The End of Individual Control over Health Information: Promoting Fair Information Practices and the Governance of Biobank Research

Abstract

Until recently, rules about protection of health information and the protection of human research subjects largely existed in different universes. In the last decade, we can see a growing awareness of privacy concerns and informational risks in the context of health research. This can be associated with the overall growth of research involving health and other personal data, but also with the increase in genetic research, which raises specific informational risks. Research ethics guidelines and regulations have included more detailed provisions on privacy protection. But they have largely continued to emphasize the importance of informed consent as the main protective mechanism in the context of sharing of health information. At the same time, new health information privacy legislation has in some jurisdictions tried to address the growing informational risks associated with health research. Some statutes have done so by, among other things, incorporating the traditional research ethics mechanism of independent review by Research Ethics Committees or Boards in privacy legislation. In line with a well-established tradition in privacy legislation, these statutes are modeled upon Fair Information Practices but nonetheless allocate a specific role to such Committees in dealing with the issue of consent in the context of research.

In this chapter, we make two connected arguments. First, we show how a variety of new developments make it increasingly hard to maintain that we can confidently assure the confidentiality of genetic information and detailed health information in the context of research. These developments include advances in genetic technology -- particularly in the context of personalized genome scanning, the growth of health data sharing websites, the increasing regulatory requirements to publicize research data, and the development of large biobanks. Second, we critically analyze how fair information practices are currently already integrated in some privacy legislation in connection with health research. While we support the use of the concept of fair information practices in the context of research, particularly also because of the increased inability to protect privacy on the basis of informed consent, our analysis suggests that research ethics review has been introduced within some of the privacy statutes without appropriate recognition of the structural weaknesses of the current regulatory regime surrounding research.

Keywords: Privacy, Confidentiality, Health Information, Medical Research, Genetics, Research Ethics, Research Governance

JEL Classification: I18, K10, K23, K32