Who Monitors Biobanks? The Need for an Oversight Authority · ii Who Monitors Biobanks? The Need for an Oversight Authority Eleana Rodriguez Master of Laws Graduate Department of

Who Monitors Biobanks?

The Need for an Oversight Authority

by

Eleana Rodriguez

A thesis submitted in conformity with the requirements for the degree of Master of Laws

Graduate Department of the Faculty of Law

University of Toronto

© Copyright by Eleana Rodriguez, 2014

ii

Who Monitors Biobanks?

The Need for an Oversight Authority

Eleana Rodriguez

Master of Laws

Graduate Department of the Faculty of Law

University of Toronto

2014

Abstract

Biobanks are essential for developing innovative solutions to address human health challenges,

including disease prevention and the development of personalized medicine.

At the same time such biobanks pose unique legal and ethical challenges, and raise many as yet

unanswered questions, including how the collection of biological samples and information

should be governed. I suggest that biobanks should have a clear regulatory structure and

oversight system. I examine, in particular, the need for an oversight authority, arguing that the

self-governance trend is not sufficient enough to ensure that all biobanks have proper governance

practices, and that some formal regulation is needed to protect the integrity of research

participants and to guarantee the security and confidentiality of the participants’ information. I

examine two Canadian models: a) the authority model that requires approval from the privacy

commissioner, and b) the stewardship committee that is a statutory access committee. Both

models could exist by enacting legislation in the biobanking context. Central to my arguments is

the concept of the "authority" to monitor the biobanks. From this, I suggest that robust biobank

iii

governance mechanisms require not only their own governance system but that these must

necessarily involve a formal oversight body by the state for licensing and monitoring and which

has the power to impose sanctions. I argue for a formal “authority” model of governance.

iv

Acknowledgments

I would like to express my sincere gratitude to the Canadian Institutes of Health Research for

their financial support in awarding me a CIHR Training Program Fellowship. I would also like to

thank my supervisor Trudo Lemmens for his guidance and support during my studies and in the

preparation of this thesis. Last but not least, my deepest thanks goes to my daughters Isabella and

Sofia who inspired me every day and especially my husband Jose-Alejandro Lujan whose

unending love and support made this possible.

I would also like to thank my parents for their endless love, support and encouragement

throughout my life.

v

Table of Contents

1 Introduction ............................................................................................................................ 1

2 Biobank Issues......................................................................................................................... 8

2.1 Individual Level ............................................................................................................... 9

2.1.1 Privacy and Confidentiality......................................................................................... 9

2.1.2 Control over Samples and Data................................................................................. 11

2.2 Public Interest ................................................................................................................ 15

2.2.1 Research Interest ....................................................................................................... 16

2.2.2 Sharing of Information .............................................................................................. 18

2.2.3 Open Access .............................................................................................................. 20

3 Mechanisms to Deal with the Issues.................................................................................... 23

3.1 Governance..................................................................................................................... 29

3.1.1 Importance of Governance ........................................................................................ 30

3.1.2 Characteristics of Good Governance......................................................................... 35

3.2 Legislation ...................................................................................................................... 40

3.2.1 Common Law............................................................................................................ 43

3.2.2 Privacy Legislation.................................................................................................... 45

4 Challenges of the Existing System....................................................................................... 61

4.1 Regulatory Patchwork................................................................................................... 61

4.1.1 International............................................................................................................... 62

4.1.2 Tri-Council Policy Statement (2010) ........................................................................ 64

4.2 Research Ethics Board’s Role....................................................................................... 67

4.3 Oversight by the Privacy Commissioner ..................................................................... 70

vi

5 Strengthening the System .................................................................................................... 72

5.1 International Initiatives................................................................................................. 73

5.2 Canada Initiatives .......................................................................................................... 75

6 Conclusion ............................................................................................................................. 77

1

1 Introduction

In Canada no authority has a specific mandate to monitor the creation, management or operation

of biobanks. The central question on which I focus in this thesis is whether or not the

governance mechanisms currently in place are adequate to: (i) protect participants’ privacy, and

(ii) enforce good governance practices in the Canadian biobank context.

Since the Human Genome Project1 completed the sequencing of the human genome in 2003, the

importance and prevalence of biobanking has increased substantially. The advances made in

genome sequencing have contributed to more medical progress due to the sharing of and access

to biological material and associated data; the growing size of the collections increasing their

scientific value; and the range of applications of data banks having grown, especially in

genomics and in population genomics.

According to the Global Directory of Biobanks, Tissue Banks and Biorepositories, Canada

currently has 14 registered biobanks, while the United States of America has 155.2

But first, a definition of a biobank is required. For the purpose of this thesis a biobank is a

collection of biological material – such as tissues, blood and cells – and the associated data and

information stored in an organized system, for a population or a large subset of a population.3

These data comprise information about the donor of the material, such as demographic

characteristics, the type of disease associated with the sample, the outcome of the disease,

1 In 2003, the Human Genome Project completed the map of the human genome. This means scientists now know the full DNA sequence for humans. This information can be used to look at the way human genes interact with other factors such as lifestyle, environment and disease. See <http://www.genome.gov/>. 2 Specimen Central, Global Directory of Biobanks, Tissue Banks and Biorepositories (Minneapolis, MN: Specimen Central, LLC), online: <http://specimencentral.com/biobank-directory.aspx>. 3 The Organization for Economic Co-operation and Development (OECD) Glossary of Statistical Terms, Creation and Governance of Human Genetic Research Databases (Paris: OECD, 2006), online: <http://stats.oecd.org/glossary/detail.asp?ID=7220>.

2

treatment and information pertaining to environmental exposures, health, and life style

variables4. In addition, DNA5 and RNA represent information, which has led to the terms

“genetic database” and “population database” that are regularly used as synonyms for the term

“biobank”.6 The scientific value of a biobank lies in the possibility of collecting data or

specimens from hundreds or even thousands of individuals.

The size and sophistication of biobanks are increasing each year, and there has been an

unprecedented proliferation of them whether in terms of storage duration, quantities of banked

specimens, or the number of bank sites. In recent years biobanks have received much attention

as a new key infrastructure and resource for biomedical research and drug development7. At the

same time, there has been a boom of population biobanks, as more and more countries have

established new sample collections.8 Among the best known are: the Icelandic Health Sector

Database; the Estonian Genome Project; the UK Biobank; the CARTaGENE Project in Quebec,

Canada; the Banco Nacional de ADN in Spain; the International HapMap Project; and several

US biobanks, such as the National Children's Study. Most prominently, in 1998, the Icelandic

Ministry of Health announced its plans for the construction of a Health Sector Database

involving the entire Icelandic population. These plans, initiated by the private company

deCODE Genetics, specified how and under what conditions to assemble medical records and

4 A computer database is usually used to store the information. The database is usually called a dataset. 5 DNA is a relatively easy way to identify people because: -It is unique to each person. No one else has exactly the same DNA makeup; -It is found in almost every cell in the body including hair, sweat and skin; and -It is permanent and lasts for life. 6 Bernice S. Elger and Arthur L. Caplan, “Consent and anonymization in research involving biobanks: Differing terms and norms present serious barriers to an international framework” (Jul 2006) 7(7): 661–666 at para 3 EMBO Report [Elger & Caplan, 2006], online: <http://www.ncbi.nlm.nih.gov/pmc/articles/PMC1500833/#b19>. 7 Herbert Gottweis, “Biobanks: Success or Failure? Towards A Comparative Model” (Feb 2012) 33:199-218 Trust in Biobanking at 213 [Gottweis, 2012], Veröffentlichungen des Instituts für Deutsches, Europäisches und Internationales Medizinrecht, Gesundheitsrecht und Bioethik der Universitäten Heidelberg und Mannheim, online: <http://link.springer.com/chapter/10.1007/978-3-540-78845-4_13>. 8 Jocelyn Kaiser, “Population databases boom, from Iceland to the U.S.” (Nov 2002) 298(5596):1158-61 Science Mag., The National Center for Biotechnology Information (NCBI), [Kaiser, 2002], online: <http://www.sciencemag.org/content/298/5596/1158.short>.

3

possibly combine them with genetic data and genealogical records for the purposes of tracking

the presumed genetic bases of diseases and for furthering the goal of economizing in the

National Health Service.9 Biobanks represent a new paradigm for biomedical research,10 and

raise some ethical and legal issues. While some of these issues are not new, the increasing

breadth and scope of biobanks has amplified them even though the combination of a broader set

of genetic data and personal information in biobanks – including data banks – raises concern

about the use of such information, especially when sharing such information in a non-clinical or

non-research context.11 Other issues include the nature, scope and adequacy of consent,12

confidentiality, access to information, and privacy protection.13. For example, some issues arise

from the fact that genetic relatives’ genomes are very similar to each other, and therefore the

genotyping of one person can have informational implications for relatives.14 Each of these

issues is subject to extensive debate, and the aim is to find a balance among such considerations

as individual autonomy, public trust and the need for continued development of innovative

solutions that address human health challenges, including disease prevention and the development

of personalized medicine.

My interest in biobanks started while working in an academic hospital. Part of my work

involved preparing agreements for the sharing of data and samples. A few years ago we started

receiving more complex agreements and I had a lot of questions about the sharing of biological

materials. At that time the institute did not have a comprehensive policy regarding such sharing,

9 Gisil Palsson & Kristin Hardardóttir, "For Whom the Cell Tolls: Debates about Biomedicine" (April 2002) 43: 271-301 Curr Antropol 10 It differentiates from the single, time-limited studies with a defined research question. 11 The Organisation for Economic Co-operation and Development (OECD) Executive Summary, Creation and Governance of Human Genetic Research Databases 9-17, [OECD, Exec Sum], online: <http://www.oecd.org/health/biotech/37647338.pdf>. 12 Margaret Otlowski, “Developing an Appropriate Consent Model for Biobanks: In Defence of 'Broad' Consent”, Principles and Practice in Biobank Governance, Jane Kaye & Mark Stranger (eds) (Farnham: Ashgate, 2009) 79-92. 13 Susan MC Gibbons, “Are UK genetic databases governed adequately? A comparative legal analysis.” Leg Stud, 2007 27(2): 312-342 [Gibbons, 2007]. 14 William Lowrance, Privacy, Confidentiality, and Health Research, (Cambridge: Cambridge University Press, 2012) [Lowrance, 2012].

4

and it was challenging to find answers to those questions. I was fascinated with the future of

biobanks and decided that I wanted to have a better understanding and at least in my circle help

this extraordinary research continue to evolve. Biobanks may help scientists understand why

people have different reactions to drugs, help reduce adverse drug reactions and allow medicine

to be tailored to each person.

The appropriate structure for the governance of biobanks in Canada continues to evolve. As it

stands now, there is a lack of legislation specific to biobanks which addresses particular issues

for their governance, such as a statutory authority to monitor and oversee their creation. I

acknowledge that in Canada it is complicated to establish a national policy due to the fact that

the regulation of biobanks is shared between the federal and provincial levels of government.

Although some biobanks have begun to develop ad hoc policies and standard operating

procedures, the self-governance model is not sufficient to compensate for the absence of specific

governmental legislation. For example, the protection of health information is addressed

differently in every jurisdiction across Canada, and the federal laws that could impact biobanks

(the Privacy Act15 and PIPEDA16) have limited applicability.

Privacy protection should be extended in a way that not only protects against the misuse of the

information by researchers but also blocks inappropriate access to such information by

researchers and third parties. Third parties would include internal personnel from the biobank

who can innocently or maliciously violate confidentiality, which could result in the data being

improperly used to reveal the identity of participants. Such action could result in participants

15 Privacy Act, RSC, 1985, c P-21 [Privacy Act, 1985]. 16 The Personal Information Protection and Electronic Documents Act, S.C. 2000, c.5 [PIPEDA].

5

being harmed or appearing to be harmed. 17 18As biobanks must ensure that those who

participate in research are protected from any unwarranted harm resulting from the inadvertent

release of personal information, more attention is needed to govern and regulate the

administration of biobanks. One possible path to build a robust governance system, as proposed

in this thesis, involves legislation addressing biobank governance, particularly establishing an

oversight mechanism that permits the enforcement of good governance practices in the context

of biobanks. One of my proposals is that the Privacy Commissioner, who has specific expertise

on privacy issues, could be the authority. Privacy is indeed one of the major challenges for the

structure of biobanks. The Privacy Commissioner should review and approve rules and

procedures in accordance with national and international standards. Another approach

considered in this thesis is a stewardship committee, which consists of a committee established

by statute and which is responsible for approving who can have access to the data and for

determining the requirements for this access.

Admittedly, legislation cannot solve all of the potential privacy risks that face individuals who

participate in biobank research. For example, legislation cannot guarantee that genomic data will

remain anonymous, that it will not be identifiable19 20 21or that it will not be linked to other

17 [Lowrance, 2012] supra note 14 at 131. 18 An example of internal malicious use of personal health information is a recent case in an Ontario hospital which has admitted that two former employees sold patient information to multiple Registered Education Savings Plan (RESP) companies. The patients affected were mainly mothers who gave birth at the hospital between 2009 and 2013. The Star, published on Tuesday June 03 2014. Online: <http://www.thestar.com/news/gta/2014/06/03/major_privacy_breach_involving_thousands_of_new_mums_uncovered_at_rouge_valley_hospital.html> 19 [Lowrance, 2012] supra note 14 at 119. 20 For example, the terminology used by the European documents (CDBI, 2006; COE, 2006) is on the basis of five levels of anonymization for human samples: anonymous, unlinked anonymized, linked anonymized, coded and identified. If samples contain any trace of DNA, they are not truly anonymous, because it is always possible to identify the donor through DNA fingerprinting—comparing DNA sequences at only 30–80 statistically independent single nucleotide polymorphisms will uniquely define a single person. Anonymous is therefore an appropriate term only for archaeological samples. The term “anonymized” means that biological material is stored alongside associated information, such as the type of tumour, medical treatment, donor's age and so forth, but all information that would allow identification of the research participant or patient is stripped, either irreversibly (unlinked anonymized) or reversibly (linked anonymized). In the case of linked anonymized samples, identification is possible by a code, to which researchers or other users of the material—as part of the definition of the term ‘reversibly/linked anonymized'—do not have access. Coded samples have the same characteristics as linked (reversibly) anonymized samples, the only difference being that researchers and users have access to the code. Finally, samples are considered to be identified if the information that allows identification—

6

databases that could potentially reveal significantly personal information. However, appropriate

legislation or regulations may significantly minimize such risks. Legislation could lay the

foundation for achieving better biobank governance mechanisms. While a significant amount of

research and literature has focused on building a model for a self-governance framework to

optimize the use of biobanks, very little work has been undertaken specifically to explore firmer

regulatory options. There has been little research undertaken with respect to the implications of

the lack of formal oversight authority for biobank structures in the research context. Therefore this

thesis also aims to examine two different Canadian approaches to fill this void in oversight and

demonstrate the importance of ensuring good governance practices for minimizing some of the

current biobank challenges.

