model of the clinical
trials)199 requires that all research protocols should be reviewed by a research ethics
committee or research ethics board or an equivalent independent body. There are two
components to the ethical review processes where stored biospecimens and data are made
available to other researchers: First, prior ethical approval must have been sought for
collection, storage, transfer, and research use of the biospecimens and data; and second,
further ethical approval must be sought for all proposed future research using the
biospecimens and data.200
The problem with REBs in Canada is the absence of national REB regulations that could specify
requirements for REBs accreditation or central governance in place. Although there is strong
198 OECD: Principles and Guidelines for Access to Research Data from Public Funding. 2007, online: OECD <http://www.oecd.org/dataoecd/ 9/61/38500813.pdf>
199 Such of those found in ICH Guidance E6: Good Clinical Practice: Consolidate guideline, especially those in section 3. 200 Donald Chalmers et al, “A Role for Research Ethics Committees in Exchanges of Human Biospecimens Through Material Transfer Agreements” (Epub ahead of print, Jun 2014) J Bioeth Inq. [Chalmers D et al], online: <http://www.ncbi.nlm.nih.gov/pubmed/24965440>.
68
recommendation201 by scholars such as Trudo Lemmens to institute such a system, it does not
appear imminent. Furthermore there is no restriction on who can establish an REB, who
becomes a member, or any training needed.202 We can find both institutional and private REBs.
While the former are at least part of a “soft” regulatory system emanating from the funding
agencies. Tri-Agencies the latter are currently without a clear regulatory structure.203 The lack
of public accountability of private REBs is problematic, and it is a concern recognized by the
College of Physicians and Surgeons of Alberta, which has set up a Centralized Research Ethics
Review Committee204 to oversee the research activities of all physicians and surgeons in
Alberta.
As a primary responsibility, REB members are the gatekeepers charged with reviewing all
clinical trials in Canada. The responsibility for protection of research participants rests at the
local REB level. Many REBs in Canada are maintained as volunteer-service committees often
with a high membership turnover rate. There is neither formal REB training nor a mandated
continuing education process in Canada. At the same time there is increased demand for REB
accountability and for ensuring patient safety.205
In the biobank context, REBs cannot and should not be expected to perform and address the
kind of privacy related review and oversight that is needed for research biobanks. In addition, it
is dangerous to assume that an “REB has the competency to engage in the level of privacy
201 Trudo Lemmens, “Federal Regulation of REB Review of Clinical Trials: a Modest But Easy Step Towards an Accountable REB Review Structure in Canada” (2005) 13(2-3): 39-50 Health Law Review (Special Issue on Research Governance) [Lemmens, 2005]. 202 Ibid. 202 Ibid. 203 Ibid. 204 Ibid. 205 Ibid.
69
oversight needed.” 206
It is problematic when there is no oversight authority – with biobank structures
expertise– to ensure that biobanks are established with a robust governance system.
In a 2014 study conducted by Elaine Gibson et al., 34 REBs and/or REB administrators
affiliated with faculties of medicine in Canadian universities were interviewed about the
role for REBs in the creation and uses of registries and biobanks. A wide range of
responses was given for the questions raised in the scenarios, indicating a lack of clarity
about the role of REBs. For example, all respondents agreed that patient consent was
needed for blood samples to be placed in the biobank but the duration of consent varied.207
One of the sites in the study expressed the following:
“Some of the decisions should be taken by authorities above local REBs. Rules should be clarified so that each local REB does not have to take decisions. Such fundamental decisions [should] not rest upon the shoulders of local REBs. The consequences of certain decisions can impact on people or populations, which makes even more [persuasive] the case for the need for a regulatory framework on banks.”208
REBs in Canada have not received clear guidance regarding their role in the creation and access to
biobanks. The original mandate of REBs was more regarding the approval for specific study-by-
study, thus not engaging in some of the larger issues concerning the creation and research uses of
biobanks. The ethical level could be handled by the REBs. However, we should ask ourselves
whether the REBs’ mandate to protect the safety of research participants could be extended to
biobank activities. This differs from what REBs are accustomed to doing. It also differs from
ethics approval in the context of traditional medical research since participants’ information will
206 [Paediatric Report, 2011], supra note 132 at 58. 207 Elaine Gibson et al, "Who's minding the shop? The role of Canadian research ethics boards in the creation and uses of registries and biobanks" (2008 Nov 14) 9:17 BMC Med Ethics [Elaine Gibson et al, 2008]. 208 Ibid.
70
be held for longer periods of time in biobanks and there is some kind of uncertainty of the
research that will be done with those samples and information in the future.
