Protection of genomic data and the Australian Privacy Act: when are genomic data ‘personal information’?
Minna Paltiel, Mark Taylor, Ainsley Janelle Newson · International Data Privacy Law · 2023
Sharing genomic data promises great benefits for health research as well as clinical diagnoses and management. However, appropriate sharing is reliant upon privacy concerns being effectively addressed.1 In Australia, the first step toward understanding the protection of genomic data under federal law (specifically the Australian Privacy Act 1988 (Cth) (Privacy Act)) is understanding when genomic data are protected by that Act. The Privacy Act covers, inter alia, commonwealth government agencies and private sector health service providers.2 Collection, use, and disclosure of data by such entities are, however, only regulated by the Act in so far as the data themselves also fall within the material scope of the legislation. This article considers the relationship between the term ‘genomic data’, as it might be used in scientific (or lay) conversation, and the concept of ‘genetic information’ provided by law. This is important for at least three reasons: (i) those subject to the Privacy Act need to be able to confidently navigate their responsibilities, such as knowing when consent to sharing is required; (ii) understanding current controls is a prerequisite for meaningful external critique (and this is particularly important at present, given that the Privacy Act is under review); and (iii) while legislation that applies to state public sector agencies is generally3 distinct from the Privacy Act,4 there are similarities that extend the relevance of the question: When are genomic data ‘personal information’ under the Privacy Act? Key Points ‘Personal information’, protected under the Australian Privacy Act 1988 (Cth), is ‘about an identified individual or an individual who is reasonably identifiable’ (S.6), so the legal assessment of ‘identifiability’ shapes the protection of genomic data under the Privacy Act. Not all genomic data are captured by the statutory definitions of ‘genetic information’ in the Privacy Act; however, genomic data that do not fit the definition may still be protected if they are about an identifiable individual. In applying the legal test of identifiability to genomic data, the interaction between the data and the data environment must be examined. Overemphasis on particular features of genomic data, such as ‘rareness’ or ‘uniqueness’, may lead to a misapplication of the Privacy Act. Whether genomic data are personal information is primarily a matter of the opportunities and likelihood of linking the genomic data in question with other data available in the data environment. Common to almost all privacy legislation in Australia is the fact that the material scope of statutory privacy protection extends only to the ‘handling of personal information’.5 The Privacy Act defines a number of subcategories of personal information such as ‘sensitive information’, ‘health information’, and ‘genetic information’ (see the section, ‘Privacy Act definitions of protected ‘personal information’ and genomic data’ below). While understandable, we argue that it should not be assumed that genomic data will be captured by a of this article is that not all genomic data are ‘personal information’ or ‘genetic information’ as In this we the first and when genomic data are subject to privacy is the genomic data are ‘personal In to the current Privacy Act definition of personal information a data must be an and that individual must be or In this we on the of this test and when genomic data the ‘identifiability’ this not only other and this of the test to be the subject of in also there is that the current for data to be a may be as a of the current Privacy Act if the definition of personal information is there is to that identifiability will a in a of the between genomic data and ‘personal information’, we will as that all genomic data are about an or individual. genomic data by their and on the of genomic However, we that from a privacy law the of genomic data, in of scientific (or not the question of data are in all the The legal test and of identifiability is to the by legal is it is not a scientific the relationship between genomic data and legal of ‘personal information’ and ‘genetic information’, it is to by scientific of genomic do this in the first section, of genomic This is in the section, ‘Privacy Act definitions of protected ‘personal information’ and genomic data’ with an of Privacy Act to that with a of the between scientific and legal In the section, Privacy Act test of we the assessment of legal identifiability in the Privacy to the provided by the of the Australian and In this section, we the of the assessment and the of the relationship between features of genomic data and the data environment. In the section, of genomic data’, we of genomic data and the data environment to the of In the section, we the of the in the and the in the identifiability of particular genomic data and their legal with to Privacy Act should be of the of the and to of and their within an while to the of In Australia, the on in in in the and of genomic defines genomic research as the scope of Privacy and to in this article the term ‘genetic However, the definitions of ‘genetic information’ are in the section, ‘Privacy Act definitions of protected ‘personal information’ and genomic genomic data as the term is used in a or scientific In this the term ‘genetic information’ is used when the definition of In we the term ‘genomic data’ with scientific This to the to the between ‘genetic information’ and ‘genomic data’ are when from legal or scientific data’ may data with a of and is to with of or is used to to data by such as or at other the term extends to information such as and data as of ‘genomic or to clinical and in this we the term ‘genomic data’ to only to data from as data This data from and as well as and of genomic data, such as data from or other of such as of data to the genomic data to are to as The and of data’ in the assessment of identifiability are in the data’, and data as well as data to are and may be genomic the data and the the that a a data to data that or genomic data’ are by to a and between the and the between the are to a may are of and to or used to data’ to information about identified to This may the with a and to an of external data, such as from is a of a is a of only those of the for and data may be in to be and for other the of individual to in the a in a is an Common in of the are