International and National Legal Approaches to the Protection of Genetic Information

Gazina Nayana Igorevna ORCID: 0000-0002-8642-4458 Postgraduate student of the International Law Department, Kutafin Moscow State Law University (MSAL) 123001, Russia, Moscow, Sadovaya-Kudrinskaya str., 9 nayana.gazina@mail.ru Other publications by this author

The research was carried out at the expense of the grant of the Russian Science Foundation No. 19-18-00422, https://rscf.ru/project/19-18-00422 /.

The protection of genetic information and personal data of patients is a legal problem that does not lose its relevance, but, on the contrary, attracts more and more attention. Now, in almost all developed countries, most of the medical information is contained in digital form, which facilitates access to it, this is necessary when a patient is led by several doctors from different medical organizations, and simplifies the patient's access to information about his health. At the same time, the relative ease of access to medical information creates threats of access to it by third parties, uncoordinated dissemination of private information, which may entail adverse consequences for the patient and his relatives.

Let's consider the main approaches to the problem of protecting genetic information at the international and national levels.

There are two main approaches to securing and protecting genetic data:

1. protection of genetic data through medical data, biometric data, personal data in general, through the right to privacy protection;
2. protection of genetic data through specialized regulations on the confidentiality of genetic information.

International legal protection of genetic informationConfidentiality of medical information is a person's claim to control the circumstances under which personal information about his health is collected, used, stored and transmitted ^{[1, p. 316]}.

Genetic information is a narrower concept, but in some cases it is covered by the concept of medical information. The confidentiality of personal data, including medical and genetic data, can be protected by many international acts, including those that have existed for quite a long time, the European Convention on Human Rights (article 8), the American Convention on Human Rights (article 11) through the right to privacy, the International Covenant on Economic, Social and Cultural Rights – through protection family, maternity (article 10), the right to the highest attainable standard of health (article 12). These international treaties provide specific mechanisms for the protection of the rights enshrined in them (the European Court of Human Rights, the Inter-American Court of Human Rights, the UN Committee on Economic, Social and Cultural Rights), which is a great advantage and makes it possible to apply the provisions of these treaties in situations that violate the right to the protection of genetic data, using the mechanism of interpretations.

The Convention on the Protection of Human Rights and Dignity in Connection with the Application of Advances in Biology and Medicine (Oviedo Convention) protects human genetic data by distinguishing between medical information related to the right to respect for privacy and the right to information ^[2].

International standards for the protection of genetic information directly are reflected in such specialized international instruments as the 1997 Universal Declaration on the Human Genome and Human Rights and the 2003 International Declaration on Human Genetic Data. These documents enshrine the right to protect the confidentiality of genetic data, the right of a person not to be discriminated against on the basis of genetic data. The corresponding obligation of the State arises from the law to prevent the emergence of discriminatory conditions, to ensure the confidentiality of information. The International Declaration on Human Genetic Data defines human genetic data as information about the inherited characteristics of individuals obtained by analyzing nucleic acids or by other scientific analysis and fixes the special status of such data, listing the reasons why such information should be specially protected. Human genetic data have a special status for the following reasons: i) they may indicate manifestations of the genetic predisposition of the person concerned; ii) they may have, over several generations, a significant impact on the family, including descendants, and in some cases, on the whole group to which the person concerned belongs; iii) they may contain information, the meaning of which may not be known at the time of collection of biological samples; iv) they may have cultural significance for individuals or groups of individuals (article 4 of the International Declaration on Human Genetic Data).

In both of these declarations, the protection of genetic information is enshrined directly, and not through the right to protect medical data or personal data in general. However, the declarations are not legally binding international acts, they are advisory in nature, proclaim common values, standards of legal regulation in this case in the field of application of genetic technologies. The declarations have a "guiding" meaning, but do not have mechanisms for ensuring and protecting rights, while they propose the creation of such mechanisms at the national level in the form of independent, multidisciplinary and pluralistic ethics committees, which are designed to consider ethical, legal and social issues that arise in connection with scientific research, to participate in establishing standards, regulations and guidelines concerning the collection, processing, use and storage of human genetic data (article 16 of the Universal Declaration on the Human Genome and Human Rights, article 6 of the International Declaration on Human Genetic Data). In addition, national ethics committees should be consulted on issues in the field of application of genetic technologies that are not regulated by domestic law.