REBs are the central mechanism through which the conduct of research is governed to facilitate
the public good. But all too often the REBs do not have adequate expertise on all the aspects
involved in research, for example when we talk about biobank structures, one of the main
concerns is the privacy of the participants. So it is not clear whether the REBs are specialized in
the protection of privacy when there is the possibility of re-identification, or unwanted
disclosure of the data, or what kind of technological/security mechanisms are needed to protect
the information. Research is becoming increasingly complex and specialized. Advances in
biomedical research, such as in the areas of genetics, mean that new expertise is required to
understand the new challenges and to effectively evaluate them.209
4.3 Oversight by the Privacy Commissioner
An important aspect to ensure a good governance system, and the public trust for biobanks as a
research infrastructure, is storage and making sensitive information available for future research.
Concerns arise over who has the power and the ability to ensure compliance, and also the
mechanisms for enforcement of decisions. Whether there is power may have implications for
ensuring that privacy and security policies are respected, and for ensuring that a private entity to
which commercialization rights are granted respects these rights and does not act in an abusive
manner.210 Canada needs an authority with power to monitor, investigate and, if necessary, take
formal steps to compel compliance or punish misconduct. This authority could be the Privacy
Commissioner, however to date the Privacy Commissioner does not have sufficient “penalties
209 Ibid. 210 [OECD, Exec Sum] supra note 11.
71
and sanctioning and enforcement powers” for violations disclosing personal or health
information in the biobank context.211
As I proposed in this thesis, one possible path in providing stronger protection to the privacy
interest of participants is giving power to provincial privacy commissioners and the Office of
the Privacy Commissioner to oversee and monitor biobanks. In Canada, this idea is not that far
away, since currently some initial approaches exist through the power to license “prescribed
persons” by the Ontario Privacy Commissioner, where in order to become a “prescribed person”
all procedures and rules require Ontario Privacy Commissioner approval, as explained in
Chapter 3. Another similar example is the participation of privacy commissioners in Canada’s
National DNA Data Bank Advisory Committee,212 in which a representative of the Office of the
Privacy Commissioner sits in the committee to ensure that the data bank has access to expert
advice in the field of individual privacy. Federal and provincial privacy commissioners
generally are not vested with authority to make binding decisions. There are, however,
exceptions: the British Columbia Information and Privacy Commissioner’s orders are
enforceable,213 and both the Alberta and Ontario Commissioners make binding orders under
their health information legislation.214 However, Commissioners are empowered to investigate
pursuant to a complaint, and may also launch an investigation where there are reasonable
grounds to believe there has been a contravention of the statute.215 In Europe, due to the
211 [Paediatric Report, 2011], supra note 132. 212 DNA Data Bank Advisory Committee Regulations, SOR/2000-181. 213 Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, C. 165, S. 59; Personal Information Protection Act, S.B.C. 2003, c. 63, s. 53. 214 Health Information Act, R.S.A. 2000, c. H-5, s. 81; Personal Health Information Protection Act, 2004, S.O.. 2004, c.3, Sched. A, s. 61. 215 For example in Ontario [PHIPA] supra note 153 at Part VI Administration and Enforcement.
72
provisions contained in Directive 95/46/EC216 data protection authorities also have an important
role in overseeing data processing not only within biobanks, but also the use of data and samples
by researchers.
In the biobank context, as discussed in this chapter regarding the role of the REBs, the current
ethics system is not very accountable and trustworthy. Thus the protection of biobank
participants cannot rely exclusively in the REBs. The monitoring and oversight of biobanks
requires the participation of other governmental bodies with different expertise – such as
privacy – and preferably with a statutory mandate, which at the same time promotes good
governance practices. I acknowledge that these proposed changes will require providing more
specific training, expertise and resources to facilitate biobank activities which go beyond their
normal duties.
The power of the Privacy Commissioner should be extended for licensing and keeping records
of all existing research structures that hold biological materials, tissue, and genetic databases.
5 Strengthening the System
In response to the challenges mentioned in the previous chapter, new legislative
approaches and governance mechanisms have been proposed and adopted to enable
biobanking to proceed. For instance, few jurisdictions around the world have legislated in
response to the phenomenon of biobanking, as is the case in Iceland, Norway, Sweden,
Estonia and Latvia.217 However, the far more common response has been policy led by
funders and other stakeholders initiating multilevel policy initiatives to guide biobank
practices. An example of this is the UK Biobank, which has developed and operates
216 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Official Journal L 281 , 23/11/1995 P. 0031 - 0050 217 [Cambon-Thomsen , 2007] supra note 23.
