Consumer Protection, Genetic Discrimination, and Privacy — The Issues

Genetic literacy — Not understanding what you don't know?

In spite of the slow process of developing legitimate clinical diagnostic tools for multifactorial diseases, public interest in DNA technology, and the information it can reveal, has never been stronger.

A consequence of the increased publicity genetic research has received in recent years is heightened enthusiasm about genetics, which has not been accompanied by a popular understanding of the limitations of the current state of scientific knowledge, or its implications.^[608] Daily reporting in mainstream media headlined with “Scientists discover link between gene and (insert medical condition here)”,^[609] frequently based on the results of GWAS reported in scientific literature directed at an informed researcher audience, rather than the layperson, creates a misperception amongst the public that: a) a comprehensive and very accurate diagnostic test may now be available; that b) treatment will be available, either immediately or in the near future; and that c) the results of testing are readily interpretable. This perception conflicts with the reality that such testing is generally only extremely preliminary in nature, and that the association between the gene and the condition may never be substantiated sufficiently to form the basis of an approved diagnostic test, for a range of reasons.

Misperceptions such as these create the perfect environment for the exploitation of genetically interested but naive individuals, who are parted from their money in exchange for statistically complex, but clinically weak, genetic tests purporting to identify whether a person is at risk of developing a particular condition.

Even so-called “recreational genetics” service providers may be a cause for concern, as many of the consumer protection and privacy issues remain the same.^[611] Those services target their marketing towards people interested in ancestry — see which genes you share with Martin Luther King, Kylie Minogue or Barack Obama — or physiological markers (or simply acquisition of a fashion statement, alongside companies that offer to turn a map of your DNA into “unique artwork”),^[612] rather than in clinical predictors.

It is against this background that we have witnessed the rise of global DTC models of marketing genetic testing. Consumers appear to be engaging with the services because provision of samples is fashionable,^[613] because individuals are concerned to gain information that supposedly allows early diagnosis and even treatment of disorders, because provision benefits all humanity by contributing to a better understanding of the “book of life” or because DTC genetic testing resonates with the values of autonomy and self-actualisation that are apparent in contemporary popular culture.^[614]

The multinational nature of some DTC genetic testing companies raises concerns on several fronts. Some companies have adopted strategies of distributing the activities of their business amongst jurisdictions that provide more permissive data storage, laboratory accreditation, privacy, and consumer protection regimes. Concerns about distribution of roles and responsibilities across jurisdictions are not restricted to the genetic testing sector — they are increasingly being voiced in relation to the data storage and processing in the global “cloud” and in much e-tailing activity. It is important to recognise, however, that the global collection of genetic data by an enterprise located in Iceland, Alaska or the Caymans is potentially more problematical than the purchase by an Australian consumer of a woolly jumper or DVD from Amazon.com.

Buyer beware? Consumer protection and DTC

Consumer protection is one of the most obvious issues in relation to this model. Although costs are rapidly falling, DTC testing is not cheap. Depending on the test, consumers can typically expect to pay several hundred to several thousand dollars.^[616] Samples are returned from consumers to the company by mail, and results are typically returned by email or website. Access to that website might be for a limited period.

There have been several reported instances of consumers simply not getting what they pay for: either the test is from someone else’s sample (eg male clients returning female-specific test results), or experiencing substitutions in the tests performed.^[617] Additional consumer issues have arisen when consumers have purportedly had identical tests performed by two separate providers, and received contradictory results, something that raises questions about the proficiency of the testers and about the way that the data is expressed.^[618]

A joint report released by the European Academies Science Advisory Council and the Federation of European Academies of Medicine in 2012 was scathing in its assessment of the industry, stating

On the whole, DTC GT (Direct-to-consumer genetic testing) has little clinical value at present and, on occasion, has potential to be harmful. We would not wish to encourage European Union citizens to use DTC GT at present. We suggest special caution about DTC GT in several specific respects, for example relating to testing for high penetrance, serious disorders, prenatal screening, and nutrigenomic and pharmacogenetic testing. In developing general principles for the management of consumer genetic services, we emphasise that regulation must be on the basis that claims about the link between genetic markers and disease are scientifically valid.