Legislation is needed in order to give statutory powers to an authority with the ability to ensure

compliance and the mechanisms for enforcement of decisions. Some can argue that it is not

necessary to have specific legislation in place to address some of the biobank issues, however

the sensitive nature of the information stored in these structures requires some level of

government protection. Legal authority would encourage adequate protection of participants in

the sensitive matter of access to personal information. Finally, having similar legislation or at

name, address and so on—is associated directly with the tissue, such as when the patient's nametag is attached to the sample. In most US and English Canadian texts, anonymized refers only to unlinked anonymized samples. Bernice S Elger and Arthur L Caplan, “Consent and anonymization in research involving biobanks: Differing terms and norms present serious barriers to an international framework”, EMBO Rep. Jul 2006; 7(7): 661–666. 21 Ibid at 119. For example genomic data can become identified using some methods such as matching genotype with identified or identifiable genotype data, or by linking genomic and associated data with external data and deducing the identity.

7

least providing similar protection to participants throughout Canada would foster the exchange

of data and biological material in a context that respects the subjects and sustains their trust.22

This thesis is divided into six chapters. It begins with an introduction to provide background

about the importance and complexity of these novel research structures vis a vis the obligation

of the state to provide some oversight mechanism to protect the participant’s interests at stake.

Chapter 2: Biobank Issues provides insight into the impact of these structures dealing with

human samples, invading individual autonomy or limiting self-control, and how they raise a

number of challenges. The chapter begins with an overview of the current ethical and legal

issues surrounding biobanks. First, it addresses issues involving individuals such as

confidentiality and privacy, control and access to data. The second part of this section provides

insights from the perspective of the public interest, namely, research interest and why it is

important for some research to use these structures, the sharing of information and the provision

of open access. Chapter 3: Mechanisms to Deal with the Issues, reviews some of the

mechanisms for dealing with biobank issues. Firstly, it addresses different forms of consent as a

way to deal with the informed consent challenge, however this does not resolve all of the issues

discussed before. The chapter will then discuss why governance is needed, and what are the

characteristics of a “good governance” system. This is followed by an overview of the common

law and the privacy legislation applicable in the biobank context, at the federal and provincial

level. This chapter also discusses how two Canadian provinces, Ontario and British Columbia,

could enact legislation to establish more specific statutory instruments for strengthening the

biobank governance system and for providing the foundation for future legislative initiatives.

22 Fonds de la Recherche en Santé du Québec (FRSQ), “Governance Framework for Data Banks and Biobanks used for Health Research” (Dec 8, 2006) Advisory Group Final Report [FRSQ, Final Report, 2006], online: <http://www.frsq.gouv.qc.ca/en/ethique/pdfs_ethique/Rapport_groupe_conseil_anglais.pdf >.

8

Chapter 4: Challenges of the Existing System, begins by analyzing the difficulties that Canadian

biobanks face within the current regulatory patchwork, at the international level, and then at the

federal and provincial levels in Canada. It then examines the role of the Research Ethics Board

(REBs) as an oversight body of biobank activities. This is followed by addressing the potential

impact of giving insufficient powers to the privacy commissioner to monitor and oversee

biobanks. Chapter 5: Strengthening the System examines international and national initiatives to

determine what steps could be taken to strengthen the Canadian system for biobanks. For

instance, what are the lessons learned from the P3G initiative? Chapter 6 provides a conclusion

to the thesis.

2 Biobank Issues

Biobanks can potentially make an endless number of contributions to health research and health

innovation, whether in the areas of prevention, diagnosis, or treatment of disease. But at the

same time, they create significant challenges. Issues that arise in the context of the establishment

and use of these biobanks can be seen at the individual level, involving concerns about consent,

confidentiality, privacy, control and access to data. Challenges also arise from the perspective

of the public interest. These concerns relate to research interest, the sharing of information and

open access. Existing legal mechanisms may not be sufficient to accommodate some of these

challenges23. In this chapter I will review the literature and discuss some legal cases that

illustrate these challenges.

23 Anne Cambon-Thomsen, Emmanuel Rial-Sebbag & Bertha Maria Knoppers, “Trends in ethical and legal frameworks for the use of human biobanks” (2007) 30: 373-82 Eur Respi J at 375, [Cambon-Thomsen, 2007], online: <http://erj.ersjournals.com/content/30/2/373.long>.

9

2.1 Individual Level

2.1.1 Privacy and Confidentiality

Advances in science come with a cost. The process of collecting, analyzing, and sharing

information in many cases invades privacy and results in the accessing of data that some people

believe should not be shared. There are two separate interests regarding the control of personal

information. The first interest is privacy, which means that people are entitled to keep certain

information private. This stems from an individual’s 24 right to be free from intrusion or

interference by others. 25 Individuals have privacy interests in relation to their bodies, personal

information, expressed thoughts and opinions, personal communications with others, and spaces

they occupy. Research affects these various domains of privacy in different ways, depending on

its objectives and methods. An important aspect of privacy is the right to control information

about oneself. The second interest is confidentiality, which means that under certain

circumstances, a person can disclose his or her private information to another with the

expectation that it will not be disseminated more broadly. The ethical duty of confidentiality

includes obligations to protect information from unauthorized access, use, disclosure,

modification, loss or theft26. For example, the participant who discloses private information to

the biobank or to her physician can expect that the physician will not reveal it to others.27

People are more likely to reveal personal information if they believe that the individuals to

24 Canadian Institutes of Health Research, Natural Sciences and Engineering Research Council of Canada, and Social Sciences and Humanities Research Council of Canada, Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans. (Ottawa: Public Works and Government Services Canada, Dec 2010), Chapter 5 [TCPS, 2010], online: <http://www.pre.ethics.gc.ca/pdf/eng/tcps2/TCPS_2_FINAL_Web.pdf>. 25 Ellen Wright Clayton, “Privacy and Confidentiality in Epidemiology: ‘Special Challenges of Using Information Obtained without Informed Consent’” in Steven S Coughlin, Tom L Beauchamp & Douglas L Weed (eds), Ethics and Epidemiology (Oxford Scholarship, September 2009) [Clayton, 2009]. 26 [TCPS, 2010], supra note 24. 27 [Clayton, 2009] supra note 25.

10

whom they reveal it will protect it.28 The concept of consent is related to the right to privacy.

Privacy is respected if an individual has an opportunity to exercise control over personal

information by consenting to, or withholding consent for, the collection, use and/or disclosure of

information. However, a basic premise of contemporary professional ethics is that privacy and

confidentiality should be compromised only to the extent necessary to achieve the desired public

goal. Health information custodians – who have custody of or control over personal health

information – and researchers have the obligation to protect the data they use, and therefore

need to provide security safeguards to protect the collected information. Another challenge for

maintaining the privacy and confidentiality of information is the current trend toward open

access to research data, which will be discussed in more detail later in this chapter.

One of the tools used to maintain the privacy of information is to de-identify the data. However,

recently, the value of de-identification of personal information as a tool to protect privacy has

come into question.29 In recent years, studies have demonstrated that it is possible to re-identify

individuals from information that has previously been claimed to be de-identified30. De-

identification continues to be a valuable and affective mechanism for protecting personal

information. Some studies have given rise to academic articles claiming that privacy cannot be

protected through de-identification. For example, Rothstein argues that the assumption that

privacy may be protected through de-identification is incorrect, since it has been demonstrated

28 Ibid. 29 Ann Cavoukian and El Eman Kahled, Dispelling the Myths Surrounding De-identification: Anonymization Remains a Strong Tool for Protecting Privacy, (Toronto: Information and Privacy Commissioner of Ontario, Jun 2011), [Cavoukian & Kahled, 2011], online: <http://www.ipc.on.ca/images/Resources/anonymization.pdf>; Djims Milius et al, “The International Cancer Genome Consortium’s evolving data-protection policies” (Jun 2014) 32(6): 519-523 Nature Biotechnology, online: <http://www.nature.com/nbt/journal/v32/n6/full/nbt.2926.html>. 30 Ibid

11

that easy re-identification is possible.31 Advances in technology have made re-identification of

personal information easier at a low cost. New databases useful for linking are now available,

with advances being made in re-identification technology. In addition, the Internet has

facilitated the collection and distribution of large amounts of information. While much of this

information may appear as non-identifying, it can be combined with information from other

sources to eventually produce data that may be linked back to specific individuals. De-

identification is particularly valuable in the context of personal health information. Health

information requires protection since it is highly sensitive and may include some of the most

intimate details associated with one’s life, such as those related to one’s physical and mental

health. Consequently, personal health information requires the strongest privacy and security

protections through a robust governance framework to prevent unauthorized collection, use and

disclosure. As mentioned before, an important aspect of privacy is the right to control

information about oneself.

2.1.2 Control over Samples and Data

According to a study in public perspectives on informed consent for biobanking,32 participants

could have some concerns over which areas of research their information and samples will be

used, and some prefer to place explicit limits on information which is particularly sensitive (e.g.

mental health and behavioural issues). 33 Participants’ preference in this study was to be asked

for their consent each time a study making use of their samples and information was proposed,

31 Mark A Rothstein, “Is De-identification Sufficient to Protect Health Privacy in Research?” (Sep 2010) 10(9): 3–11 Am J Bioeth. 32 Juli Murphy et al, “Public Perspectives on Informed Consent for Biobanking” (December 2009) 99(12): 2128-2134 Am Journal Public Health [Murphy, 2009]. 33 Ibid.

12

since with this approach they were able to maintain control over their samples and have the last

word over the kind of research in which they wished to participate.

Also, there is a debate concerning the nature of the legal interest in and rights of control over

human biological materials, as well as tensions between “vital public interest in protecting

research participants and facilitating beneficial, cutting-edge biomedical research”.34 One

question is whether individuals who donate biological materials for research purposes can

withdraw their consent to the use of their materials at any point. An issue around control over

information is the right of participants and family members to maintain the privacy of the

information.35 Another issue involving control is how to deal with the general ethical standard

which requires that each individual has “the right to know and the right not to know” the results

of research.36 The issue of return has sparked a broad debate about the ethical implications of

biobanking. Although very few articles confirm that participants actually have a substantial

level of interest in getting their personal research results back,37 it seems that most of the

authors do not advocate returning individual results.38 39 40

Another issue is the concept of “ownership” of human biospecimens and it has led to several

disputes and legal cases.41 42 The dispute at the heart of most of these cases is who has the right

34 Ubaka Ogbogu & Sarah Burningham, “Privacy protection and genetic research: where does the public interest lie?” (March 2014) 51(3): 471

Lexis Nexis [Ogbogu & Burningham, 2014], online: <https://litigation-essentials.lexisnexis.com/webcd/app?action=DocumentDisplay&crawlid=1&doctype=cite&docid=51+Alberta+L.+Rev.+471&srctype=smi&srcid=3B15&key=26f573c4ea65fb973db098f847d6660a >. 35 Loane Skene, “Feeding Back Significant Findings to Participants and Relatives”, Principles and Practice in Biobank Governance, Jane Kaye & Mark Stranger (eds), (Farnham: Ashgate, 2009) 175 [Skene, 2009]. 36 Danijela Budimir et al, “Ethical aspects of human biobanks: a systematic review” (June 2011) 52(3): 262-279 Croat Med J. 37 Juli Murphy et al, “Public expectations for return of results from large-cohort genetic research” (Nov 2008) 8(11): 36–43 Am J Bioeth. 38 See Mats G. Hansson, “The need to downregulate: a minimal ethical framework for biobank research” (2011) 675:39-59 Methods Mol Biol. 39 See Mark A. Rothstein, “Expanding the ethical analysis of biobanks” (2005) 33(1):89-101 J Law Med Ethics. 40 See Joanna S. Forsberg, Mats G. Hansson & Stephan Eriksson, “Changing perspectives in biobank research: from individual rights to concerns about public health regarding the return of results” (2009) 17(12):1544-9 Eur J Hum Genet. 41 Moore v. Regents of University of California, 793 P.2d 479 (Cal. 1990).

13

to control the use and distribution of biospecimens, and in some cases, products derived from

biospecimens. One of the questions in the biobank context is whether individuals who donate

biological materials for research purposes still have control over the samples. An Ontario court

has recently ruled that excised human tissue is private property and that it belongs not to the

person from whom it came but to the institution that holds it.43 Although this ruling has been

made, focus should be on the issue of how the sample can be used, and not who owns it.

Some of the questions that arise around “ownership” or “custodianship” are: Can participants

withdraw consent to the use of their materials at any point in time? Can the participants decide

to transfer their samples to another institution? 44 Some scholars 45argue that is not realistic or

practical to ensure that people have an actual right of control over the samples and data, since

the samples vary in their uses. The samples circulate, can be coded in many different ways, and

can be used by various researchers.

In a recent publication by Ogbogu46 et al., they used the McInerney v MacDonald47 decision, a

leading Canadian Supreme Court decision that sets out the nature and scope of common law rights

of access to health information. With the McInerney case the authors argue that the Supreme Court

suggests a strong and ongoing right of access to and control over genetic information that is

grounded in the nature and character of genetic information, personal autonomy and fiduciary law,

42 Greenberg v. Miami Children´s Hospital Research Institute, Inc, 264 F. Supp. 2d 1064, 1075 (S.D. Fla 2003). 43 Piljak Estate v. Abraham, 2014 ONSC 2893. 44 Washington University v. William Catalona, Washington University v. Richard Ward et al, United States Court of Appeals for the Eighth Circuit, Nos. 06-2286 & 06-2301, 13 December 2006. 45 Emmanuelle Rial-Sebag and Anne Cambon-Thomsen, “The Emergence of Biobanks in the Legal Landscape: Towards a New Model of Governance” (March 2012) 39(1):113-30 Journal of Law and Society [Rial-Sebag & Cambon-Thomsen, 2012]. 46 Ubaka Ogbogu, Sarah Burningham & Timothy Cauldfield, “The right to control and access genetic research information: Does McInerney offer a way out of the consent/withdraw conundrum?” (University of Alberta, Health Law Institute, Jan 2014) [Ogbogu, Burningham & Cauldfield, 2014], online: <http://www.hli.ualberta.ca/~/media/hli/Research/Docs/2013-09-15_McInerney_website.pdf>. 47 McInerney v. MacDonald, [1992] 2 S.C.R. 138.

14

which also includes the right to withdraw consent to research use of biological material and

associated genetic information. While the McInerney decision did not deal specifically with human

tissues or with the property law issues surrounding the collection and use of tissues for research

purposes, it raises interesting questions about how a Canadian court might “characterize the legal

interests in human tissue”.48

As we noted above, the concept of “ownership” over biological samples is a complex topic

which raises concerns. Debate continues over whether participants should or should not keep

control over the samples now stored in these biobanks.

There is a case that illustrates this tension between institutions and researchers. In the U.S.

patients who donate tissues to a researcher or university may lose all rights to those tissues, even

if signed documents exist saying the patients retain rights. That is the meaning of a recent court

ruling in St. Louis, involving the internationally famous prostate surgeon William Catalona. Dr.

Catalona over many years collected thousands of biological specimens. Many of the donors

were Dr. Catalona’s patients, and many others were not. Most of the informed consent forms

signed by these research participants used the term “donation” to describe the biological

sample’s transfer from the individual to the university and noted that the samples “may be used

for research with our collaborators at [the university], other institutions, or companies.”

When Dr. Catalona left the university to join the medical faculty of another institution in 2003,

he contacted thousands of research participants, without institutional review board (IRB)

approval, and requested that they direct the University to transfer the participants’ biological

materials to him at his new institution.

48 [Ogbogu, Burningham & Cauldfield, 2014], supra note 46 at 12.

15

The Court held that Washington University “owns the biological materials and neither Dr.

