Collection and Protection of Personal Health Data

Abstract

In this chapter, I reflect on key issues in the governance of the collection and protection of genomic data, with a focus on examples from European Union law. First, I discuss broadly how data privacy regimes regulate the collection and protection of genomic data. I examine how these regimes balance the needs of those wanting to collect and use genomic data for various purposes with the rights and interests of those from whom genomic data are taken and to whom they relate and implicate. In the genomic data context, those collecting and processing data include researchers (and their affiliated institutions), clinical organisations, and companies offering genetic testing. Following this discussion, I argue these regimes tend to generate or perpetuate several paradigms that can cause problems in an age of ‘big data’ analytics, direct-to-consumer genetic testing, and genomic data sharing initiatives. I then focus on two paradigms: first, the tendency in regulation to create bounded, siloed categories of personal data; and second, the ‘consent or anonymise’ paradigm. I conclude with a brief discussion of several emerging tools and initiatives that aim to strike a better equilibrium between robust exploitation of genomic data that promotes the public interest, while remaining consistent with the confines of existing law and preserving privacy as a fundamental value in biomedical research and clinical practice.

Keywords: law, genomics, data protection, privacy, personal data, health data