The US Government Accounting Office in 2010 condemned the DTC testing sector for deceptive advertising, nonsensical claims, “test results that are misleading and of little or no practical use”, “contradictory results” and “DNA-based disease predictions that conflicted with... actual medical conditions”.^[620] It is notable that those criticisms are consistent with authoritative medical and scientific literature on DTC, some of which is noted in citations throughout this chapter, but are independent of the specialist regulators. In Australia for example the NHMRC has identified concerns as late as 2012.

Just as importantly, there are questions about consumer interpretation of the information provided by the services. The DTC model is, in essence, one of convenience rather than authority and meaningful interpretation by specialist medical practitioners.

DTC genetic testing is problematical because the services operate across national borders and outside conventional regulatory frameworks that centre on diagnosis by medical practitioners or the promotion and delivery of pharmaceuticals. Those services are also problematical because there are persistent questions about the quality of testing (different services provide substantially different reports regarding samples from the same people) and about the advice consumers receive on the basis of those tests.

In many instances, the multinational structure of providers and the use of opaque online boilerplate makes it unclear to consumers what their rights are.^[621] As indicated above, they may mistakenly believe that the consumer protection laws in Australia apply to these services, when in actual fact the services may be performed in the US, Asia, or Europe, under a vastly different (or indeed non-existent) consumer protection regime.

Consent and privacy protection: Yours, mine, or ours?

Consumer protection is not the only issue raised by the multi-national operation of DTC providers. From a privacy perspective three additional concerns are apparent.

The first is that of consent. It is unclear whether consumers are aware of what use currently is or might in future be made by the service providers and third parties with information gathered through sample collection. What rights do consumers have under national and international law?^[622]

In orthodox clinical medicine, it no longer acceptable for a clinician to leave a patient floundering in the dark with respect to understanding their choices. As the Australian High Court decision in Rogers v Whitaker^[623] makes crystal clear, a patient’s consent must be based on an understanding of the risk factors which are important to them — not the factors a “body of medical men”,^[624] or anyone else, would consider to be important, but the factors that could reasonably be expected to be of importance to the patient.

Although the Court rejected the use of the terminology “informed consent”,^[625] as placing too much emphasis on the provider of the consent, and not enough on the provider of the information the consent was based on, the concept has still crept into Australian law. What is clear, based on the decision, is that valid exercise of consent can only occur when patients or consumers have a complete understanding of all the relevant information.

The reliance some clients of DTC services are likely to place on the results they receive is of concern, given that some consumers will perceive “DNA as destiny”, based on their own lack of genetic literacy, and lack of access to the support of professional counsellors. Some may make fundamental life choices (eg commit suicide, not have children, not invest for old age on the basis of expectations about an early death) or experience severe depression attributable to what they incorrectly construe from a DTC report as their genetic fate.

In the event that Australian regulators do not address the shortcomings of DTC both adequately and publicly, there is the potential for consumers who do undertake testing to be driven underground, and feel too embarrassed to discuss the results of their test with their own doctors, in case their doctor feels that they lack trust in them, or because they feel stupid for having the tests done, or even because they feel stupid for not fully understanding them. In the event that regulatory intervention drives the DTC market underground, there is a significant risk that patients will make decisions by giving undue weight to the results of DTC.

Although data from recreational providers is less likely to be considered in clinical patient decision-making, it still raises similar additional issues to clinical DTC that are inadequately considered by many consumers, particularly pertaining to privacy and disclosure concerns. Many of these providers are storing leftover samples for the purposes of creating DNA biobanks suitable for sale to third parties for further exploitation, often without the knowledge or consent of the consumer.^[626] Consumers do not own the results of the tests and typically the buccal swabs or other samples become the property of the service provider.^[627] There are no global protocols for rights in those samples or associated data if the service provider is acquired or goes into receivership, at which time its most significant asset might be data collected about people across the globe.^[628]

The second concern is that consumers may not realise that by providing samples of their own DNA for analysis, they are by implication revealing genetic information about their relatives, potentially allowing the service provider and associates to build a genetic profile of those relatives. When you provide a spit sample or swab from your cheek you are implicitly providing genetic data about your siblings, a gift of data that may be received, processed and disseminated in a legal regime that has significantly lower privacy protection than Australia. Those relatives of course have not consented to the provision of information, and indeed may be unaware that individual/familial profiling is taking place in a jurisdiction that lacks the regulatory protections that are axiomatic in their place of residence.