Catalona nor any contributing individual has any ownership or proprietary right in the disputed

biological materials.” In sum, the U.S. Court of Appeal held that patients do not retain an

ownership interest in tissues voluntarily donated for research purposes and it did not grant them

the right to withdraw their tissues from research use. This case shows some of the tensions that

can arise between researchers and institutions, and that patients desire to keep with them some

decision-making authority or even ownership over the samples.49

2.2 Public Interest

Biobanks have become increasingly important for the study of health and disease. Also, there is

a significant public interest in the outcomes of genetic research, which include diagnostic,

therapeutic, and preventative health methods and products. Trust must be established within not

only the medical and research community but also with the general public.    

However, there is also concern that genetic research – including cell therapy research and

biobanking – will foster the use and disclosure of personal health and genetic information in a

way that could undermine protected privacy interests.50 Therefore, it is necessary to find a

balance between research interests and public interest implicated in the collection, use and

disclosure of protected personal information in the biobank context. Due to the public interest

component of biobank research a biobank governance structure is necessary and has to be publicly

accountable for its actions and decisions on those affected and involved. Good governance also

49 Eighth Circuit Clarifies Ownership of Research Specimens in Washington University v. Catalona, Pharmaceutical and Biotechnology Update, July 12, 2007, 1, online: <http://documents.lexology.com/60585210-35ab-4a93-a80a-2154b41c3da7.pdf> 50 See Timothy Cautfield et al, “Research Ethics Recommendations for Whole-Genome Research: Consensus Statement” (March, 2008) 6(3):e73. doi:10.1371/journal.pbio.0060073 PloS Biology, online: <http://www.plosbiology.org/article/info%3Adoi%2F10.1371%2Fjournal.pbio.0060073>.

16

requires transparency, and since its public function, “it seems appropriate that the public should

have access to how the system is run.” 51

2.2.1 Research Interest

The collection of living organisms and tissues has been carried out for many years. Initially

centered on their educational value, collections of human biological samples have increasingly

become part of medical research protocols. This activity was started, and then structured,

primarily in the hope of developing new diagnostic or therapeutic strategies, or for identifying

new genes involved in the development of disorders, eventually leading to the possibility of

medical intervention.52 Today, biobanks have been identified “worldwide as crucial research

infrastructures of great significance for medicine and public health”.53 Investigations of public

perceptions show clearly the public acceptance of biobanks and the “willingness to participate”

in biobank research.54 However, current research55 shows that people see participation in

biobanks as a risk and they have concerns about their private medical and biological data being

used against their interests. Some concerns are whether employers or insurance companies may

have access to this information. Participants’ expectation is that their samples and information

will be respected and protected. But while it is also important in creating interest of the

participants in the research undertaken by these biobanks, some may argue56 that it is helpful if

utilizing existing “community-academic partnerships and disease organizations” to learn about

51 Trudo Lemmens and Lisa Austin, “The End of Individual Control over Health Information: Promoting Fair Information Practices and the Governance of Biobank Research”, Governing Biobanks, Jane Kaye and Mark Strange (eds), (Farnham: Ashgate, 2009) 243-66 [Lemmens & Austin, 2009]. 52 [Rial-Sebbag & Cambon-Thomsen, 2012] supra note 45. 53 Herbert Gottweis, George Gaskell & Johannes Starkbaum, “Connecting the public with biobank research: reciprocity matters” (2011) 12(11): 738-9 Nature Reviews Genetics [Gottweis, Gaskell & Satrkbaum, 2011]. 54 Ibid at 738. 55 Beatrice Godard, Jennifer Marshall & Claude M. Laberge, “Community engagement in genetic research: results of the first public consultation for the Quebec CARTaGENE Project.” (2007) 10(3):147-58 Community Genetic. 56 Amy A. Lemke et al, “Public Biobank Participant Attitudes toward Genetic Research Participation and Data Sharing” (Aug 2010) 13(6): 368-77 Pub Health Genom [Lemke et al, 2010].

17

the most appropriate methods of reviewing, developing and disseminating genetic data and

sharing educational materials with their communities. Focusing on genetic research issues that

are relevant and of interest to a community will be important in “initiating dialogues and

developing partnerships”.57 The study also suggested that additional mechanisms that may lead

to greater transparency and public understanding could include: a) an assessment of the

accessibility of existing biobank policies for data sharing to the public; and b) development of

materials that are written at a general public literacy level.58

Although initially centered on the collection of data and eventually of blood samples, research

activity has been transformed by the discovery of DNA and by the development of techniques

enabling “better harvesting, preservation, and use of such biological material”. The eventual

goal for biobanks is either to produce scientific information (in particular genetic) which can be

used without any immediate medical application (for example, in population genetics), or to

generate information useful for the development of biological tests (including genetic tests)

which can be used in medicine, or to give rise to an understanding of disease mechanisms,

leading indirectly to medical intervention.59 The participation of the public is crucial and

maintaining their trust is essential. Therefore it is necessary to respect participants’ interest in

the research and promote their desire to be part of novel discoveries.

57 Ibid at 375. 58 Ibid. 59 [Rial-Sebbag & Cambon-Thomsen, 2012] supra note 45.

18

2.2.2 Sharing of Information

The importance of sharing information for the advancement of health research has become

increasingly well recognized because it helps to maximize the public benefit to be gained from

biomedical research.

Since biobanks are mostly publicly funded, funders of biobanks impose the obligation of data

sharing. In this case, the funding agencies require that beneficiary biobanks implement either a

data management or data-sharing plan prior to the release of funds. Usually these plans may

demonstrate how sharing will increase the significance of their research and benefit society and

outline the methods that will be used to share data and results.60 At the same time, funding

agencies also recognize the importance of certain restrictions on data sharing, particularly due to

privacy. As an example, in Chapter 4 we have discussed the TCPS in greater detail.

Rapid developments in genomics are widely promoted as being dependent on such resources,

which can be accessed by many researchers for different research uses. They also reduce

duplication of work, allowing researchers to share the financial burden of generating

fundamental data and tools. However, sharing of participants’ information with biobanks and

researchers needs to balance respect for participants’ fundamental rights such as privacy and

confidentiality with the public good. Biobanks as research structures require participants to collect

all the samples and information that will translate into research. There is a debate on how the

information should be shared and who should have access. The sharing of data and samples poses a

significant privacy concern, specifically, “that placing sensitive genetic information or data derived

from these materials in the public domain increases the possibility of misuse, especially for non-

60 [Ogbogu & Burningham, 2014], supra note 34.

19

research purposes.” 61 There is a need for implementing some restrictions to access the information.

Therefore, the sharing of samples or genetic information “cannot be left completely unregulated.”62

On the one hand, open access is offered for data that cannot be linked with other data to generate a

dataset that would uniquely identify an individual, while on the other hand a more controlled access

mechanism regulates access to certain, more sensitive data (e.g. detailed phenotype and outcome

data, and genome sequencing files).63 A publication by S. Fortin et al., summarized and highlighted

the following four access practices for controlling how information is shared: (1) broadening the

focus to data sharing, (2) creating an access committee to evaluate requests, (3) using contracts

to secure relationships with researchers, and (4) developing a customer service approach.64 The

sharing of information needs mechanisms in place to protect participants’ privacy and

confidentiality.

Another challenge in the sharing of samples and information is the increase in information crossing

borders. Each jurisdiction has its own legislation and regulations, so different protections are

provided in each of these jurisdictions. This issue has awakened a movement for the harmonization

of biobanking operational procedures and best practices. The goal is harmonization rather than

uniformity, a more flexible approach seeking the effective interchange of valid information and

samples. 65 However harmonization is only one aspect; there is also a need to promote and

implement the sharing of ethical principles and procedures as they relate to biobank activities, as

61 Ibid. 62 Yann Joly et al, “Data Sharing in the Post-Genomic World: The Experience of the International Cancer Genome Consortium (ICGC) Data Access Compliance Office (DACO) (July 2012) 8(7): DOI: 10.1371/journal.pcbi.1002549 PLoS Computational Biology, [Joly et al, 2012], online: <http://www.ploscompbiol.org/article/info%3Adoi%2F10.1371%2Fjournal.pcbi.1002549>. 63 Ibid. 64 Sabrina Fortin, et al, “Access Arrangements for biobanks: A Fine Line between Facilitating and Hindering Collaboration” (2011) 14: 104-114, p106 Public Health Genomics [Fortin, 2011], online: <http://www.ncbi.nlm.nih.gov/pubmed/20689244>. 65 Jennifer R Harris, “Towards a roadmap in global biobanking for health” (Nov 2012) 20 (11): 1105-1111 Eur J Hum Genet [Harris, 2012].

20

well as building public trust.66 There is public openness and support for the sharing of information

within the research communities. However, participants are more reluctant when there is industry

involvement and the possibility of an economic benefit to the company. This leads us to the subject

of benefit sharing which is also a very sensitive issue. Benefit from research results, especially

financial benefits, could be shared among participants, communities that take part in research,

researchers, and their institutions67. There is a substantial interest from the industry in this research,

so that generation of intellectual property and benefits over time is not unlikely. In terms of benefit

sharing, biobanks must strike a balance between many competing interests from various

stakeholders in the process.68 In addition to the sharing of information, it is important to define how

the information can be accessed and by whom. After the advances in genomics there has been a

trend to be able to publicly access the information to support the research, but the openness of the

information should be seen more carefully with the advances of the technology and the possibility of

re-identifying the information.

2.2.3 Open Access

The benefits of rapid, open data sharing in health research have been most clearly illustrated by

the Human Genome Project. During the development of the entire draft human genome

sequence, the data was shared on an ongoing basis, such that each sequence of 1,000 base pairs

was generally made public within 24 hours of being read.69 As a result of this new sharing, new

information on 30 disease genes was published before the genome draft was even completed.70

66 Ibid. 67 [Cambon-Thomsen, 2007] supra note 23 at 379. 68 Ibid. 69 Toronto International Data Release Workshop Authors, “Prepublication data sharing”, Nature 461, 168-170 (10 September 2009), [TIDRWA, 2009], online: <http://www.nature.com/nature/journal/v461/n7261/full/461168a.html>. 70 Ibid.

21

The scientific community, research funders and governments have time after time recognized the

importance of open access to genomic data for scientific research and medical progress, however

at the time of its origin sometimes the “open access policies were drafted and implemented

without consideration of privacy concerns”, although later modified to take such concerns into

account.71 Moreover, it has been justified as a matter of public interest, based on the argument that

research done with this information is for the “public good”. 72 Open access is becoming a well-

established practice for large-scale, publicly funded projects, particularly in the field of

genomics.73 For example, in the United Kingdom, the Wellcome Trust requires funded research

papers to be made freely available as soon as possible, and in any event within six months of

publication.74 In Canada, the CIHR policy requires researchers to deposit research data “into the

appropriate public database…immediately upon publication of research results.”75

Open access is important in the biobank context because (i) there is the idea that research funded

by the public should be accessible to that public,76 (ii) it promotes faster and wider dissemination

of results, and (iii) it increases economic and societal opportunities.77

However, an unregulated open data access could raise important concerns, and the main concerns

are related to the protection of privacy. This is associated with the continued growth of research

71 [Ogbogu & Burningham, 2014], supra note 34. 72 Ibid. 73 Peter Suber, “Ensuring Open Access for Publicly Funded Research” (2012) 345:e5184, BMJ, online: <http://www.bmj.com/content/345/bmj.e5184>. 74 Dave Carr and Robert Kiley, “Open access to science helps us all” The New Statesman (13 April 2012), online: The New Statesman <http://www.newstatesman.com/blogs/economics/2012/04/open-access-science-helps-us-all>; The Wellcome Trust, Open Access Policy, online: The Wellcome Trust <http://www.wellcome.ac.uk/About-us/Policy/Policy-and-position-statements/WTD002766.htm.> 75 Canadian Institutes of Health Research, CIHR Open Access Policy (1 January 2013), online: CIHR <http://www.cihr-irsc.gc.ca/e/46068.html> 76 Ibid. 77 [Ogbogu & Burningham, 2014], supra note 34.

22

involving health and other personal data, but also with the increase in new forms of research such

as genetic research, where participants are exposed to a privacy risk. For example, gene

sequencing studies or research involving genetic biobanks raises particular concerns about

revealing information that can be used against the interest of the research participants and their

family members, which could cause discrimination or may harm them psychologically. Scholars,

policy-makers and researchers have identified the privacy protection of study participants as the

main challenge to open genomic data sharing.

One of the problems with open access in genomic research is that data access is available not only

within the scientific research community, but also genomic sequencing information is accessible

to people outside of this community, i.e. those who are not subject to the same safeguards,

oversight and professional codes of conduct. Likewise, authorized individuals occasionally take

classified information outside of secure environments. Human gene data seems to be amazingly

useful and to be in huge demand, and is capable of being studied from a vast number of angles.

Sometimes there is a need for the sharing of such information with more people. Research projects

are frequently global in nature, involving teams with different types of expertise, such as

clinicians, laboratory staff and researchers. And the more people granted access to datasets, the

more likely it is that someone will decide that it is ethically imperative to share the data with

researchers outside of the secure vault.78

Requirements for the ethical management of research data have sought to balance the privacy of

data subjects with the benefits of research, utilizing anonymization and informed consent.

However, it is now unrealistic to promise participants in research projects absolute confidentiality

78 George Church et al, “Public access to genome-wide data: Five views on balancing research with privacy and protection”, (Oct. 2009) 5(10) PloS Genet, [Church et al, 2009], online: <http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2749921/>.

23

in relation to genomic data.79 The rise in the sheer number of available data sources, in both the

commercial and public sectors, coupled with the ease with which an individual’s DNA can be

(and is) analyzed, suggests that the context for released data has changed. Disregarding this takes

for granted the support of participants and the wider public for genomic research in a way that

could have damaging consequences for future scientific endeavors.80

Making data available maximizes the likelihood that the benefits of research will rapidly be

returned to society, but also maximizes the opportunity for breaching the duty of privacy to

research participants. One way in which people have attempted to reconcile these objectives has

been by making only aggregated genotype data publicly accessible on the Internet while

restricting access to data that reveals individual participants' genotypes.81

3 Mechanisms to Deal with the Issues

Informed consent remains a fundamental legal and ethical principle in health research and

historically has been used as the main tool to protect participants’ interests. The requirement that

researchers obtain informed consent from potential participants before research commences is a

fundamental principle of medical research, enshrined in the Declaration of Helsinki82 and

subsequent legal instruments. Informed consent engages the foundational principle of respect for

persons. As a legal principle, “it finds roots in common law as a waiver to the tort of battery

and negligence in medical, and in human rights law, as an express manifestation of the

79 Patric Taylor, “Personal genomes: when consent gets in the way”, Nature 456, (November 2008); 32-33. [Taylor, 2008] 80 [Church et al, 2009], supra note 78. 81 Ibid. 82 [Taylor, 2008], supra note 79

24

individual right to autonomy, liberty and human dignity.” 83 The consent of participants is

usually required before biobank samples can be used in research. But the nature of this consent,

and how it is obtained, vary widely.84 Informed consent requires individuals to know,

understand, and appreciate the nature and consequences of their inclusion in research, including

all the risks involved, before deciding whether or not to participate. While this concept may be

practicable in the context of individual research projects, such as clinical trials for example,

where the specific details of the trial must be firmly set out in the study design and protocol, it is

considerably more difficult to apply in the context of biobanks. Biological samples are not

persons but human materials, and a sample stored in a biobank involves no direct physical risk

to the donor once the sample has been obtained. However, biological samples without data 85

attached to them, such as medical records and social and environmental information, are not

very useful for research.86 The research time frame87 for projects using biobanks is much longer

than that of any individual project, and multiple uses – some still unknown – of biological

samples has become an expectation of biobank samples.88 Therefore, there is a need to adjust

the traditional consent to the specificity of biobanks. General information about the governance

of the biobank may be described at the time of recruitment and prospective data collection, but

one cannot predict with certainty how the biobank may evolve over the years or even decades,

83 Patricia Kosseim & Dara Jospe, “Banking for the Future: ‘Informing’ Consent in the Context of Biobanks”, paper submitted at the IV International Seminar on the UNESCO Universal Declaration on Bioethics and Human Rights, organized by the UNESCO Chair of Bioethics in the University of Barcelona and the Catalan Data Protection Authority, Jan 21, 2011, Barcelona, Spain, [Kosseim & Jospe, 2011] online: <http://www.priv.gc.ca/media/sp-d/2011/sp-d_20110121_pk_e.asp >. 84 [Kaiser, 2002], supra note 8 85 This information attached to the samples, which could include personal health information, raised questions related to the protection of the privacy and confidentiality of the donor. 86

The data might relate to a given individual (clinical data), to a family (genealogy information or ethnic origin) or to a group (geographical location of a population, or its language). 87 Some biobanks store the samples and the data for projects longer than 10-20 years, or for the lifetime of the individual, inclusive of after donors deceased. 88 [Rial-Sebbag & Cambon-Thomsen, 2012] supra note 45.