73
according to an Ethics and Governance Framework.218 Although this instrument has no
basis in law it is a requirement for the biobank that anyone gaining access to the biobanks
follows and complies with these procedures and rules. The purpose of this chapter is to
present some important initiatives and approaches developed to date.
5.1 International Initiatives
In the international context, legislation specific to biological material and/or data collection
exists at the national level, as is the case in Iceland, Norway, and Latvia.219
However, in other jurisdictions there are additional bodies sanctioned by the state, which are
responsible for biobanking activities, such as the Human Tissue Authority in the UK. These
kinds of oversight previously mentioned are external mechanisms where biobanks have no
control. These mechanisms include binding and, in some cases non-binding, sources of
obligations.220
At the same time, new oversight bodies – internal221– have emerged which operate within the
existing regulatory/ethical structures but are designed especially for biobanks. As part of the
governance structure, some biobanks will typically have a scientific advisory board and data
access committee. These bodies have been essential for transparency and accountability and for
ensuring confidence in the governance of biobanks.222
In May 2000, the Icelandic Parliament passed the Icelandic Biobanks Act, the world's earliest
attempt to construct binding rules for the use of biobanks in scientific research. The legislation
218 [Graeme, 2011], supra note 119. 219 [Cambon-Thomsen , 2007] supra note 23. 220 [Mallete, Tasse & Knoppers, 2013] , supra note 126. 221 Internal oversight is created by the biobank itself to meet a requirement or fulfill its role, to control the access to data and samples. 222 [Hotweiss & Kaye, 2012], supra note 94.
74
had the purpose of authorizing the collection, storage, handling and utilization of human
biological samples in a manner that would maintain confidentiality, safeguard the interests of
donors of biological samples, ensure that the utilization of the biological samples serves the
purposes of science and medicine, and also ensure that such utilization is conducive to the
public good.223 In sum, the purpose of this Act is to achieve a balance between the welfare of
the participants and the carrying out of the research. The Act contains provisions dealing with
requirements and conditions for obtaining a license from the Minister of Health.224 Also there
are specific provisions for biobank governance, such as (i) the need to establish a board which
shall monitor the operation of the biobank,225 (ii) how to obtain access and use of biological
samples,226 and (iii) consent of donors of biological samples and revocation of consent. In
addition, it gives the Data Protection Authority the power to monitor the security of personal
data in biobanks.227
Legislation can also be found in Estonia, which established the Human Genes Research Act in
2000.228 This Act was specifically designed to govern the establishment of a national biobank
by the Estonian Genome Project Foundation. This Act governs genetic research conducted with
the “Gene Bank” and mandates requirements for the maintenance of a biobank as well as for a
Data Protection Commissioner and a Supervisory Board to oversee the biobank.229
223 Iceland, Biobanks Act, No. 110/2000, as amended by Act No. 27/2008 and Act No. 48/2009. 224 Ibid at Art. 4. 225 Ibid at Art. 6. 226 Ibid at Art.9. 227
Ibid at Art. 12. 228 Human Genes Research Act, 2000 RT I 2000/10/685. 229 [Wallace et al, 2008], supra note at 125.
75
Another example is in Latvia, which in 2003 also adopted a biobank specific law, the Human
Genome Research Law.230 The purpose of this law is to regulate the establishment and operation
of a national genome database for the state population. There is a State Data Inspector who is
responsible for the oversight of the resource and for receiving complaints. The Central Ethics
Committee also has a governance role, to evaluate compliance with the principles of ethics in
genetic research and establishment and operation of the genome database.231 232
The above countries have in common their creation of statutes which create or give a mandate to
an existing body to monitor and oversee biobank activities. These statutes not only govern the
creation and establishment of these research structures under the law, but also they create a clear
legal framework that seeks to protect participants’ rights at stake.
5.2 Canada Initiatives
Currently, a large number of biobanks have a similar initiative with policies and procedures that
guide decisions and practices. In addition to this trend of self-regulation there are some initiatives
that complement and enhance the process of designing and developing these policies and
procedures.
One example that is worth mentioning is the Public Population Project in Genomics (P3G), a not-
for-profit international consortium that provides access to expertise, resources and up-to-date
information on public population genomics. P3G was initiated in 2003 with the aim of fostering
collaboration between researchers and projects in the field of population genomics, as well as to
facilitate the harmonization of samples and data from international biobanks. In 2008 the P3G
230 Ministry of Foreign Affairs of the Republic of Latvia, online: <http://www.am.gov.lv/en/?id=480> 231 Human Genome Research Law, 2002 (Latvia). 232 [Wallace et al, 2008], supra note at 125.