Recent amendments to the Australian Privacy Act now provide scope for doctors whose patients have genetic conditions to contact the relatives of those patients, without the patient’s consent, and advise those relatives that they may potentially have the same genetic predisposition.

To be permitted to disclose genetic information, such as is obtained from DTC genetic testing, to another person, such as a genetic relative, without the authorisation of the patient, the doctor must reasonably believe that disclosure is necessary to prevent a serious threat to the life health or safety of a genetic relative of the patient.

The NHMRC, in its recently released for comment draft guidelines for practitioners on DTC testing, advises that doctors may, under the amended Privacy Act, be able to advise relatives of a patient of the results of that patient’s DTC testing, again without the consent of the patient. In a submission to the public consultation process, these authors raised concerns about that advice, primarily that disclosure without consent, under the amended Privacy Act, requires that there be a reasonable belief that disclosure is necessary to lessen or prevent a serious threat to the life health or safety of their genetic relatives.^[629]

As discussed above, the evidentiary base underpinning DTC genetic testing is weak; while many of the tests may be of utility in research, in the vast majority of cases there is either insufficient evidence of a statistically significant association between the test and manifestation of the disease; inadequate understanding of the role of other genetic factors in contributing to manifestation of a multi-factorial disease; or the association is simply too weak to be of any clinical use.

Having regard to these well-documented limitations of DTC genetic testing, therefore, it is inconceivable that a doctor could form a reasonable belief that disclosing the results of such tests would lessen or prevent a serious threat to anyone — including the patient they directly relate to — much less a genetic relative. Advising the genetic relatives of a patient that the patient has tested positive for a weak genetic marker which may or may not be clinically relevant in diagnosis of a specific medical disease, according to a mail-order laboratory which may or may not meet the accreditation requirements for criteria including sample handling and quality control, without at the very least seeking confirmation through clinically validated and regulatory approved tests, is not going to advance the health interests of the patients relative in any meaningful way, and the disclosure is, therefore, unreasonable. This lack of reasonableness will therefore render the doctor’s disclosure unlawful.

Furthermore, even referring to the provisions permitting disclosure without patient consent in the draft guidelines induces a belief that there may be grounds under which disclosure under the amendment might be permitted, which, if a practitioner were to rely on, could conceivably see them facing litigation for breach of privacy and confidentiality.

The authors have opposed the inclusion of the textbox in the guidelines on the basis that the scientific literature comprehensively opposes the use of DTC genetic testing as a diagnostic tool, based on its lack of clinical utility and validity, and as such it could never be reasonable for a doctor to contact a patient’s relatives and advise them of the results of the patient’s DTC genetic testing, because the link between the disease and the gene is, at this stage, far too tenuous to justify breach of the patient’s confidence on those grounds alone. Clearly, legislative interpretations such as these from a body entrusted with drafting guidelines on implementation of the Privacy Act in the medical context calls the independence and objectivity of the NHMRC, as advisors to the regulators entrusted with protecting the privacy rights of Australians, into question.

This recent development demonstrates that even in a country like Australia, which claims to have a high degree of regard for individual autonomy, our privacy protections are vulnerable, especially in the context of genetic privacy.

In considering those concerns we might look to two framework documents: the 2011 Opinion on Consent produced by the Article 29 Working Party and the 2012 Privacy and Progress in Whole Genome Sequencing report from the US Presidential Commission for the Study of Bioethical Issues.