Another act that, with the entry into force of the amendments, will directly mention the protection of genetic data is the 1981 Convention on the Protection of Individuals with Regard to Automated Processing of Personal Data (hereinafter referred to as the Convention on Automated Data Processing), created within the framework of the Council of Europe. In article 2, the Convention on Automated Data Processing broadly defines the concept of "personal data" and means "any information about a certain or identifiable natural person", and "data processing" means data storage, logical and/or arithmetic operations with this data, their modification, destruction, search or distribution. The Protocol on Amendments to the Convention on the Protection of Individuals with Automated Processing of Personal Data of 2018 (hereinafter referred to as the Protocol) provides for the expansion of the "special category" of confidential data, which should include genetic and biometric data. The Protocol will enter into force from the moment all parties sign the Convention on Automated Data Processing or on October 11, 2023, if there are less than 38 parties to the Convention on Automated Data Processing that have ratified the Protocol by that date. The Protocol was signed by Russia, but has not been ratified at the moment. After ratification, the relevant amendments should be made to federal legislation – Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".

The practice of the European Court of Human Rights (hereinafter referred to as the European Court, ECHR) is significant for the area under consideration. The European Court in the process of considering cases gives an official interpretation of the European Convention on Human Rights of 1950 (hereinafter – the European Convention, ECHR), which should be taken into account in its national practice by all countries participating in the ECHR.

Respect for the confidentiality of human health data is an essential principle of the legal systems of all ECHR participants. Without such protection, those who need medical care may refrain from communicating personal and intimate information necessary for treatment, and thereby endanger their health, and in the case of contagious diseases, public health ^[3]. The European Court recognized that the collection of cellular material and its storage, as well as the determination and storage of DNA profiles taken from cell samples, constitute an interference with the exercise of the right to respect for privacy enshrined in paragraph 1 of Article 8 of the Convention ^{[4, §§ 71-77]}, however, this conclusion may not apply to the taking of and storage of DNA profiles of convicted criminals for possible use in subsequent criminal proceedings ^{[5, §§ 42, 49]}. Nevertheless, such interference with persons convicted and serving a sentence would be a violation of article 8 of the Convention if it cannot be justified by paragraph 2 of this article as "provided for by law" and as "necessary in a democratic society" to achieve the set goal or goals ^{[6, §122]}, for example, if DNA samples are stored longer, than stipulated by law ^[7].

The right to privacy also applies to cases when it comes to ensuring the confidentiality of information about a person's HIV status, since the disclosure of such information can have devastating consequences for a person's private and family life and his or her social and professional status, including stigmatization and possible isolation ^{[6, § 123]}. The measure of interference with the right to privacy is disproportionate and cannot be compatible with article 8 if it is not justified by a more significant requirement of the public interest, the interests of the applicant himself or the interests of the safety of hospital staff ^{[3, § 96]}.

In addition, the withdrawal of consent or permission for research in which biological materials and related data are used requires special attention. National legislation may contain provisions that identifiable data and biological materials must be destroyed and not used in the future. Other solutions may also be proposed at the national level — for example, a ban on the use of data in specific studies for a certain time or the storage of material in biobanks in a depersonalized form ^[8].