are the of and do not lead to between are in to a be used to of that a of The or are used to in of the The term also used to a that in is for in the of the are of that the other will be between or at of within particular The or of data will on the of the and the with the on the and of particular data are also from other data with to the of the data and and is important to that the and of a data is from and of genomic data and that may be the scope of ‘genomic data’ is to a of data’ other that by genomic data are and with other of data such as data’, and data from external such as of in the and data’ may also clinical and to the of the data may between data and with we in the are between genomic data and data, and between data and other information in a particular data are to an important in the legal assessment of In the Privacy personal information is in to information or an about an identified or an individual who is reasonably the information or is or and the information or is in a material or This definition of ‘personal information’ the Act in The definition to individual is or be reasonably from the information or The is not only as it the concept of personal also it is an that not by state legislation. of ‘personal information’ in privacy and health legislation in and the that the of a must be or reasonably the information or The be in particularly in the of data if genomic data by a state government on the that it not personal while the may be with those and the data, if by the Privacy may be personal information to that The that personal information is about an identified or identifiable individual is to the and the Privacy Act definitions of ‘personal however, important to that under the current definition the question is the genomic data are about a who is identified or The question is with the question of the genomic data be used to to this when we the legal test of identifiability to genomic is also important to that the question of data are for the of an of the Privacy should be a to that used in a scientific The and concept of genomic data will be and in scientific (and lay) of are upon in legal This and is a to to data The Privacy Act considers ‘genetic information’ to be ‘sensitive information’ is a of personal information and is to particularly for the data subject or if it is of information’ is a of ‘sensitive information’ and ‘genetic information about an individual in a that or of the health of the individual or a of the information’ that is not health information is as a of ‘sensitive The Privacy Act and material do not is by ‘genetic information that is not health however, this of information for genomic data used to an to an or reasonably identifiable In to the of being within the of information health information and as information that is not health there is in the definition of ‘genetic of information as ‘sensitive information’, such as and are under the Act to be also ‘personal This is not so with ‘health information’ or ‘genetic information that is not health The definition of ‘health that other of health information be ‘personal information’, this is not for ‘genetic in and the of the we do not on this of information health information or will only fall within scope of the Privacy Act if it is also personal not only to of statutory the statutory concept of ‘genetic information’ almost that might be as information fall subject to the of the Privacy Act. This or in those to all it is and to be if is to a between information and other of data with to the that it is personal and the question of The current Privacy Act may an to this and to that the only information within scope of the Privacy Act is personal this that we data’ may fall under at least three only of are as ‘genetic information’ in law in information that is health information that is not health information and genomic data that are not personal information at all (and as such not be subject to the Privacy on to when genomic data will be personal information under the Privacy Act we to of the definition of information is only a of health information when it is a that or of the of the the or a The of is and may not with the and used in the of In the of and data and to an individual in to a of that the statutory definition only to to information about do not this as information that is not health information is still by the it is and to legal definitions not with scientific and to information is about an identified when a particular within a of be from the a between the information in question and a particular When data that an the information on the of be about an individual from and will be personal The of identifiability is when personal information is about an individual who is is a and there are provided in or law for However, we law and to important of the assessment of (i) that identifiability is and (ii) that it upon the of the of and the of in that and features may on the of identifiability the in they are in of and that identifiable’ information information from the of the individual may be reasonably identifiable information by other This with we the Privacy Act definition of ‘personal information’ and the fact that a need not be identified from the it is for data to be an individual who be from in the to a between the information and a particular the in the test of identifiability is the genomic data, on or with other are about a or not the genomic data are or will be to that individual. In also that information is identifiable’ only it is reasonably to the the and of is not a a The of an individual is not to data as personal In is or to the information will not be personal The of of identifiability in Privacy the not the of and that of the reasonably be will an The assessment of of to the genomic data and to the data and is on a all the of such an is given by the that in should the and of the of the or who or the other information available to the the the of the the available to to the to it and this is the and in if the information is a of the be able to it to the upon the that the and of the data with an identifiable individual. This is with to a of the upon a or upon personal or for the The law this question that identifiability on and available to the or the In the of the that identifiability must the and of the as well as other information by the individual who the information and the and available to the individual who The in of identifiability on the in and sharing genomic data, to a of in if the data are privacy The of identifiability is also and the the on the of ‘personal information’ in the Privacy be and the of information This that of identifiability with to the data may with and genomic data are their with to identifiability is The of identifiability on of the genomic data in a particular data at a particular The of the concept of identifiability is also in provided in the for sharing genomic data for research The from of the or as for data or information to in their ‘identifiability’ as a on a and by While the of the in the are not with the and material of the Privacy the that identifiability of information is and on a is not at with the This of and of identifiability to the and the of current genomic In the current of the Privacy is being given to the between personal information and information should be under the that for information to fall the definition of ‘personal information’ and for the Act to it should be as The of such of not be to an or may the of data for research or health service to that only of or information fall the scope of the In this the of ‘identifiability’ in the Privacy Act and the need for an a that an of be for genomic data to be particular genomic data are on the upon the for with other information in the While genomic data is data and are to an The of identifiability must be when data are first and to Privacy Act However, when genomic data are it is that and of the data, with will that an identified or identifiable individual be with genomic This there is need to the of the data environment to to the for of the identifiability of of genomic data to on features that the of of data and and in of genomic data to the of the particular or in a this to the or a particular of a particular in the may be to the likelihood that the to it may be from in the The and as in the of disclosure of The data of in the of is not with other data as data and genomic data are to that are to are to of being about a particular individual (or if to other data, while information to privacy While the between of and is we that the ‘identifiability’ of be by the ‘rareness’ of given in with and that individual is not a of a data subject an of the or with information to that to a This is identifiability the and interaction between the genomic data and information in the data environment. This not that the or of information not upon that the data sharing environment is a in the identifiability of such data, in to data, are by as to the individual and identifiable data are as or to to individual is in the as not data to as an is and sharing of as to data, between data and individual they are not identifiable and of a privacy protection and that such as privacy concerns by only data, and not genomic data and that from the individual are not in the and a of the from the data may when they are from or are in the In other are the data to an with a particular or or genomic data to a or from in the in such as or however, they also to or of that genomic data, information that is not only about the from the also about their and about of they are a in the to within a particular data and the of a within a of important in However, we that on in identifiability may be data and and may an individual in the that be from a of of genomic and that be from and a for for such as and as for the In the of genomic data’, we between data and of this is that data, may for and This that for and for are and that identifiability of the genomic data may This may be to genomic and such information to a of a and not to individual While all genomic data may be and data to a of is given to and to an identified or reasonably identifiable individual. However, as we this is a matter of and subject to The of data in to the of of The and of data also opportunities for with information from other and the of This also applies to genomic data identified in those that information’ may be consent to the and of data as to or In this is The of or in data upon in the particular data or with that the on features of genomic data, and and are and genomic data are the genomic data be in the is the Privacy Act definition of personal information the question of an be reasonably from genomic data only a number of The of and of genomic data are between data and other information it with particular also the number of with the data may be the of However, they are not the only and should not be in The the term to the between the data and identifiability in the the interaction between the data and the environment in the data are or This is and and to genomic data in to data, as well as the data environment. data to genomic data an important in identifiability and genomic data are personal and between the of privacy protection for information on the data to they individual with clinical information to data with that the first should be to sharing while the should in the health in it to be only with and that of clinical will of that it is not only the and of the to the with information upon This assessment of ‘identifiability’ is by the features of the data, the data, and the of in the data sharing environment. The between and are or of that are for all in the data such as a or Australian are However, as we a as may not be to it to an individual it be to information and it is in the to do a number as an only the the data or to other information linking an individual to the or The as data be used to an individual with a or with information other considers to such as of of at of of or data to data are to the and the data and a or to the to information and The may also information available in and as well as of the with the the number of in the identified and a of the and features of those The that be an on the information and that in it is to a given is an that However, we argue that data, those are only in particular data The between and is to However, for we those as in to the of to an individual are for such as and are and are or at the when to while other with as data’, are as with all of assessment of particular data an with an identifiable individual is an the and of linking the data to an individual in the particular data that the the relationship between the genomic data in question and the of the data environment in it is or must be in data is when data are between or may also be data such as when there is a data sharing or when the data in environment are to In of data the likelihood for with an identifiable individual and the relationship between the of the data and the to is and is an in the of the data’ and the of the those and sharing genomic data must data on The upon and as data is current the is to the the