25

and specifics about future research projects that will make use of the biosamples and data in the

biobank are not yet known.89 90

Increasingly, academics, policy-makers and even legislatures have come to acknowledge the

practical difficulties of transposing a specific informed consent requirement from the traditional

medical research paradigm into the contexts of biobanks. As a result, “there has been a growing

movement away from a model of specific informed consent to one of broad consent.” 91 Broad

consent is a more general form of consent where individuals agree to have their biosamples and

personal information collected and stored in the biobank and used for future, unspecified

research. An example of how a broad consent may be inappropriate can be understood by

examining the case of the Havasupai tribe of Arizona who sued Arizona State University over a

genetic study conducted by its researchers. In this case, although the tribe had consented to the

collection of their DNA for research, they understood the purpose of such research was to

investigate the high incidence of type-2 diabetes among their tribe. It was only years later that

they learned their DNA samples were also being used to research other conditions, including

schizophrenia (a condition which they considered socially stigmatizing) and the geographic

origins of their tribe (research they found objectionable given their own traditional beliefs of

their ancestral origins). In this case, participants had signed a broad consent form, which

stipulated that their blood could be used to "study the causes of behavioral/medical disorders".

Using samples without complete informed consent and without permission from tribal members

was a major concern in the Havasupai lawsuit. However, most participants did not understand

89 [Kosseim & Jospe, 2011] supra note 83. 90 Mats G. Hansson, et al, “Should donors be allowed to give broad consent to future biobank research?” (Mar 2006) 7(3):266-9 Lancet Oncology, [Hansson et al, 2006] online: <http://www.ncbi.nlm.nih.gov/pubmed/16510336> 91 Bertha Maria Knoppers and Ma’n Abdul-Rahman, “Biobanks in the Literature”, Chapter 2 in Berenice Elger et al, (eds), Ethical Issues in Governing Biobanks, (Oxford: Asgate Publishing, 2008) 13-22.

26

this to mean research beyond diabetes. Stigmatization of the tribe was also a risk to the

Havasupai community, especially with respect to a component of the research focused on

“inbreeding”. Scientists used a statistical measurement called the “inbreeding coefficient” to

estimate how individuals within a population are similar to each other genetically.92 Ultimately

the university settled the suit for millions of dollars.93

Despite the challenge outlined above, broad consent has become a practical solution and is now

the norm for biobank recruitment. Participants are asked to consent to the use of samples and

data within a biobank at the time of collection 94 rather than to specific project types of research

as specified in traditional formulations of informed consent. However, some jurisdictions are

adopting laws or policies in support of broad consent, although subject to some conditions such

as: controlled access, anonymization of data, and approval by a research ethics board. The use

of broad consent has led to a heated debate within the bioethics community as to whether this is

ethically appropriate. Others suggest “layering the consent”. In this approach, a participant

could make choices, agreeing to allow a sample to be used in research on a specific disease or

requesting recontact for consent to any other research.95

General information about the governance of the biobank may be described at the time of

recruitment and prospective data collection. However, certainty about how the biobank may

evolve over the years or even decades cannot be predicted and specifics about future research

projects that will make use of the biosamples and data in the biobank are not yet known.

92 Therese Markow et al, “HLA polymorphisms in the Havasupai: evidence for balancing selection” (Oct, 1993) 53(4): 943-52 Am J Hum Gen, online: <http://www.ncbi.nlm.nih.gov/pmc/articles/PMC1682387/>. 93

American Indian & Alaska Native, Genetics Resource Center, “Havasupai Tribe and the lawsuit settlement aftermath”, online: <http://genetics.ncai.org/case-study/havasupai-Tribe.cfm>. 94 Herbert Hotweiss & Jane Kaye, “Biobanks for Europe- A challenge for governance”, Report of the Expert Group on Dealing with Ethical and Regulatory Challenges of International Biobank Research (European Commission, 2012) 45, [Hotweiss & Kaye, 2012], online: <http://ec.europa.eu/research/science-society/document_library/pdf_06/biobanks-for-europe_en.p>. 95 Caroline Trouet, “Informed consent for the research use of human biological materials” (2003) 22(3): 411-19 Medicine in Law [Trouet, 2003]

27

Consent should be regarded as valid until further notice. There should be a realistic opportunity

for withdrawal of consent for those who have donated identifiable samples and data, which can

be an issue with biobank-based research that can last for many decades.  96  The right to withdraw

consent does not imply a right to withdraw results that have already accumulated, rather it

implies that new data cannot be obtained and that existing data must be maintained in an

impersonalized form. When the right to withdraw consent at any time includes a realistic

practical possibility to exert this right, perhaps many decades after the original consent, no time

limits are needed in the original consent. 97 A person’s autonomy should remain a guiding

principle at the stage of informing individuals about the possible risks and benefits of their

participation in biobank-based research. Broad consent and consent to future research studies

are valid ethically and should be recommended for biobank research, provided that three criteria

are met: personal information related to the research is handled safely, donors of biological

samples are granted the right to withdraw consent, and every new study is approved by the

ethics review board.    

There is a growing focus on the return of either research results or incidental findings to

participants in biobank research.98   This is based on the idea that advances within genome

sequencing increase the potential for producing data that research participants would find

valuable to access. Therefore it would be important to inform participants about such data and

to continuously provide them with the choice of whether or not to receive it.  However, others

may argue that a “disclosure policy may easily shift the focus and expectations of research from

no direct personal gain to making return of individual research results the primary motivation

96 [Hansson, et al, 2006] supra note 90. 97 Ibid. 98 Susan M. Wolf et al: “Managing incidental findings and research results in genomic research involving biobanks and archived data sets” (2012) 14: 361–384 Genet Med.

28

for participation.” This might then enforce ideas of individualism and of “what’s in it for me”

even in aspects of human conduct relating to contributing to biomedical research.99 In any case,

from the perspective of “good governance practices” it will be desirable to leave to the

participant the decision of whether or not to receive back the results or any incidental

findings.100

A new informed consent approach is the “dynamic consent” model proposed by Jane Kaye.101

Dynamic consent seeks “engaging individuals about the use of their personal information”. It is

also an interactive personalized interface through a technology-based platform that allows

participants to engage as much or as little as they choose and to alter their consent in real time.

Rather than being restricted to the opportunity only to give broad consent to the use of their

samples and data, individuals could provide different types of consent depending upon the kind

of study.102 This approach as explained by Jane Kaye is “dynamic” because it allows

interactions over time; it enables participants to consent to new projects or to alter their consent

choices in real time as their circumstances change and to have confidence that these changed

choices will take effect.103 However, this new model requires overcoming some challenges

such as: (i) cultural change for both health-care professionals and individuals, and (ii)

development of new policies, standards and ways of working that can accompany this approach.

In addition, it must have the technical capacity to interface with the systems of the biobanks and

research organizations so it can provide information and feedback to participants. This requires

investment of resources such as time, money, and expertise. This model has been developed for

99 Kristin Solum Steinsbekk, Bjørn Kare Myskja & Berge Solberg, “Broad consent versus dynamic consent in biobank research: Is passive participation an ethical problem?” (Sep 2013) 21(9): 897–902 Eur J Hum Genet [Steinsbekk, Myskja & Solberg, 2013]. 100 Ibid. 101 Jane Kaye et al, “Dynamic consent: A patient interface for twenty-first century research networks”, (Epub ahead of print, May 2014) Eur J Hum Gen, online: <http://www.nature.com/ejhg/journal/vaop/ncurrent/pdf/ejhg201471a.pdf >. 102 Ibid. 103 Ibid.

29

biobanking in the EnCoRe104 and CHRIS105 projects for biobanks. Informed consent cannot on

its own provide complete protection for participants. However, some dilemmas related to the

above consents can be addressed through a good governance system. Governance mechanisms

and legal concepts are needed to deal with the issues described above. It is critical for the future

of biobanks to establish governance regimes and a regulatory framework that will appropriately

link research with societal concerns and politics.

3.1 Governance

Biobank governance may not be seen as an ethical or legal issue as such, but it can be an

effective way to address ethical, social and political issues.106 Biobanks need a governance

framework that will help to establish order to accommodate the wide range of individual and

infrastructure concerns. Biobank governance is still evolving and it is critical for the future of

biobanks to establish governance regimes that appropriately connect research with society and

politics. The main challenge in the creation and operation of biobanks seems mainly in how to

deal adequately with potential issues involving informed consent, personal integrity, self-

determination, confidentiality and non-discrimination,107 as well as the need to have in place

adequate scientific and ethical oversight at the time of the creation of a biobank. Also it is

important that throughout the project there is ongoing monitoring, independence of the oversight

authority and efficiency of its control powers including sanctions.108 The “success and failure”

104 EnCoRe/Oxford Radcliffe Biobank (UK), online: <http://www.publichealth.ox.ac.uk/helex/projects/about/research-projects-1/dynamic-consent-project> 105 CHRIS- Cooperative Health Research in South Tyrol (Italy). Online: <http://www.eurac.edu/en/research/institutes/centerofbiomedicine/CHRISstudy/default.html> 106 Herbert Gotweiss, “Biobank governance: Trends and perspectives” (2007) 74(4):206-11 Pathobiology [Gotweiss, 2007]. 107 Ibid. 108 [Cambon-Thomsen , 2007] supra note 23 at 379.

30

of biobank projects will depend on “their integration into the social and political sphere.”109

Therefore, biobank governance offers more than just technical challenges.110 “Biobank

governance is a key aspect: (a) to protect the rights and welfare of research participants, (b) to

demonstrate respect for research participants and (c) to promote ethically responsible

research.”111 The importance of a good governance system lies in how it helps to weigh the risk

to privacy or the difficulty in obtaining consent against the potential benefits.

3.1.1 Importance of Governance

Historically the academic debate tends to focus on informed consent as the mechanism to

protect the participants, leaving most of the participants’ concerns unattended. An emerging

dilemma that has arisen in the context of biobanks is whether the technological advances that

threaten the participants’ privacy can be addressed through informed consent, or whether there

is a need to shift the concentration in the informed consent – as the only vehicle to protect

participants’ privacy to achieve proper biobank governance– to the establishment of proper

governance systems for this research infrastructure. Scholars like Lisa M. Austin and Trudo

Lemmens have argued that:

“…specific research uses of research samples and associated data in the biobank do not necessarily require informed consent but do require a governance structure that can regulate privacy risks such as the risk of re-identification… In our conclusion we suggest that the legal and ethical debates regarding biobanking must shift from an obsession with consent and focus more closely on the elements of good governance in order to move away from compromises and back to the principled protection of research subjects.”112

109 [Gottweis, 2012] supra note 7. 110 [FRSQ, Final Report, 2006] supra note 22. 111 Jim Vaught & Nicole C. Lockhart, “The Evolution of Biobanking Best Practices”, (Oct 2012) 413(19-20):1569-75 Clinica Chimica Acta at 1571 [Vaught & Lockhart, 2012]. 112 Lisa Austin and Trudo Lemmens, “Privacy, Consent and Governance”, New Challenges for Biobanks: Ethics, Law and Governance, in Kris Dierickx, Pascal Borry (eds) (Antwerp: Intersentia, 2009), chapter 9, 111-21 [Austin & Lemmens, 2009].

31

In addition to the participants’ informed consent, for biobanks to give access to their data and

biological materials to researchers, each biobank needs to develop and implement through their

governance a set of conditions in order to protect the information and biological materials

deposited. These conditions must include any requirement necessary to: i) comply with the

applicable law; ii) promote the availability of scientific results to the widest audience, and iii)

facilitate access to samples and data for research purposes. While biobanks are based in a given

jurisdiction, the researchers who use them might be located elsewhere. Increasingly, research is

conducted at a global level, often involving large international research collaborations that pool

and share samples and data. As a result, the exchange of data and samples can be done with

different levels of protection. Biobanks can emerge out of such collaboration, or be used as a

basis for research carried out by these consortia.113

The design and development of policies and procedures play important roles in biobank

governance, since the SOPs develop in more detail the governance of the biobank. Some

biobanks may use Standard Operating Procedures (SOPs), however the following are

further policies used for biobank governance:

(i) Policies and processes that seek to monitor and respond to re-identification

risks, including but not limited to, controlled access mechanisms;

(ii) Institutional sharing policies addressing privacy protections for associated

clinical health information collected with human biological material;

(iii) Information access control; and

113 [Hotweiss & Kaye, 2012], supra note 94.

32

(iv) Developing and revising consent forms, obtaining and withdrawing

consent.114

In the absence of a regulatory system, one common and effective solution has been to use SOPs.

For example a comprehensive set of biobanking SOPs was developed by the Canadian Tumour

Repository Network (CTRNet).115 These SOPs are intended to ensure its member

biorepositories maintain compliance with the ethical principles and standards outlined in

CTRNet’s policies, as well as meet international norms, policies, and guidelines in order to be

able to participate in research abroad (e.g. Declaration of Helsinki116, Food and Drug

Administration117, and International Conference of Harmonization118).