The right to confidentiality and protection of the patient's personal data was discussed above. However, there is another, no less important right protected by the same Article 8 of the ECHR – the right of a person to access information concerning his private life. Often in practice there are situations of "collision" of the right of one person to maintain the confidentiality of his data with the right of another person to receive information directly related to his private life – these are like the rules of determining kinship, motherhood, paternity. The European Court considers that issues relevant to personal development include details of an individual's identity as a person and a vital interest protected by the Convention in obtaining information necessary to establish the truth about important aspects of a person's personal identity, such as the identity of his parents, his origin, aspects of his childhood and early stage of development ^[9]. The birth and, in particular, the circumstances in which the child was born are part of the private life of the child, and then of the adult, guaranteed by article 8 of the Convention ^{[6, § 127]}. The Court considers that the interests of a person requiring access to documents relating to his private and family life should be ensured if the person who compiled these documents is either absent or unreasonably does not give his consent to access to them. Such a system meets the principle of proportionality only if it provides that an independent body makes a final decision on granting access in cases when the author of the documents refuses to answer or does not give his consent ^{[6, §128]}.

 National approaches to the protection of genetic informationIn the USA, genetic information can be protected both by general rules on the protection of medical data and by a special act on protection against discrimination based on genetic information.

The Law on Confidentiality of 1974 (Privacy Act of 1974) contains provisions on the protection, including medical information, prohibits the disclosure of such data without the consent of the person to whom this information relates ^[10].

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes rules for the exchange of personal medical information and its protection from misuse.  The law allows people directly involved in the care of the patient or in paying for services to see information about the patient. Employers, specialists in attracting funds for insurance or other persons wishing to access information cannot obtain it without appropriate grounds, for example, direct participation in providing insurance payments to a person or use for official purposes (work with claims, internal accounting for invoicing clients based on the time spent, etc.) ^[11].HIPAA is based on two important principles: privacy and confidentiality. The inviolability of private life includes the right of a person to limit the amount of information and the circle of persons who can access information about his health status. This also includes the right to discuss treatment issues in places where other people will not be able to accidentally hear them. Confidentiality includes the duty of a healthcare professional to preserve information in such a way that it is not disclosed without the consent of the patient, except in cases where this is required by law or is considered necessary for clinical reasons ^[12].

Since 2008, the US has a Law prohibiting discrimination based on genetic information (Genetic Information Nondiscrimination Act, GINA), which does not allow discrimination based on genetic information in the employment of a person and health insurance. GINA prohibits employers from receiving genetic information from such a subject or a member of his family, except in cases stipulated by law, such as, for example, the voluntary provision of information by a person as part of a health program ^{[13, p. 19]}. In addition, there are laws on the protection of genetic data separately from some US states (for example, in Kentucky, Illinois, California).

A separate law on the protection of genetic information, Genetic Information Law, 5761-2000, is also in force in Israel, and it was adopted a long time ago, in December 2000. The Act describes the conditions for the use and protection of data containing information about DNA, the provisions on licensing organizations conducting genetic testing, enshrines the principle of non-discrimination based on genetic information.

In France, on the contrary, there is no separate law on the protection of genetic information, it is indicated in general documents on the protection of personal data. The basic law on the protection of personal data in France is Law No. 78-17 of January 6, 1978 "On data processing, data files and personal freedoms" (Loi n° 78-17 du 6 janvier 1978 relative ? l'informatique, aux fichiers et aux libert?s), (hereinafter referred to as Law No. 78-17), it has repeatedly Amendments were made, in particular, to implement the General Data Protection Regulation (hereinafter – GDPR), adopted at the EU level, into national legislation. Both in the French Law No. 78-17 (Article 6) and in the GDPR, genetic data are directly assigned to a special category of personal data.

The advantage of fixing the norms on the protection of genetic data directly in national acts is the opportunity to go to court referring to a violation of the confidentiality of genetic data. Genetic data may not always be considered a medical secret at the same time, in addition, it is necessary to find out which personal data protection regimes should be applied to such data if they are not explicitly named in the legislation.

In Russia, genetic data is protected through legislation on the protection of personal, in particular, biometric data, and through the rules on medical secrecy. The basic acts in this area are Federal Law No. 152–FZ of 27.07.2006 "On Personal Data" and Federal Law No. 149-FZ of 27.07.2006 "On Information, Information Technologies and Information Protection".