76
Ethics and Policymaking Core put forward a document identifying core elements to consider
when drafting an “Access Policy for Population Biobanks.” 233 More recently, P3G has updated
the document with “The P3G Model Framework for Biobank Governance (2013).” This updated
document incorporates an analysis of the last five years of legislation, policies and literature that
have influenced and shaped the governance of biobanks, and reflects the P3G vision of global
access to research tools.234 Members of P3G share their tools and their methodologies. This kind
of initiative is an important contribution to these research structures, since their goal is to facilitate
the establishment process for biobanks, but in a consistent, efficient and harmonized manner.
Another initiative found in the international and national context is the establishment of advisory
bodies as part of the governance structures. To date, biobanks will typically have a scientific
advisory board and data access committees, and sometimes these are established by statute as in
the case of the British Columbia Stewardship Committee discussed in Chapter 4. But, but as also
discussed in that chapter these committees can be also part of the self-governance system such as
the ICGC.235
As mentioned before, this thesis does not suggest that such particular type of legislation is the only
solution for biobank governance nor does such governance involve a one step process for
achieving a complete legal framework. Instead it is argued that a legal framework is needed which
will provide some statutory shape and regulate oversight and sanctions mechanisms for these
biobank structures. Thereafter, any gap in legislation or regulations should be addressed through
governance.
233 Susan Wallace, P3G Sample and data Access Policy: Core Elements, Centre de Recherche en Droit Public (CRDP), (Université de Montréal 2008) [Wallace, 2008], online: <http://www.p3g.org/biobank-toolkit/p3g-sample-and-data-access-core-elements>. 234 [Mallette, Tasse & Knoppers, 2013], supra note 121. 235 See [ICGC Policies] supra note 185.
77
6 Conclusion
Traditionally in the biobank context, while dealing with ethical issues, attention has been mainly
focused on the nature and scope of the informed consent. As discussed elsewhere in this thesis,
biobanks have started to shift the focus from informed consent to giving greater attention to the
governance system as a mechanism to deal with biobank issues. As a consequence, biobanks
have started to develop and establish a self-governance system.
In Canada, despite the diversity of regulatory bodies, statutes and guidance that apply to medical
research, very little of this has relevance for biobanking. Currently Canada does not have a clear
regulatory system on biobanking, therefore the burden of developing rules and procedures relies
on biobanks themselves, which need to exercise considerable judgment about the best sources of
guidance to follow. If the funder or REB did not clearly outline what should happen, biobanks
are forced to select from a wide range of sources to identify standards and practices that are
relevant for biobanks. The system appears to depend on self-regulation or soft law. In addition
to these difficulties, the current biobanking governance framework in Canada depends on
“informal” oversight methods. Furthermore, the “informal oversight” approach also raises the
challenge of ensuring that all biobanks have proper governance.
This thesis has made the argument that a competent statutory authority should carry out
supervision of biobanking activities to ensure that biobanks have in place good governance
practices to safeguard participants’ interests.
One criteria could be that all biobanks with a significant sample size and storage time for
relevant research material surpassing five years must be licensed and overseen by the authority,
in this case by federal and provincial privacy commissioners, who should be included within the
regulatory framework for biobanks created for research.
78
Canada needs to determine the degree of governance required. One option is legislative
amendments that are more likely than legislative constructions. For example PIPEDA – federal
level – should be amended to allow the inclusion of some regulatory framework for biobanks,
including greater sanctions against breach of privacy. However this could be controversial due
to constitutional parameters, such as the provincial jurisdiction over health related matters, as
well as the fact that this statute is limited to the private sector. Other options, and more feasible,
are at the provincial level. These include amending privacy statutes to better incorporate
specific related issues236, and giving power to the provincial privacy commissioner to monitor
and oversee biobanks with sufficient sanctioning and enforcements powers for the breach of
privacy and confidentiality of the participants.237 Adaptation of existing legislation in order to
incorporate the characteristics of biobanks will be desirable as a provincial approach for the
standardization of the existing personal health information legislation.
The legislative proposal is based on the idea that the law has validity and authority which is
lacking in administrative standards such as internal policies and procedures, and that the law
provides greater consistency. The consistency makes the regulation predictable in order to give
stability and certainty to those who are being regulated.238 Another advantage of a law is that it
has longevity that administrative standards lack and the various stakeholders can therefore trust
the stability of the applicable rules.
Also legislation connects with the public, who have a substantial interest in participating and
collaborating in donating their samples to biobanks to facilitate research that may more
236 [Paediatric Report, 2011], supra note 132 at 58. 237 Ibid. 238 Jane Kaye et al, Governing Biobanks-Understanding the interplay between law and practice, 1st ed (US and Canada: Hart Publishing, 2012), at 311.
Top Related