Some may argue that the policy-driven phenomenon is an effective approach and can be used as

an alternative to law. Graeme Laurie argues that a policy of reflexive governance can best meet

the challenges faced by many biobanks and does not require the use of legal instruments.119 The

reflexive governance is premised on the principles of integrity of purpose, proportionality of

action and reflexivity of approach, whereby mechanisms are developed to permit biobanks to

operate despite uncertainty and to adapt with time to ensure “good governance”, defined as:

i) designing in interoperability with respect to scientific and governance approaches;

ii) designing-out approaches that are restrictive of sharing, cooperation, flexibility and

mutuality;

iii) establishing policies and procedures to promote actively the use of the resource in

keeping with its original purpose;

114 Canadian Tumour Repository Network, Standard Operating Procedures, online:< http://www.ctrnet.ca/operating-procedures>

115 Rebecca Barnes et al, “Generating a comprehensive set of standard operating procedures for a biorepository network-The CTRNet Experience (Dec 2013)11(6): 387-96 Biopreservation and Biobanking. 116 World Medical Association. Declaration of Helsinki; 1964 (with 1975,1983,1989,1996,2000,2002,2004 and 2008 amendments). 117

USA Food and Drug Administration. FDA Code of Federal Regulations, Title 21, Part 50: Protection of Human Subjects;1981. 118 International Conference on Harmonisation (ICH). Good Clinical Practice (GCP) Guidelines; 1995. 119 Laurie Graeme, Reflexive governance in biobanking: on the value of policy led approaches and the need to recognize the limits of law. Hum Genet (2011) 130: 347-356. [Graeme, 2011], Online: <http://www.ncbi.nlm.nih.gov/pubmed/21766192>

33

iv) ensuring the longevity of the biobank through carefully managed access policies and

arrangements and stewardship of the resource; and

v) ensuring that governance policies and mechanisms remain fit for their purposes over

time.120

This proposed approach considers within its operation the development of scientific endeavor

while encouraging cooperation and compliance, and it is dependent on those governed and those

governing being receptive and open.121

Although these initiatives, whether SOPs or other policy approaches, are intended to develop

a comprehensive set of rules for self-governance, not all Canadian biobanks have been able to

take this approach. There are still incomplete and/or informal biobanking procedures that do not

meet applicable laws and international standards to secure the privacy of participants.122

Furthermore, such incomplete and/or informal biobanking procedures are not usually available

or disseminated publicly, and currently there is no statutory obligation to do so. The reason for

this lack of policies and procedures is sometimes because the development of policies and SOPs

requires a commitment to invest large amounts of time and resources, including often unstable

funding, that not all biobanks can manage.

Governance plays a crucial role in addressing the social and ethical challenges of biobanking. It

remains pivotal to maintaining public support and financing, and ensuring the security and

protection of participants, respect for cultural perspectives and the availability of biospecimens

and data for research. Moreover, proper governance is a key aspect to the success of a biobank,

120 Ibid.

121 Ariane Mallette & Anne Marie Tasse, P3G Model Framework for Biobank Access Policy: Core Elements, (Public Population Project in

Genomics and Society, 2013), [Mallete & Tasse, 2013], online: <http://www.p3g.org/system/files/biobank_toolkit_documents/P3G%20Core%20Elements%20Access%20Policy%20Final%20Dec%202013.pdf> 122 Ibid.

34

and one important and vital avenue for biobanks to maintain and honor public trust.123Also

governance is important to connect biobanks with individuals in a socially, politically and

ethically acceptable manner.124 Nonetheless, few efforts have defined what constitutes a proper

governance framework in practice. Without a proper governance framework, population

biobanks may unduly add multiple layers of oversight125, limiting their ability to conduct

research and their overall utility as well as their ability to ensure the privacy of participants.

Various theoretical approaches to governance have been advanced, considering the changing

nature of post-genomic medical research and the growing need for global research networks,

notably e-governance, reflexive governance and anticipatory governance.126

As stated by Jane Kaye, the benefit of a relevant and appropriate governance system is in tune

with social expectations if:

“It promotes certainty and efficiency as people know what the rules are, what

happens, and when. It can ensure uniformity and equality- that things are done in a

uniform way with everyone and the same issues being treated the same. Such a

system enables problems to be anticipated as there are mechanisms to deal with

the routine issues but unanticipated situations can also be resolved efficiently.

Having a governance system in place ensures that ethical and lawful research is

supported through accountable and transparent decision-making. This not only

protects the integrity of the research community but also has the promoting public

confidence and trust.” 127

123 [Gottweis, 2012] supra note 7. 124 Ibid. 125 Susan Wallace et al, “Governance Mechanisms and Population Biobanks: Building a Framework for Trust” (2008) 6(2): 1-11 at 3 GenEdit [Wallace et al, 2008]. 126 [Mallete, Tasse & Knoppers, 2013] supra note 121. 127Jane Kaye, “From single biobanks to international networks: developing e-governance” (2011) 130(3): 377-382 Hum Genet [Kaye, 2011], online: < http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3155683/>.

35

Providing clear and transparent procedures makes biobanks more accountable for their work. In

addition, the public and participants are more involved in the process and have a better

understanding of what biobanks are doing with their samples and information. But we may ask

ourselves, why is it so important to have good governance practices within these research

structures?

3.1.2 Characteristics of Good Governance

For the purpose of this thesis it is important to understand the principles that should apply to a

“good governance” system to assess the adequacy of the current biobanking regulatory

framework, and for formulating defensible, pragmatically acceptable recommendations for

future reform.

Therefore, the main purpose of this chapter is to respond to the question: What are the principal

qualities or attributes that “good” regulatory systems, policies and practices should have?

Numerous sets of principles have been proposed around the world, for example at the

international level those prepared by the Organization for Economic Co-operation and

Development (OECD).128 In Canada the Fonds de la Recherche en Sante du Quebec (FRSQ)

Advisory Group, through a final report for the “Governance Framework for Data Banks and

Biobanks used for Health Research”, 129 recommended among others the following principles:

128 See, eg: The Organisation for Economic Co-operation and Development (OECD), “Recommendation of the Council of the OECD on Improving the Quality of Government Regulation”, Creation and Governance of Human Genetic Research Databases (Paris: OECD, 1995), online: <http://www.oecd.org/officialdocuments/publicdisplaydocumentpdf/?doclanguage=en&cote=OCDE/GD(95)95>.; The Organisation for Economic Co-operation and Development (OECD), “Guiding Principles for Regulatory Quality and Performance”, Creation and Governance of Human Genetic Research Databases, (Paris: OECD, 2005), [OECD, 2005], online: < http://www.oecd.org/fr/reformereg/34976533.pdf >. 129 [FRSQ, Final Report, 2006] supra note 22.

36

(i) Accountability: The biobank shall guarantee that data and biological material entrusted to it

will be handled properly.

(ii) Continuing staff training: Biobank staff receive continuing training that covers

confidentiality, free and informed consent, secure storage methods, relevant technological

innovations, legitimate access to data and biological material, governing laws, existing

administrative standards, internal bank policies, and so on. That training is intended chiefly to

produce and sustain a vibrant ethics culture among bank staff.

(iii) Mandatory approval by a competent REB

The competent REB works within its designated jurisdiction to approve and monitor the

creation of all new banks. An REB’s terms of reference embrace both research projects and the

creation of banks as research infrastructures. Every research project involving human subjects

must have the prior approval of an REB.

(iv) Determining the research objectives

When applying for funding, researchers should present a proposal, a written description of the

purpose of the research to be done. This research proposal will require ethics approval from the

respective REB, and in some cases other biobank committees will assess and approve the

project in order to gain access to the samples and information. The objectives may be specific as

well as general. Researchers must justify the desired access based on the expressed objectives.

(v) Determining the need for a free and informed consent

Free and informed consent is a basic instrument for the protection of research subjects.

It should be considered of paramount importance where data banks and biobanks are concerned.

37

(vi) Obtaining free and informed consent, as needed

Consent must be obtained in a way that respects the freedom and enlightened decision of the

potential subject. The practical conditions for expressing consent determine whether the

potential subject espouses the proposed objective.

Consent is a continuing process and includes the right to withdraw. However, the potential

subject must be informed that it is impossible in practice to withdraw data or biological material

which is anonymous or has been anonymized.

Consent must be renewed in the event of significant changes in the research initiative, banking

agreement or bank governance framework.

(vii) Storage of data and biological material, and confidentiality protection.

The storage of data and biological material requires appropriate human skills and technology.

Organizational, technological and physical security measures are used to safeguard the

confidentiality of data and biological material. The bank establishes clear policies to manage

collection, storage and access.

(viii) Access to personal information

All individuals have the right to access information which pertains to them. They can challenge

the accuracy of such data and make any changes they deem appropriate. At their request, the

bank is bound to inform them of the use being made of their data, e.g. the fact that their

information has been communicated to other persons.

(ix) Transparent management of data and biological material

The general public, and research subjects in particular, must have easy access to information

concerning the principles, policies and practices of the bank.

38

(x) Grievances

The bank appoints a person to enforce the laws, as well as the bank’s principles and policies.

Grievance management is straightforward and readily available. Anyone connected with the

bank is entitled to lodge a grievance alleging non-compliance with those laws, principles or

policies.

(xi) Sharing and confidentiality protection

Banks that entrust data or biological material to organizations outside their province must ensure

that those organizations can match the confidentiality protection provided in their province. The

banks shall also ensure that data and biological material are used in accordance with the

conditions indicated in the consent form.

As mentioned in the previous chapter the protection of information is one of the most sensitive

issues and remains an issue of great concern for the public and their attitudes towards biobanks.

When we talk about a good governance system, of particular importance is how biobanks

prevent possible misuse of data, and protect the privacy of the participants. As outlined above

one example of good governance practice is continuing staff training. In the Canadian context

there is a recent initiative by the Canadian Tumour Repository Network (CTRNet). The CTRNet

has implemented a certification program to communicate common standards to harmonize

biospecimen quality and approaches to governance, in conjunction with simultaneous exposure

to education focusing on the rationale and foundations underlying these standards.130 The

CTRNet certification program comprises registration and certification steps as two linked

130 Elizabeth AM Matzke et al, “Certification for Biobanks: The Program Developed by the Canadian Tumour Repository Network (CTRNet)” (Oct 2012) 10(5): 426-32 Biopreserv Biobank.

39

phases. In the registration phase, launched in November 2011, biobanks are registered in the

system and individuals complete an introductory educational module. In the subsequent

certification phase, the type of biobank is classified and assigned relevant educational modules

and adoption of relevant standards of practice is confirmed through review of documentation

including policies and protocols that address the CTRNet Required Operational Practices

(ROPs). An important feature of the program is that it is intended for all types of tumor

biobanks, so the scope and extent of assessment is scaled to the type of biobank. This program

aims to provide an easily adoptable and flexible mechanism to communicate common standards

through education and address both quality assurance and governance across the broad spectrum

of biobanks.

Furthermore, good governance practices should require informing participants in detail about

the mission of a particular biobank, its funding and governance structures, and what it hopes to

achieve. While such an initial disclosure statement on the side of the biobank would regularly

include disclosure of research questions and contexts that the biobank supports at the time of

recruitment, it should also include a statement that the biobank – and thus the samples and data

of the participant – may be used to serve research that cannot yet be envisaged, and that

appropriate research ethics approval will be obtained wherever laws and regulations require

this.131 The process of recruiting consenting participants of biobanks context needs to be

adapted to these kinds of novel structures. While biobanks are aware that the future uses of the

information and samples collected are not fully determined by the time of consent being given,

participants need to be informed as much as possible of the possibilities that the biobank can

foresee. As well, they need to provide full disclosure to participants that include enough

131 Barbara Prainsack & Alena Buyx, “Solidarity: Reflections on an emerging concept in bioethics”, (London: Nuffield Council on Bioethics, 2011) 331-344.

40

information to enable participants to make the decision, with an explicit note that the list may

not be exhaustive. If we recall the case presented in this chapter, the conflict between the

Havasupai Indians and Arizona State University, where the participants had signed a broad

consent form, this type of lack of information could be resolved in the manner as stated above,

i.e., by providing more context to the participants of the scope of research that can be done, and

moreover explaining the possibility of unknown future research uses, so the participants can

make informed decisions. However, consent must be renewed in the event of significant

changes in the research initiative, or the bank governance framework.

Informed consent has been a core element in the area of research, but it cannot stand alone

anymore. Informed consent needs a governance system that as a whole supports and protects

the donors’ interests and rights at stake.

3.2 Legislation

In order to lay the foundation for understanding and critically evaluating the current legal

framework applicable to biobanks in Canada, I have divided this section into two subsections:

(i) an identifying and examining of applicable common law; and (ii) providing a review of

applicable privacy legislation in the biobank context.

There is an absence of biobank specific federal law in Canada. No federal law addresses either

the collection of biological material for biobank activities or the secondary use of biological

material. In contrast, privacy legislation that could address some aspects of biobanks comprises

various federal, provincial, and territorial statutes and regulations, professional codes of

41

conduct, guidelines, standards, common law, and constitutional law.132 Indeed, the protection of

health information is addressed differently in every provincial jurisdiction across Canada, and

the federal laws that could impact biobanks (e.g., the Privacy Act and the Personal Information

Protection and Electronic Documents Act (PIPEDA)) offer limited applicability.133

In Canada, due to the constitutional division of powers, jurisdiction over health and information

is shared between the federal government and the provinces/territories. The Constitution Act,

1867 allocated marine hospitals and quarantine to the federal government134, whereas the

provinces were assigned power over “the Establishment, Maintenance, and Management of

Hospitals, Asylums, Charities, and Eleemosynary Institutions in and for the Province, other than

Marine Hospitals”.135 The provinces pursuant to this power assumed most health matters over

hospitals as well as power over poverty and civil rights and matters of a local or private nature.

This division still exists, with federal jurisdiction over quarantine being interpreted to apply only

to ingress and egress into and out of Canada.136 The Canada Health Act137was not an assertion

of federal jurisdiction over health matters; rather, it invoked federal spending power to gain the

participation of the provinces/territories in a program of Medicare for hospitals and medically

necessary physician services.

Respect for privacy is a constitutional principle in Canada. The development of the concept and

categories of privacy interests have been largely driven by the Canadian Charter of Rights and

132 Edward S. Dove, et al, “Privacy in Canadian Paediatric Biobanks: A Changing Landscape. A Report Delivered to the Office of the Privacy

Commissioner of Canada”, Centre of Genomics and Policy (REVISED 1 August 2011), [Paediatric Report, 2011], online: <http://www.pediagen.org/ressources/Privacy_in_Canadian_Paediatric_Biobanks.pdf>. 133 [PIPEDA] supra note 16. 134 (U.K.), 30 & 31 Vict., c. 3, s 91(11). 135

Ibid, s 92 (7). 136

See, e.g., Quarantine Act, s.c. 2005, c. 20. 137

Canada Health Act, R.S.C 1985, c C-6.

42

Freedoms (Canadian Charter).138 Two provisions in the Canadian Charter have been interpreted

as protecting a person’s privacy. Firstly, in section 7, which guarantees everyone “the right to

life, liberty and security of the person”, has been interpreted to include the right to be free of the

psychological stress resulting from unauthorized disclosure of one’s personal health

information. Secondly, section 8, which grants the “right to be secure against unreasonable

search or seizure”, includes the protection of an individual’s informational privacy. In this

regard, the Supreme Court of Canada has stated, “…what is protected by s. 8 is people not

places or things. The principal right protected by s. 8 is individual privacy, and the provision

must be purposively applied to that end.”139 However, to date there has not been presented in

the Canadians courts any challenge to the Canadian Charter invoking the privacy principle in the

biobank context.

In addition to the constitutional principle of respect for privacy, two federal privacy laws protect

Canadians. The Privacy Act, which covers the personal information-handling practices of the

federal government, and the Personal Information Protection and Electronic Documents Act

(PIPEDA) is Canada’s private sector privacy law.