Genetic data may belong to different categories of personal data, to special and biometric personal data, depending on the nature of the information, the purpose of storage and use. In the Ruling of the Justice of the Peace of the Judicial precinct No. 1 of the Sovetsky Judicial District of Novosibirsk dated July 07, 2017 in case No. 5-324/2017, the judge did not agree with the qualification of genetic data as biometric, since in a particular case data was not used for the purpose of identifying a person, and the results of the analysis of genetic data alone could not allow to identify a person (several polymorphic DNA loci were studied). Depending on which category of personal data the processed genetic data will be assigned to, the applicable levels of security of the information system in which they are stored and processed will also be determined ^[14]. In addition, genetic information can be protected by ensuring the confidentiality of medical data, through the obligation to maintain medical secrecy. In accordance with Article 13 of Federal Law No. 323-FZ of 21.11.2011 "On the basics of protecting the health of citizens in the Russian Federation", medical secrecy consists of information about the fact of a citizen's request for medical care, his state of health and diagnosis, other information obtained during his medical examination and treatment. Disclosure of information constituting a medical secret to other citizens, including officials, for the purpose of medical examination and treatment of a patient, conducting scientific research, their publication in scientific publications, use in the educational process and for other purposes is allowed with the written consent of a citizen or his legal representative.

The State Duma of the Russian Federation is considering a draft Federal Law "On Amendments to Article 1 of the Federal Law "On Personal Data" regarding the processing of Biometric Personal Data" (hereinafter referred to as the Bill), which provides for amendments to Federal Law No. 152-FZ of July 27, 2006 "On Personal Data", aimed at ensuring the protection of information about a person obtained from his biomaterial containing genetic information. The bill proposes to include genetic data in the category of biometric. It is worth noting that this bill was submitted to the State Duma in July 2019. According to information from the website of the legislative support system, the last significant actions to work with this bill were carried out more than a year ago. From this it can be concluded that at present this issue is far from priority tasks for the legislator.

ConclusionBased on the analysis of the regulatory framework in the field of protection of genetic information, the following conclusions can be drawn.

Genetic data is covered by the concept of personal data and medical data, however, both at the international and national levels, protection regimes for such data can be fixed by specialized acts.

At the international level, the protection of genetic information is carried out mainly through the right to privacy. It is the broad interpretation of this right that makes it possible to effectively protect the confidentiality of data of various kinds, including those containing information about DNA. Acts on the protection of human rights of a general nature (the European Convention on Human Rights, the American Convention on Human Rights, the International Covenant on Economic, Social and Cultural Rights), unlike declarations, not only proclaim rights, but also have specific mechanisms for the protection of these rights, which makes it possible to file a complaint about the violation of human rights by States in the sphere in question. At the same time, acts of soft law, declarations, although they cannot ensure the binding implementation of their provisions and establish a control mechanism due to their advisory nature, perform an important, "orienting" function, revealing in detail possible methods of regulation and protection of genetic data by states, establish standards, following which it is possible to effectively organize legal regulation in this area. Many countries follow these standards, for example, they create ethical committees recommended by declarations, designed to assess the ethical, legal and social risks that arise from the use of genetic data in scientific research, to participate in the establishment of standards and norms concerning the collection, processing, use and storage of human genetic data.

At the national level, the mode of working with genetic data is determined either by special acts (there are such acts, for example, in the USA, Israel), or genetic data is indicated in the list of personal data and, as a rule, the mode of their use is established (for example, in France), or through the norms on personal data protection without specifying genetic data in the list data, through biometric data or through the rules on medical secrecy (for example, in Russia). The first two variants of the regulatory consolidation of the protection of genetic data – through the creation of separate norms on genetic data (in a special law or by naming in the law on personal data) – allow courts to refer directly to the violation of the modes of use of genetic data. In this case, there is no need to prove their classification as biometric, nor is it necessary to have a treatment situation, as in the case of protection through the rules on medical secrecy.  Such normative consolidation creates an advantage in practice when it is necessary to protect human rights in this area.