The Article 29 Working Party is an independent European body concerned with data protection and privacy. It was established under Article 29 of Directive 95/46/EC (ie the overarching European Data Protection Directive that shapes national privacy law in the EU member states).^[630] Its 38 page Opinion (15/2011)^[631] reflects the European Commission’s commitment to “clarifying and strengthening the rules on consent”, given a recognition that although the current EU rules provide that the individual's consent for processing personal data should be a “freely given specific and informed indication” of wishes, those conditions are currently interpreted differently in the EU member states.

The Opinion confirms that consent should be freely given, specific and informed, giving individuals enough detail to make a decision about how their personal data will be used. Where explicit consent is required to process sensitive personal data (such as health records) the Opinion indicates that an individual must expressly agree — whether orally or in writing — to the processing of the personal data. Consent on the basis of an individual’s inaction is not sufficient. Individuals should also be able to withdraw their consent, preventing any further processing of their personal data.

The Working Party states that —

Consent is one of several legal grounds to process personal data. It has an important role, but this does not exclude the possibility, depending on the context, of other legal grounds perhaps being more appropriate from both the controller’s and from the data subject’s perspective. If it is correctly used, consent is a tool giving the data subject control over the processing of his data. If incorrectly used, the data subject’s control becomes illusory and consent constitutes an inappropriate basis for processing.

The Opinion further notes that

The relevance of consent as an enabler of the individual’s autonomy and self-determination relies on its use in the right context and with the necessary elements. Individuals who have consented should be able to withdraw their consent, preventing further processing of their data.

Is that withdrawal of consent meaningful when consumers are dealing with a DTC testing provider that is located in another jurisdiction and that may have been dealing with genetic information in a way that has not come to the individual’s attention and that may not be readily verifiable?

The Opinion, in identifying specific elements of the EU legal framework related to consent, comments that

For consent to be valid, it must be freely given. This means that there must be no risk of deception, intimidation or significant negative consequences for the data subject if he/she does not consent... Consent must be specific. Blanket consent without determination of the exact purposes does not meet the threshold.

Consent must be informed. the information provided must be sufficient to guarantee that individuals can make well informed decisions about the processing of their personal data. The need for consent to be “informed” translates into two additional requirements. First, the way in which the information is given must ensure the use of appropriate language so that data subjects understand what they are consenting to and for what purposes. This is contextual. The use of overly complicated legal or technical jargon would not meet the requirements of the law. Second, the information provided to users should be clear and sufficiently conspicuous so that users cannot overlook it. The information must be provided directly to individuals. It is not enough for it to be merely available somewhere.

Those statements in the Opinion are not part of Australian law. However, they highlight questions about whether Australian and overseas consumers are truly informed and validly consenting when using DTC testing services that are located in another jurisdiction and that rely on vague (or difficult to identify) indications of how genetic information will be used, shared and deleted.

The Privacy and Progress in Whole Genome Sequencing report, by the US Presidential Commission for the Study of Bioethical Issues,^[632] also has no force under Australian law and may be disregarded by US legislators. It does however complement the Article 29 Working Party Opinion by highlighting concerns about genetic data.

The Commission concluded that:

to realize the enormous promise that whole genome sequencing holds for advancing clinical care and the greater public good, individual interests in privacy must be respected and secured. As the scientific community works to bring the cost of whole genome sequencing down from millions per test to less than the cost of many standard diagnostic tests today, the Commission recognizes that whole genome sequencing and its increased use in research and the clinic could yield major advances in health care. However it could also raise ethical dilemmas.