Then, every province and territory also has privacy legislation governing the collection, use and

disclosure of personal information held by government agencies. These acts provide individuals

with a general right to access and correct their personal information. Oversight is through either

an independent commissioner or ombudsman authorized to receive and investigate

complaints.140 Although health information is based in statute, some significant areas are carved

138 Canadian Charter of Rights and Freedoms, Part 1 of the Constitution Act, 1982, being Schedule B to the Canada Act 1982 (UK) 1982, c. 11. 139 R v Colarusso [1994] 1 SCR 20 at 60, see also R. v Plant [1993] 3 SCR 281 at 293. 140 Office of the Privacy Commissioner of Canada official website.< https://www.priv.gc.ca/faqs/index_e.asp#q002>

43

out in common law. In the next section I will give an overview of some concepts related to the

biobank context as addressed in common law.

3.2.1 Common Law

Common  law  is  well  beyond  the  scope  of  this  thesis,  but  while  it  is  worth  noting  that no Canadian

court has ruled directly on biobank activities, we may find some important aspects and concepts

related to these research structures within the Canadian common law, such as privacy,

ownership and informed consent.

Canada has yet to fully recognize a distinct common law right to privacy.141 There have been

courts recognizing a common law tort action for invasion of privacy but also there is provincial

variation of the recognition. Common law in Canada has been reticent to establish a right to

privacy protection more generally. At present, a handful of trial level decisions in Ontario have

found the existence of a common law tort of invasion of privacy.142 Thus far, these cases have

primarily concerned invasions that may be described as forms of harassment as opposed to

violations of the protection of information.143

Regarding personal health information, both common law and statutes have adopted the concept

of custodianship or trusteeship when a patient’s health information is being held by another

party whether by a healthcare provider, hospital, long term care facility, research centre or

department of health. The property or ownership model has been considered at common law and

ultimately rejected by the Supreme Court of Canada.

141 Lisa M. Austin, Privacy and Private Law: The Dilemma of Justification, (Montreal: McGill LJ, 2010) at 55. 142 MacKay v. Buelow, [1995] O.J. No. 867 (Gen. Div.) (QL). 143 Elaine Gibson, Is There a Privacy Interest in Anonymized Personal Health Information (University of Alberta, Health Law Institute, Special Edition 2003), 97.

44

The Supreme Court weighed into the matter of ownership and custodianship of health

information in its 1992 judgment in McInnery v. Mac Donald,144 a case involving a patient’s

right to access her own health information. This case was decided in the absence of New

Brunswick legislation addressing the issue of access. With respect to informed consent being a

physician’s duty, the Supreme Court of Canada established the obligation of disclosure that

required physicians to provide the information necessary for patients to act as autonomous

decision-makers. The decision reflected an advance in the patients’ role in having more control

over their own health care and a desire to move away from the paternalistic approach that had

previously characterized the doctor-patient relationship.

The issue of informed consent in a medical negligence action was addressed by the Supreme

Court of Canada in the landmark cases of Hopp v. Lepp145 and Reibl v. Hughes.146

Empowerment of patients through disclosure was the foundation of the Supreme Court’s

decision. Patients must possess sufficient information about their treatment to enable them to

decide whether or not to participate, thereby exercising autonomy. Patients require a full

understanding to be able to assess the proposed treatment in light of their values, beliefs, goals

and circumstances.

It was the Reibl judgment that introduced the doctrine of informed consent into Canadian law.

Building on his reasons in Hopp v. Lepp, Laskin C.J., writing for a unanimous court, confirmed

that the relationship between a doctor and a patient undoubtedly gives rise to a duty of the

doctor to disclose material risks associated with a procedure, without having to be questioned by

the patient. Thus, the traditional standard of disclosure, that is, what a reasonable physician

144 [1992] 2 S.C.R. 138 [McInerney]. This case was also discussed in section 1.1.3 Control over the data and samples. 145 Hopp v. Lepp, [1980] 2 S.C.R. 192. 146 Reibl v. Hughes, [1980] 2 S.C.R. 880.

45

would disclose, was replaced with the standard of what a reasonable patient would want to

know.

However, these cases refer more particularly to the context of a specific procedure, but we may

ask if this interpretation can be extended to the individual’s right to determine what shall be

done with his own body.

3.2.2 Privacy Legislation

Since personal health information is legislated in Canada on a provincial/territorial level,

significant differences in coverage arise, depending on one’s jurisdiction. However, not all

legislation is provincial. Since 1983 there has been federal legislation governing personal

information held by the federal government and its agencies. Also there is PIPEDA, which will

be discussed later on in this chapter.

3.2.2.1 Federal

(i) The Privacy Act147and its companion Access to Information Act apply to personal

information collected, used, retained or disclosed by the federal public sector. In this Act,

personal information is defined as “information about an identifiable individual that is recorded

in any form”.148

(ii) Personal Information Protection and Electronic Documents Act149 (PIPEDA)

The fact that jurisdiction over both health and information rests primarily with the provincial

governments has not prevented the federal government from enacting legislation governing

147 [Privacy Act, 1985] supra note 15. 148 Ibid, s. 3. 149 [PIPEDA] supra note 16 at s. 2(1).

46

information management, most notably PIPEDA, to give individuals control over the collection,

use and disclosure of their personal information. The federal government had to rely on its trade

and commerce clause, so the legislation only applies to the commercial sector.

Since January 1st, 2004, PIPEDA has regulated information crossing provincial boundaries and

also intra-provincially in provinces that do not have legislation declared by the Governor in

Council to be “substantially similar”150 to PIPEDA in providing information protection. In

summary, in provinces with legislation declared “substantially similar”, PIPEDA applies only to

information going into and out of the province and to information collected, used or disclosed in

connection with the operation of a federal work, undertaking or business, but not to other

information kept within the province. 151 Then, organizations that are subject to provincial

legislation deemed substantially similar are exempt from PIPEDA with respect to the collection,

use or disclosure of personal information occurring within the respective province. Some

provincial laws that have been deemed substantially similar include British Columbia‘s

Personal Information Protection Act152 and Ontario’s Personal Health Information Protection

Act (In the case of Ontario only with respect to health information).153

Since January 1st, 2004, it has been in force for information crossing provincial boundaries and

also intra-provincially in provinces that do not have legislation declared by the Governor in

Council to be “substantially similar” to PIPEDA in providing information protection. In

150 On August 3, 2002, Industry Canada published the Process for the Determination of “Substantially Similar Provincial Legislation by the Governor in Council. Under the policy, laws that are substantially similar: provide privacy protection that is consistent with and equivalent to that found under PIPEDA; incorporate the ten principles in Schedule 1 of PIPEDA; provide for an independent and effective oversight and redress mechanism with powers to investigate; and restrict the collection, use and disclosure of personal information to purposes that are appropriate or legitimate. 151 [Elaine Gibson, 2007] supra note 154 at 233. 152 Personal Information Protection Act [SBC 2003] Chapter 63. 153 Personal Health Information Protection Act. S.O. 2004,[PHIPA].

47

summary, in provinces with legislation declared “substantially similar”, PIPEDA applies only to

information going into and out of the province and to information collected, used or disclosed in

connection with the operation of a federal work, undertaking or business, but not to other

information kept within the province. 154

PIPEDA covers solely personal information, defined as “information about an identifiable

individual, but does not include the name, title or business address or telephone number of an

employee of an organization”.155

However, this Act also includes a detailed definition of personal health information.156 For the

biobank context it is important to note that the definition of personal health information is broad

enough to apply to a deceased individual, and information relating to body parts or substances,

but does not include the samples themselves.157 This will be in effect as long as the collection

used or disclosed is “in the course of commercial activity.”

As noted by some scholars,158 unless the governance model clearly divides roles and

responsibilities and creates a clear management structure, and a well-documented funding

source, determining whether a biobank falls under public sector or private sector privacy

154 Elaine Gibson, “Health Information: Confidentiality and Access,” in T. Caulfield, J. Downie, and C. Flood (eds), Canadian Health Law and Policy, 3rd ed., (Canada: LexisNexis, 2007) Chapter 5, 233 [Elaine Gibson, 2007] at. 233. 155 [PIPEDA] supra note 16 at s. 2(1). 156 In [PIPEDA] supra note 16 at s. 2(1) is defined “personal health information'', with respect to an individual, whether living or deceased, means: (a) information concerning the physical or mental health of the individual; (b) information concerning any health service provided to the individual; (c) information concerning the donation by the individual of any body part or any bodily substance of the individual or information derived from the testing or examination of a body part or bodily substance of the individual; (d) information that is collected in the course of providing health services to the individual; or (e) information that is collected incidentally to the provision of health services to the individual. 157 [Elaine Gibson, 2007] supra note 154 at 234. 158 [Paediatric Report, 2011], supra note 132.

48

legislation is a challenge. This challenge has not gone unnoticed by CIHR159, which has

remarked:

“...the activities of health researchers themselves will be difficult to categorize as either commercial or non-commercial in nature. Increasingly, academia, private sector, voluntary charitable organizations and government are joining forces to engage in innovative research partnerships and to transform this new knowledge into forms, which are beneficial to the population. In an era where such partnerships are actively encouraged, a whole spectrum of public-private arrangements have begun to emerge.” 160

For example, it is unclear whether PIPEDA, a commercial activity statute, applies to biobanks in

hospitals or universities since the main purpose of such institutions is research which is not

commercial in character. 161

3.2.2.2 Provincial

There are a number of different kinds of provincial/ territorial legislation impacting directly on

health information. Some provinces have enacted health-information-specific legislation. Others

have legislation that covers personal information in the private sector, including health

information. All have legislation governing information in the public sector, which may include

hospitals and extended care facilities.162

A number of provinces have enacted legislation that deals exclusively with health information.

These provinces are Manitoba163, Alberta164, Saskatchewan165, Ontario166, Newfoundland and

Labrador167, and New Brunswick168.

159 Ibid. 160 Canadian Institutes of Health Research, Personal Information Protection and Electronic Documents Act: Questions and Answers for Health Researchers (Ottawa: Public Works and Government Services Canada, 2001) at 8. 161 [Paediatric Report, 2011] supra note 134 at 19. 162 [Elaine Gibson, 2007] supra note 154 at 236. 163

Personal Health Information Act, CCSM 1997 c P33.5. 164 Personal Information Protection Act, SA 2003, c P-6.5 and Health Information Act, RSA 2000, c H-5. 165 Health Information Protection Act, SS 1999, c H-0.021.

49

The primary aim of these statutes is to provide for the protection of personal health information

being collected, used, stored or disclosed by an entity other than the individual who is the

information source. Personal health information or, in the case of Alberta, individually

identifying information, is defined in various ways in the legislation. Some, including the

Ontario Act dealing with personal health information, may include information with respect to

the donation of body parts or body substances. In Manitoba, the Manitoba Act limits personal

health information only to recorded information.169 An example of health information privacy

legislation that has been used in the context of biobanks is the Ontario PHIPA. Under this act it

is voluntary for biobanks to register as “prescribed persons” in order to receive personal health

information from health information custodians.170 For example, one “prescribed person” is the

Ontario Institute for Cancer Research’s Ontario Tumour Bank (OTB) under paragraph 39(1)(c)

of Ontario’s PHIPA. As a result, the OTB is entitled to collect, use, and disclose personal health

information171 without consent strictly “for the purpose of facilitating or improving the

provision of health care, or that relates to the storage of donation of body parts or bodily

substances.” The “prescribed person” statutes make it easier for the OTB to enrich its databases

166 [PHIPA] supra note at 153. 167 Personal Health Information Act, SNL 2008, c P-7.01. 168 Personal Health Information Privacy and Access Act, SNB 2009, c P-7.05. 169 Personal Health Information Act, C.C.S.M. c P33.5, S 1(1). 170 Defined in section 3 of the Ontario’s PHIPA as a person or organization described in s. 3 who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work, such as a health care practitioner or a hospital. 171 In accordance with s. 4 Ontario’s PHIPA means: identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family, (b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual, (c) is a plan of service within the meaning of the Home Care and Community Services Act, 1994 for the individual, (d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual, (e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance, (f) is the individual’s health number, or (g) identifies an individual’s substitute decision-maker. 2004, c. 3, Sched. A, s. 4 (1); 2007, c. 8, s. 224 (6); 2007, c. 10, Sched. H, s. 2.

50

with valuable follow-up information such as patient treatment and vital statistics by linking it to

other data holdings, such as those held at Cancer Care Ontario. To maintain the “prescribed

person” status, the OTB is required to have policies approved by the Ontario Privacy

Commissioner, that describe how it collects, retains, and protects health information and how

anonymized data may be disclosed and to whom. Participants in the OTB fully consent to the

provision of samples and are informed of their status within the Ontario PHIPA and the intended

use.172 This regulated entity will be discussed in more detail in Chapter 4.

The legislative landscape in Canada for biobank activities is a patchwork of different legislation

and regulations where in some circumstances applicability remains uncertain as will be

discussed in Chapter 4. In addition legislation does not contemplate the ever-evolving world of

genomics and biobanking. These complexities are leading some research structures to resolve

the issues through the governance of the biobank.

3.2.2.2.1 Ontario and British Columbia Models

1) Ontario Authority Model

Firstly, it is important to highlight that one of the Ontario PHIPA advantages is that it

includes within the definition of personal health information, any information that relates to the

donation by an individual of any body part or bodily substance of the individual or that is

derived from the testing or examination of any such body part or bodily substance.173 It means

that the personal identifying information that accompanied the body part or bodily substance is

considered personal health information. Secondly, another benefit of the PHIPA is that it

172 Ann Cavoukian, Review of the Ontario Institute for Cancer Research in Respect of the Ontario Tumour Bank: A Prescribed Person under the Personal Health Information Act (Toronto: Information and Privacy Commissioner, Feb 2011), [Cavoukian, 2011], online: <http://www.ipc.on.ca/images/Resources/hfaq-e.pdf>. 173 [PHIPA] supra note 153 at Section 4.

51

established the prescribed person entity that permits prescribed persons such as institutions and

hospitals – health information custodians (HIC) – to disclose personal health information

without consent. The prescribed person who compiles or maintains a registry of personal health

information for purposes of facilitating or improving the provision of health care or that relates

to the storage or donation of body parts or bodily substances will be permitted to receive

personal health information without consent. This model permits the flow of personal health

information between HICs and biobanks within the parameters permitted by PHIPA and the

protections provided by PHIPA.

Ontario has its own specific health information legislation and has taken the unique approach in

its health information legislation of designating some health entities such as the Ontario Institute

of Cancer Research (OICR) in respect of the Ontario Tumour Bank (OTB) and its registries as a

“prescribed entity” that is authorized to collect health information.

Who is a Prescribed Health Registry?

Although subsection 39(1)(c) in174PHIPA does not define the term “registry”, in combination

with Regulation 329/04175 these together provide insight into the scope of this type of registry:

1) The purpose of the prescribed person is to facilitate or improve the provision of health

care or carrying out functions relating to the donation or storage of body parts or bodily

substances. [emphasis added]

2) It is specified that in order to be “prescribed”, a person must compile or maintain a

registry.

174 Halyna Perun, Michael Orr & Fannie Dimitriadis, Guide to the Ontario Personal Health Information Protection Act, (Toronto: Irwin Law Inc., 2005) 467-485. 175 Personal Health Information Protection Act, O.Reg. 329/04, s. 13 (1).

52

3) A person who compiles or maintains a registry of personal health information of this

type may or not be a health information custodian.

4) Where the prescribed health registry is not a health information custodian but receives

personal health information from a health information custodian, such as a hospital, the

registry shall put into place practices and procedures approved by the Information and

Privacy Commissioner of Ontario (PCO), and it is subject to the recipient rules set out in

OPHIPA.