that the three data environment are when genomic data sharing (i) the data are in a or (ii) the and of other data in the or and (iii) who is or the and in genomic data are and The may be by applying particular to the data The to on the and the environment to the data are The of from and term the of data for genomic data, to for genomic data, and Sharing within a or in to a between within a is subject to and by will a a the sharing the genomic data and legal to the data and However, of genomic data is for to research and clinical sharing of genomic data the sharing to for and in data the data will be and it will be used data are the is the This the that the data will or to information with the genomic it with an identified or identifiable individual. if there is particular to such the of should also be This to the of an individual in a data from personal of a number of In of that are only appropriate for data that is not personal information to or so that it is personal The test of not that there is of only that it is a by and is in and the at is to on a of the of by particular data in that this question is an assessment and a matter of The definition of ‘personal information’ in the Privacy Act the scope of ‘personal information’, only that the data are about an identified or identifiable and not that the data to the of the individual. if genomic data are about an individual who is reasonably it is captured (and will be ‘personal of the genomic data are used to the individual. The information in the data environment is When data are information may be public as the or available data data be on a as well as data be at or by for an individual or data information such and of and is also available to of the such as available to or information available to In such as clinical information about the to the genomic data may be there is the personal information by about with they and genomic data are all of information are available within the of data The to linking genomic data with available data, data, in a number of of genomic data and other data, or also that be from this research is that of genomic data, and the of information that sharing genomic data of of In while controls may be effectively in there may be information’ available to within an the In the a of information’ available to a within with data health information number of of to and Australian and of in a the of such information must be in if genomic data be and of controls and may be to an assessment of must also the or who and the other information entities may and their to available to to an individual to the data data are the or are in the of the is to the of the of the however, the law such as the and available to the or the is the it is to the and available to a data may also in the likelihood that will be the genomic data with a particular individual. that or is when data are with to linking genomic data to an the of is to and applying the concept of the a a to the or of a data and who available information for of that the to for a of and need not be that it is not to when a of the public will be a is to with the and of that a data is and by on the of and to linking the data to an individual may be with in the of the In an the and of or of the data are and there is that be to and the of a This to the likelihood of an with an identifiable individual being The in data are of an The first is with as to who may the data or they may do with and there is or on the of the if are to to the and of the for the data may be used and be genomic data on a are at of being personal information under the Privacy Act. The also to in a must and to the for of the data, and the to the data at a particular subject to the as is as the of research data This to a in the the data, is in a to an in the data, being able to and the the for are to the of a data environment within the by the such as who they within data data and and all the assessment of the genomic data in may be with as that genomic data are upon in the it is still to the data with other information with an identified or identifiable individual. This article with the question: when are genomic data ‘personal information’ and subject to Australian privacy this this article of genomic data, the definitions of ‘personal information’ and ‘genetic information’ in the Privacy and the legal test of as to genomic The that a to the question of when genomic data are personal information is not the article the and to the of the identifiability of genomic data, such as those that be by a of this article is that the legal and scientific of information (or genomic the to data to an or genomic may be The scientific of genomic data is with distinct of and of particular The legal of information is a and is the legal concept of ‘personal information’ in Australian privacy genomic data are not personal they be When applying the law to in scientific are ‘genomic data’, may the of the distinct are In other when applying the law to in scientific are ‘genomic data’, should the legal and scientific for the of and it may be to the legal term ‘genetic information’ to to the by law and to of the term ‘genomic data’ to that by and ‘Personal information’ in the Privacy Act must be about an identified or identifiable The to the identifiability of genomic data on the of and while and are they when from a particular data be is with to the data, the and the relationship between assessment of the ‘genomic data the features of the genomic data in question with data and such as the to to the data is or the of information in the data environment and the the or entities or the genomic is only and all of and the in they that the identifiability of a the genomic data are be and the question of the data are personal information data may also be is not and as a of or in or The of identifiability is an and the of genomic data may a for the identifiability and the legal of genomic data Privacy Act protection is the scope of this However, the and provided to the must be in such of the features of the genomic data, and in particular and of the of the data and and of data are to assessment of the data and data environment with to the of it the information available with the and of those or the data and the controls and in the a for in with the of the particular data is question that such an is and However, a understanding of the to the identifiability of genomic data will a of and the of genomic data and the privacy of those who of this at the Australian the and at the of and at an Australian The at for their The also and for their and