The report accordingly considers:

the most feasible ways of reconciling the enormous medical potential of whole genome sequencing with the pressing privacy and data access issues raised by the rapid emergence of low-cost whole genome sequencing. The life-saving potential of genome sequencing depends on gathering genetic information from many thousands (perhaps millions) of individuals, most of whom will not directly benefit from the research. Those who are willing to share some of the most intimate information about themselves for the sake of medical progress should be assured appropriate confidentiality... Without such assurance in place, individuals are less likely to voluntarily supply the data that have the potential to benefit us all with life-saving treatments for genetic diseases.^[633]

Unsurprisingly the report emphasises

the principle of respect for persons, which requires strong baseline protections for privacy and security of data, while public beneficence requires facilitating ample opportunities for data sharing and access to data by clinicians, researchers, and other authorized users. Respect for persons further requires that any collection and sharing of individual data be based on a robust process of informed consent. Responsible stewardship calls for oversight and management of whole genome sequence information by funders, managers, professional organizations, and others... Respect for persons implies not only respecting individual privacy, but also respecting research participants as autonomous persons who might choose to share their own data. Public beneficence is advanced by giving researchers access to plentiful data from which they can work to advance health care. Regulatory parsimony recommends only as much oversight as is truly necessary and effective in ensuring an adequate degree of privacy, justice and fairness, and security and safety while pursuing the public benefits of whole genome sequencing. Therefore, existing privacy protections and those being contemplated should be parsimonious and not impose high barriers to data sharing. While the Commission supports the intellectual freedom this access will encourage, clinicians and researchers must also act responsibly to earn public trust for the research enterprise.

A girl called GINA? Or something else...

Other privacy-related issues raised by DTC genetic testing include mandatory disclosure of results under some circumstances, which may be unfavourable in the case of analysis of behavioural traits, for example, and the potential for discrimination on the basis of genetics. Referred to as the “GATTACA” problem, based on the 1997 film of the same title, it relates to the geneticisation of opportunities afforded to individuals on the basis of their DNA profile.^[634]

In Australia, it is unlawful for providers of health insurance to refuse to provide, or adjust premiums on, the basis of genetic predisposition to certain conditions. This is not, however, the case with respect to life insurance or travel insurance, or other classes of risk-based personalised insurance. Under Part IV of the Insurance Contracts Act 1984 (Cth), any information which is relevant to the policy issuer must be disclosed, otherwise any payments made under the policy can be challenged on the basis of non-disclosure. Relevant information requiring disclosure would include the results of genetic testing, including DTC genetic testing.^[635]

While it is unlikely that many insurers would significantly alter their practices on the basis of DTC test results at this stage, in the future, once a greater number of GWAS are scientifically verified as being of clinical utility and validity, this situation may change. Unfortunately, however, the patient’s genome will not. The results of that “fun” test they took as a teenager to determine how much they have in common with Justin Bieber may come back to haunt them as a 50 year old when they are refused life insurance on the basis that they are at an increased risk of having a heart attack based on updated knowledge about those gene associations.

Other areas where the potential for genetic discrimination is ripe include employment and migration. Similar to the experiences of some employees who participated in “team-building” personality profiling activities, only to discover that their “profile” made them “unsuitable” for their job, the clear potential exists for employers to utilise DTC genetic in a similar way. Want to make someone redundant, but can’t decide who? What better way than to take a look at their DTC genetic testing profile, and hazard a guess which employee will use more sick leave in the next few years, and get rid of them? Likewise, it is conceivable that in the absence of legislation and international legal frameworks specifically prohibiting the use of genetic data in this context, countries considering citizenship applications may be influenced by the information in their decision-making processes, to avoid absorbing the long-term costs of providing healthcare resources to chronically ill people.

Although recent research in Australia shows that the incidence of genetic discrimination is relatively infrequent,^{[636] [637] it is still there — which is frightening in itself, considering how much DTC genetic testing has taken off since the research was completed. Although our federal Disability Discrimination Acta includes “genetic discrimination” as a type of prohibited discrimination, it is by no means comprehensive, and there will continue to be situations where DTC test results, in the wrong hands, can be used to exploit people, either intentionally, or through lack of understanding of what those results actually mean. The US has recently released new legislation dealing specifically with the issue of genetic discrimination. Called the GINA — Genetic Information Non-discrimination Act[638] — it specifically prohibits discrimination against people in employment and access to health insurance on the basis of their genetic makeup. Only time will tell how effective this legislation proves to be for clients of DTC genetic testing services discriminated against by US entities; problematically, though, it will provide no protection to them offshore.}