5) The registry must make publicly available a description of its functions, including a

summary of the practices and procedures approved by the PCO.

While some biobanks collect biological materials directly from participants, other

entities perform other biobank activities. For example, cancer agencies conduct large-scale

longitudinal studies. In order for these types of entities to conduct their studies, they require

collaboration and cooperation from hospitals or other institutions to receive larger numbers of

samples and personal health information. The PHIPA prescribed entity covers this aspect of

biobanking and could be used by these entities to facilitate the flow of the data as well as

securing and protecting the personal health information.

Another benefit of the prescribed person is that in order for a health information custodian to be

permitted to disclose personal health information to a prescribed person without consent, the

prescribed person must have practices and procedures in place which are approved by PCO.176

This is to protect the privacy of individuals whose personal health information is being received.

In addition, PCO approved practices and procedures maintain the confidentiality of the personal

176 [PHIPA] supra note 153.

53

health information pursuant to subsection 13 (2) of Regulation  329/04.177  This approach can

be used as a model for good governance practice since it addresses the need for biobank

governance and imposes the obligation of biobanks to create procedures  and policies to protect

the privacy of the participants, with the oversight of the PCO. In addition, this kind of initiative

will be translated in the long run towards the design and establishment of robust biobank

structures. Also the fact that these practices and procedures must also be reviewed by the PCO

every three years from the date of their initial approval provides assurance that there is oversight

by privacy experts who will assess the security mechanisms implemented and review it again in

a reasonable time period to validate the policies and procedures in place. The involvement of the

PCO also includes recommendations made by scholars such as Knoppers et al.178 since one of

their recommendations is that in general privacy commissioner should have the oversight over

biobanks.        

The PHIPA approach with respect to the prescribed person is a step forward for what is needed

in Canada in relation to biobank governance, and to ensure that the biobank has in place

procedures and mechanisms to protect the personal information it holds. Also these procedures

and mechanisms provide certainty and efficiency, as people know what the rules are and what to

expect. As Kaye said, “Having a governance system in place ensures that ethical and lawful

research is supported through accountable and transparent decision-making. This not only

protects the integrity of the research community “but also has the effect of promoting public

confidence and trust”.179 The biobank governance structure is necessary and has to be publicly

177 Ibid. 178 [Cavoukian, 2011] supra note 172. 179 [Kaye, 2011], supra note 127.

54

accountable for its actions and decisions to those affected and involved.180

Participants are willing to participate and collaborate by donating their samples and data for

research. At the same time the public expects that all their rights will be respected. Biobanking

activities are different from traditional research with subjects where the studies are specific,

certain and some even interventional. However, the studies that will be done with the samples

and data deposited in the biobanks will not necessarily be done directly on the participants, so

there is no possible harm to the individual in the same way that could happen in a clinical trial

study; for example, where a company is testing a new drug. From the perspective of the

participants, the major risk with biobanks centers around the autonomy and privacy of the

participants/donors.

i) Advantages of the Authority Model

As explained above, biobanks require an external oversight – a body over which biobanks have

no influence – preferably by mandated statutes that cover the structure of all biobanks. The

prescribed person is based in the licensing of a biobank. This model requires that biobanks have

in place practices and procedures approved by the Privacy Commissioner to protect the privacy

of individuals whose personal health information the biobank receives and to maintain the

confidentiality of that information.181 Another authority example is in the UK where a specific

biobank legislation is the Human Tissue Act 2004.182 This Act established the Human Tissue

Authority (HTA), an oversight authority, and guidance through codes of practice183, for the

180 [Lemmens & Austin, 2009], supra note 51. 181 Subsection 13(2) of Regulation 329/04 of [PHIPA]. 182 Human Tissue Act 2004 (c 30), UK. 183 [Gibbons, 2007] supra note 13.

55

storage and use of human tissue, among other purposes used for research. This body gives

approval by licensing organizations for the store and use of human tissue.

The governance of biobanks is also about regulating the relationships among participants

(donors), researchers and the biobank itself. The next section will examine the advantages that

are encountered in the prescribed person as an authority model, including some good

governance practices, and it will also address some limitations.

a) From the perspective of the participants

(i) Advantages

It is made certain that there is a clear purpose for the biobank.

Transparency of practices are put into place in respect of handling personal

health information.

The protection of the participants is safeguarded to protect participants from

unauthorized disclosure, as the prescribed person is required to implement

procedures to improve the privacy and data security of health information.

It extends the coverage from health information custodians (HIC) to non-

health information custodians that receive personally identifiable health

information from a HIC, for example the prescribed person. Thus, the privacy

protections follow the data.

All the data is required to be de-identified prior to distribution to researchers.

An authority oversight (through the privacy commissioner) is in place to

protect the privacy of the participants. The authority has clear public

accountability in the privacy area and is interested in the protection of the

information held by these structures.

Limitations

Although the data and samples are primarily collected under participants’

consent, sometimes secondary use and disclosure by the HIC to a prescribed

person can be done without consent.

56

The Ontario Authority Model does not provide clear sanctions or privacy

commissioner enforcement powers for unauthorized access and disclosure of

personal health information.

b) From the Biobank perspective:

(i) Advantages:

The Ontario Authority Model provides clear guidance for the design and

establishment of biobanks.

Biobanks may receive without consent personally identifiable health

information from health information custodians (HIC).

In certain circumstances, with a research plan approved by a research ethics

board, these prescribed entities are permitted to use and disclose personal

health information for research purposes as if they were health information

custodians.

A prescribed person is also permitted to disclose personal health information

to another prescribed person that compiles or maintains a registry of personal

health information, and for purposes related to the planning, management and

analysis of the health care system.

The model provides for oversight of the PCO (a three year renewal period

ensures that the governance policies and mechanism remain fit for the

purpose over time).

It makes strong measures mandatory to safeguard the security of health data.

Under this model the biobanks could also aggregate personally identifiable

data from multiple sources, and then provide data to researchers with direct

identifiers removed, under strict security requirements.

The Ontario Authority Model permits the free flow of personal health

information between custodians and biobanks.

ii) Limitations of the Ontario Authority Model:

The burden of developing the policies and procedures rests on the biobank.

57

Although the Ontario Authority will need to implement policies and

procedures, the prescribed person model does not address the need for

creating other committees such as scientific or access committees that we see

more today as part of the biobank governance.

c) Researchers (gaining access to the biobanks)

i) Advantages of the Authority Model

More samples and information are available for research, as well as a more

comprehensive database through data linkages.

Researchers will have access to samples and information stored by regulated

entities, which can offer acceptable standards.

Structures are well organized with specific procedures and rules in place.

ii) Limitations of the Authority Model

Diversity: Researchers will find differences among different prescribed

persons.

Sometimes the policies and procedures are more complex, and access to data

and samples could also be more complex.

Although the Ontario Authority Model does not resolve all the biobank issues, it is a step

towards enacting provincial legislation that gives power to the Privacy Commissioner to license

and approve biobank structures, and that helps to build good governance practices. One

important aspect lacking in the Ontario Authority Model is providing more sanction powers to

the Privacy Commissioner. The Ontario Authority Model gives power to the Privacy

Commissioner every three years during the renewal process to revoke the license given.

However, the legislation should include more power to monitor, investigate and, if necessary,

take formal steps to compel compliance.

2) British Columbia: The Stewardship Committee Model

There are different oversight models to gain access to biobank samples and data. The

Authority Model (through the Privacy Commissioner) has been examined above. Another

model involves setting up either (i) an internal committee (such as a scientific advisory

58

committee) or a data/sample access committee (sometimes a single committee or various

committees) or an external committee such as a stewardship committee which will be discussed

below when examining the British Columbia Stewardship Committee. A stewardship committee

would review access requests made by researchers.

Internal committees are in charge of evaluating the biobank project as a whole and the research

projects submitted that require its use. These committees scrutinize the ethics with regard to

access of research scientists to sample and data.184 External committees – where the biobank

does not have control – are created by statutory mandate. Both types of committees will be

explored.

British Columbia launched an e-health system in 2009. Under the E-Health (Personal Health

Information and Protection Privacy) Act, S.B.C. 2008, c. 38 (E-Health Act), the minister of

health can create health information banks (HIBs). The personal health information in this

system is known as an Electronic Health Record (EHR).

One of the main characteristics of this system is that the E-Health Act gives an HIB

administrator the power to collect identifiable patient information from both public- and private

sector sources.

In addition, this E-Health Act introduced a governance model through the “Data Stewardship

Committee.” This Stewardship Committee is responsible for managing the disclosure of

information (both personal health information and de-identified information derived from

personal health information) for planning or research purposes from Health Information Banks

and prescribed Ministry databases. The composition of the committee is wide and varied with

184 [Rial-Sebbag & Cambon-Thomsen, 2012] supra note 45.

59

members from different disciplines – including the public - and others appointed by the Minister

of Health. The committee is responsible for managing the disclosure of information contained in

a health information bank or a prescribed Ministry of Health database. The committee must

include at least:

• one person from within the Ministry of Health Services;

• one person chosen as a representative of the health authorities;

• one person nominated from the Council of the College of Physicians & Surgeons of British

Columbia;

• one person nominated from the Council of the College of Pharmacists;

• one person nominated from the Board of the College of Registered Nurses;

• one person engaged in health research generally;

• one person engaged in pharmaceutical research;

• three persons chosen as representative of the general public; and

• Ministry of Health Chief Data Steward as a non-voting member.

Anyone seeking data contained in PharmaNet, a health information bank or a prescribed

ministry database for research purposes, must submit a request to the Data Stewardship

Committee through the Data Stewardship Secretariat. If the committee approves the request, the

health information bank or the prescribed database administrator may disclose the requested

information, subject to any conditions set by the Data Stewardship Committee or the

administrator.

This stewardship committee model can be assimilated to the “controlled-access” used by the

60

International Cancer Genome Consortium (ICGC),185 an international initiative which

established two bodies to oversee controlled access to data.

As mentioned previously part of good governance involves controlling data access to protect the

privacy and misuse of the data.

One of the defining features of biobanks is that they are established for the purpose of sharing for

research purposes, and there is a public interest in biobanks being available for medical research.

Access for research purposes should thus be facilitated as much as possible, while respecting any

constraint imposed by participants’ consent and protection of their privacy and confidentiality.

Open access is becoming a well-established practice for large-scale projects, particularly in the

field of genomics. Joly et al. have suggested, “[o]ne possible way to reconcile open data sharing

with privacy concerns is to use a tiered access system to separate access into ‘open’ and

‘controlled’”. Controlled access mechanisms regulate access to certain, more sensitive data (e.g.

genome sequencing files) by requiring an independent body or committee, and complete an access

application that contains privacy safeguards.186

One of the major contributions of the stewardship committee model is the involvement of the

public with the data bank. Just as it is important to pay attention to the scientific project, or the

legal and ethical challenges faced, it is also important to link biobanks to society. Biobanks must

not just be linked to participants but to society in general.187 Therefore, it is vital for biobanks to

maintain and honour public trust through the creation and use of governance mechanisms. The

185 See International Cancer Genome Consortium (ICGC) Goals, Structure, Policies and Guidelines at < http://icgc.org/icgc/goals-structure-policies-guidelines> [ICGC Policies]. 186 Yann Joly et al, "Data Sharing in the Post-Genomic World: The Experience of the International Cancer Genome Consortium (ICGC) Data Access Compliance Office (DACO)" (July 2012) 8(7): e1002549. Doi: 10.1371/journal.pcbi.1002549. PLoS Comput Bio, online: <http://www.ploscompbiol.org/article/info%3Adoi%2F10.1371%2Fjournal.pcbi.1002549 >. 187 [Gottweis, 2012] supra note 7.

61

stewardship committee model is a top-down approach where the state intervenes and requires the

participation of the general public – as a decision maker - who form part of the committee who

will decide who can have access to the data.

4 Challenges of the Existing System

Currently Canada faces few challenges in the context of the existing system in the context of

biobanks. Although biobank activities are not new, their evolution in the last ten years has been

enormous. Research biobanks suffer from a patchwork of regulatory and policy provisions.

Overall, according to a study conducted by Knoppers et al., there is lack of regulation of many

aspects of research biobanks.188

4.1 Regulatory Patchwork

In Canada, privacy legislation comprises various federal, provincial, and territorial statutes and

regulations, professional codes of conduct, guidelines, standards, common law and

constitutional law. Privacy protections available to Canadians vary from one province or

territory to another, and from one sector (public) to another (private or hybrid).

According to an analysis made by Edward Dove et al., the Canadian privacy framework lacks

rationalized and harmonized privacy coverage. In addition, much of our legislation does not

contemplate the novel world of genomics and biobanking.189  Each province has relevant health

information legislation that would need to be satisfied whenever health information is accessed

– which will often be the case. In each province, slightly different rules and standards apply.

188 [Paediatric Report, 2011], supra note at 132. 189 Ibid.

62

Another challenge is the lack of any legislation or jurisprudence for determining whether a

biobank is a “person”, “public body”, “organization”, “institution”, or a similar designation.

This is in addition to the fact that some biobanks have a combination of public and private

funding, and there is no clarity as to how public sector or private sector privacy legislation may

apply in the case of combined funding. This limitation can be foreseen in statutes that apply

only to “commercial activity” as in the case of PIPEDA. The legal landscape is not uniform

across Canada and applicability remains uncertain.190

4.1.1 International

As has been described by Knoppers191 et al., there are currently multiple international bodies

suggesting legal and ethical frameworks for regulating international biobank research. UNESCO

issued its universal declaration on human genome and human rights in 1997. The European

Council agreed on a convention on biomedicine and human rights in 1996, a document that has

been a beacon to many legislators. A follow-up came in 2006 regarding research on biological

material. In 2003 WHO issued a report on genetic databases. The OECD and its working party

on biotechnology provided a draft of guidelines for human genetic research databases in July

2007.

One will for obvious reasons find inconsistencies in terminology and differences in procedures

suggested for biobank research among all those guidelines, emanating from many different

moral and legal traditions.

190 Ibid. 191 Bertha Maria Knoppers, Ma’n Abdul-Rahman & Karine Bédard, "Genomic databases and international collaboration" (2007) 18: 291–311 KLJ [Knoppers, Abdul-Rahman & Bédard, 2007].  

63

As discussed in Chapter 3, there are a number of different kinds of provincial/ territorial

legislation impacting directly on health information. Some provinces have enacted health-

information-specific legislation. Others have legislation that covers personal information in the

private sector, including health information. All have legislation governing information in the

public sector, which may include hospitals and extended care facilities.192 This situation makes

the Canadian regulatory landscape for biobank activities a patchwork of different legislation and

regulations that in some circumstances have uncertain applicability.

On the one hand, although PIPEDA   applies to federally- and provincially-regulated

organizations alike, it does not extend to the provinces unconditionally. If the federal

government is satisfied that a province has enacted “substantially similar” legislation to PIPEDA,  

then the relevant organizations, activities and classes will be exempt from Part 1 with respect to

the collection, use and disclosure of personal information that occurs within that province.

However, even where provincial privacy legislation is deemed “substantially similar,” PIPEDA  

will continue to apply to the extra-provincial collection, use and disclosure of personal

information in the course of commercial activities, as well as to any organization that collects,

uses or discloses personal information in connection with the operation of a federal work,

undertaking, or business. In short, only non-federal intraprovincial   activities will be exempt

from PIPEDA,   although they will remain subject to the substantially similar provincial

legislation.

On the other hand, some provinces started enacting their own health information privacy

legislation that has been declared to be substantially similar to PIPEDA. Currently then, we have

192 [Elaine Gibson, 2007] supra note 154 at 236.

64

a complex legislative map, although each province has enacted its own privacy legislation

modeled upon “Fair Information Practices”193, and not all the statutes have provisions relating

specifically to biobank activities.

4.1.2 Tri-Council Policy Statement (2010)

Funding bodies can have substantial control over those who receive grants from them, since the

grant holders must comply with their funders’ policies and conditions. This means that funders

can prescribe certain norms and conditions as to how research should be carried out by

researchers and biobank operators.

In December 2010, the Canadian Institutes of Health Research (CIHR), the Nature Sciences and

Engineering Research Council of Canada (NSCER), and the Social Sciences and Humanities

Research Council of Canada (SSHRC), three major federal research funding agencies (the Tri-

Agencies), issued a second edition of the Tri-Council Policy Statement (TCPS2). Similar to the

first edition, this document establishes an ethical framework for the conduct of human

participant research, including studies involving human participants and “research involving

human biological materials and stem cells”, whether or not this material is derived from living

or deceased persons.194

However, being a policy statement, the TCPS2 lacks the legal authority of legislative

instruments. Instead, the scope and extent of its regulatory impact rests on other factors. One

such factor is that in order to be eligible to receive and administer funding from the Tri-

Agencies, an institution must agree to abide by a number of Tri-Agency policies referenced in a

193 A concept well established in privacy law, in the context of medical research. More at Office of the Privacy Commissioner of Canada. Online: < http://www.priv.gc.ca/resource/tool-outil/english/fair-info-practices.asp> 194 [TCPS, 2010], supra note 24 at s. 2.1.

65

Memorandum of Understanding (MOU) that each institution enters into with the Tri-Agencies.

Included within these policies is the TCPS2. In addition, the Tri-Agencies grant applications

requiring applicant researchers to certify compliance with all of the Tri-Agencies’ policies

regarding the ethical conduct of research, including the TCPS2, if the research will involve

human participants. As a result, Tri-Agency-funded researchers and their institutions must

comply with the TCPS2.

For example the TCPS2, within the biobank context, obligates researchers to provide research

ethics boards (REBs) with details concerning “their proposed measures for safeguarding

information, for the full life cycle of information: its collection, use, dissemination, retention

and/or disposal.”195

Also, the TCPS2 defines the term “secondary use” as “the use in research of information

originally collected for a purpose other than the current research purpose”. Therefore,

researchers setting out to conduct research using health care records compiled in the clinical

context or biological specimens collected for therapeutic purposes are engaging in secondary

activities. The TCPS2 in Chapter 12 (Human Biological Materials Including Materials Related to

Human Reproduction), and Chapter 13 (Human Genetic Research), contains guidelines on

biobank activities, human tissue samples and human genetics. On the one hand, it recognizes the

importance of biobank structures to help researchers understand diseases as well as their

interactions with our genetic composition. On the other hand, it recognizes that these biological

materials may also present risks to individuals whose biological materials and other personal

information is stored, accessed, used, retained and disclosed through a biobank. Although the

195 Ibid at s. 2.1.

66

TCPS2 alone does not address all aspects of biobank activity, it is very influential in Canada and it

is incorporated by reference into a variety of other regulations. It is worth noting that in section

12.5 two principles were identified that could be considered the core elements that every biobank

shall consider. Specifically, institutions and researchers that maintain biobanks:

a) shall ensure that they have or use appropriate facilities, equipment, policies and

procedures to store human biological materials safely, and in accordance with

applicable standards; and

b) shall establish appropriate physical, administrative and technical safeguards to

protect human biological materials and any information about participants from

unauthorized handling.196

Therefore, in compliance with the TCPS2 every biobank funded by the Tri-agencies shall

develop its own governance through procedures and rules in accordance with applicable

standards. In addition, it is expected that these procedures and rules shall address the

protection, access and use of the information stored by these research structures. Although

it should be mandatory to all universities and institutions funded by the tri-agencies to

establish their own policies and rules, while there is no formal oversight mechanism it is

hard to ensure not only that the institutions/universities have in place comprehensive

procedures and rules, but also to ensure that these rules and procedures are in compliance

with applicable privacy laws and international standards.

Similar to the TCPS, at the international level there are soft laws which include, for example: (i)

National Cancer Institute (NCI) Best Practices for Biospecimen Resources, US197, and the

Organization for Economic Co-operation and Development’s Guidelines on Human Genetic

196 Ibid at s. 2.1. 197 National Cancer Institute (NCI) Best Practices for Biospecimen Resources, U.S. Office of Biorepositories and Biospecimen Research, National Cancer Institute, National Institutes of Health, U.S. Department of Health and Human Services online: http://biospecimens.cancer.gov/bestpractices/2011-NCIBestPractices.pdf.

67

Research Databases (OECD -HBGRD).198 These instruments serve as a reference for biobanks,

researchers and public authorities. Although their violation cannot in any way cause a direct

sanction, they can influence the adoption of more stringent texts.

4.2 Research Ethics Board’s Role

In Canada, Research Ethics Boards (REBs), also known as Research Ethics Committees

(RECs), Institutional Review Boards (IRBs), and Ethical Review Boards (ERBs), have the

mandate to approve, reject, propose modifications to, or terminate any proposed or ongoing

research involving human subjects which is conducted within, or by members of, the institution,

using the considerations set forth according to the Tri-Council Policy as the minimum standard.

The basic principles of medical research governance (following the model of the clinical

trials)199 requires that all research protocols should be reviewed by a research ethics

committee or research ethics board or an equivalent independent body. There are two

components to the ethical review processes where stored biospecimens and data are made

available to other researchers: First, prior ethical approval must have been sought for

collection, storage, transfer, and research use of the biospecimens and data; and second,

further ethical approval must be sought for all proposed future research using the

biospecimens and data.200

The problem with REBs in Canada is the absence of national REB regulations that could specify

requirements for REBs accreditation or central governance in place. Although there is strong

198 OECD: Principles and Guidelines for Access to Research Data from Public Funding. 2007, online: OECD <http://www.oecd.org/dataoecd/ 9/61/38500813.pdf>

199 Such of those found in ICH Guidance E6: Good Clinical Practice: Consolidate guideline, especially those in section 3. 200 Donald Chalmers et al, “A Role for Research Ethics Committees in Exchanges of Human Biospecimens Through Material Transfer Agreements” (Epub ahead of print, Jun 2014) J Bioeth Inq. [Chalmers D et al], online: <http://www.ncbi.nlm.nih.gov/pubmed/24965440>.

68

recommendation201 by scholars such as Trudo Lemmens to institute such a system, it does not

appear imminent. Furthermore there is no restriction on who can establish an REB, who

becomes a member, or any training needed.202 We can find both institutional and private REBs.

While the former are at least part of a “soft” regulatory system emanating from the funding

agencies. Tri-Agencies the latter are currently without a clear regulatory structure.203 The lack

of public accountability of private REBs is problematic, and it is a concern recognized by the

College of Physicians and Surgeons of Alberta, which has set up a Centralized Research Ethics

Review Committee204 to oversee the research activities of all physicians and surgeons in

Alberta.

As a primary responsibility, REB members are the gatekeepers charged with reviewing all

clinical trials in Canada. The responsibility for protection of research participants rests at the

local REB level. Many REBs in Canada are maintained as volunteer-service committees often

with a high membership turnover rate. There is neither formal REB training nor a mandated

continuing education process in Canada. At the same time there is increased demand for REB

accountability and for ensuring patient safety.205

In the biobank context, REBs cannot and should not be expected to perform and address the

kind of privacy related review and oversight that is needed for research biobanks. In addition, it

is dangerous to assume that an “REB has the competency to engage in the level of privacy

201 Trudo Lemmens, “Federal Regulation of REB Review of Clinical Trials: a Modest But Easy Step Towards an Accountable REB Review Structure in Canada” (2005) 13(2-3): 39-50 Health Law Review (Special Issue on Research Governance) [Lemmens, 2005]. 202 Ibid. 202 Ibid. 203 Ibid. 204 Ibid. 205 Ibid.

69

oversight needed.” 206

It is problematic when there is no oversight authority – with biobank structures

expertise– to ensure that biobanks are established with a robust governance system.

In a 2014 study conducted by Elaine Gibson et al., 34 REBs and/or REB administrators

affiliated with faculties of medicine in Canadian universities were interviewed about the

role for REBs in the creation and uses of registries and biobanks. A wide range of

responses was given for the questions raised in the scenarios, indicating a lack of clarity

about the role of REBs. For example, all respondents agreed that patient consent was

needed for blood samples to be placed in the biobank but the duration of consent varied.207

One of the sites in the study expressed the following:

“Some of the decisions should be taken by authorities above local REBs. Rules should be clarified so that each local REB does not have to take decisions. Such fundamental decisions [should] not rest upon the shoulders of local REBs. The consequences of certain decisions can impact on people or populations, which makes even more [persuasive] the case for the need for a regulatory framework on banks.”208

REBs in Canada have not received clear guidance regarding their role in the creation and access to

biobanks. The original mandate of REBs was more regarding the approval for specific study-by-

study, thus not engaging in some of the larger issues concerning the creation and research uses of

biobanks. The ethical level could be handled by the REBs. However, we should ask ourselves

whether the REBs’ mandate to protect the safety of research participants could be extended to

biobank activities. This differs from what REBs are accustomed to doing. It also differs from

ethics approval in the context of traditional medical research since participants’ information will

206 [Paediatric Report, 2011], supra note 132 at 58. 207 Elaine Gibson et al, "Who's minding the shop? The role of Canadian research ethics boards in the creation and uses of registries and biobanks" (2008 Nov 14) 9:17 BMC Med Ethics [Elaine Gibson et al, 2008]. 208 Ibid.

70

be held for longer periods of time in biobanks and there is some kind of uncertainty of the

research that will be done with those samples and information in the future.

REBs are the central mechanism through which the conduct of research is governed to facilitate

the public good. But all too often the REBs do not have adequate expertise on all the aspects

involved in research, for example when we talk about biobank structures, one of the main

concerns is the privacy of the participants. So it is not clear whether the REBs are specialized in

the protection of privacy when there is the possibility of re-identification, or unwanted

disclosure of the data, or what kind of technological/security mechanisms are needed to protect

the information. Research is becoming increasingly complex and specialized. Advances in

biomedical research, such as in the areas of genetics, mean that new expertise is required to

understand the new challenges and to effectively evaluate them.209

4.3 Oversight by the Privacy Commissioner

An important aspect to ensure a good governance system, and the public trust for biobanks as a

research infrastructure, is storage and making sensitive information available for future research.

Concerns arise over who has the power and the ability to ensure compliance, and also the

mechanisms for enforcement of decisions. Whether there is power may have implications for

ensuring that privacy and security policies are respected, and for ensuring that a private entity to

which commercialization rights are granted respects these rights and does not act in an abusive

manner.210 Canada needs an authority with power to monitor, investigate and, if necessary, take

formal steps to compel compliance or punish misconduct. This authority could be the Privacy

Commissioner, however to date the Privacy Commissioner does not have sufficient “penalties

209 Ibid. 210 [OECD, Exec Sum] supra note 11.

71

and sanctioning and enforcement powers” for violations disclosing personal or health

information in the biobank context.211

As I proposed in this thesis, one possible path in providing stronger protection to the privacy

interest of participants is giving power to provincial privacy commissioners and the Office of

the Privacy Commissioner to oversee and monitor biobanks. In Canada, this idea is not that far

away, since currently some initial approaches exist through the power to license “prescribed

persons” by the Ontario Privacy Commissioner, where in order to become a “prescribed person”

all procedures and rules require Ontario Privacy Commissioner approval, as explained in

Chapter 3. Another similar example is the participation of privacy commissioners in Canada’s

National DNA Data Bank Advisory Committee,212 in which a representative of the Office of the

Privacy Commissioner sits in the committee to ensure that the data bank has access to expert

advice in the field of individual privacy. Federal and provincial privacy commissioners

generally are not vested with authority to make binding decisions. There are, however,

exceptions: the British Columbia Information and Privacy Commissioner’s orders are

enforceable,213 and both the Alberta and Ontario Commissioners make binding orders under

their health information legislation.214 However, Commissioners are empowered to investigate

pursuant to a complaint, and may also launch an investigation where there are reasonable

grounds to believe there has been a contravention of the statute.215 In Europe, due to the

211 [Paediatric Report, 2011], supra note 132. 212 DNA Data Bank Advisory Committee Regulations, SOR/2000-181. 213 Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, C. 165, S. 59; Personal Information Protection Act, S.B.C. 2003, c. 63, s. 53. 214 Health Information Act, R.S.A. 2000, c. H-5, s. 81; Personal Health Information Protection Act, 2004, S.O.. 2004, c.3, Sched. A, s. 61. 215 For example in Ontario [PHIPA] supra note 153 at Part VI Administration and Enforcement.

72

provisions contained in Directive 95/46/EC216 data protection authorities also have an important

role in overseeing data processing not only within biobanks, but also the use of data and samples

by researchers.

In the biobank context, as discussed in this chapter regarding the role of the REBs, the current

ethics system is not very accountable and trustworthy. Thus the protection of biobank

participants cannot rely exclusively in the REBs. The monitoring and oversight of biobanks

requires the participation of other governmental bodies with different expertise – such as

privacy – and preferably with a statutory mandate, which at the same time promotes good

governance practices. I acknowledge that these proposed changes will require providing more

specific training, expertise and resources to facilitate biobank activities which go beyond their

normal duties.

The power of the Privacy Commissioner should be extended for licensing and keeping records

of all existing research structures that hold biological materials, tissue, and genetic databases.

5 Strengthening the System

In response to the challenges mentioned in the previous chapter, new legislative

approaches and governance mechanisms have been proposed and adopted to enable

biobanking to proceed. For instance, few jurisdictions around the world have legislated in

response to the phenomenon of biobanking, as is the case in Iceland, Norway, Sweden,

Estonia and Latvia.217 However, the far more common response has been policy led by

funders and other stakeholders initiating multilevel policy initiatives to guide biobank

practices. An example of this is the UK Biobank, which has developed and operates

216 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Official Journal L 281 , 23/11/1995 P. 0031 - 0050 217 [Cambon-Thomsen , 2007] supra note 23.

73

according to an Ethics and Governance Framework.218 Although this instrument has no

basis in law it is a requirement for the biobank that anyone gaining access to the biobanks

follows and complies with these procedures and rules. The purpose of this chapter is to

present some important initiatives and approaches developed to date.

5.1 International Initiatives

In the international context, legislation specific to biological material and/or data collection

exists at the national level, as is the case in Iceland, Norway, and Latvia.219

However, in other jurisdictions there are additional bodies sanctioned by the state, which are

responsible for biobanking activities, such as the Human Tissue Authority in the UK. These

kinds of oversight previously mentioned are external mechanisms where biobanks have no

control. These mechanisms include binding and, in some cases non-binding, sources of

obligations.220

At the same time, new oversight bodies – internal221– have emerged which operate within the

existing regulatory/ethical structures but are designed especially for biobanks. As part of the

governance structure, some biobanks will typically have a scientific advisory board and data

access committee. These bodies have been essential for transparency and accountability and for

ensuring confidence in the governance of biobanks.222

In May 2000, the Icelandic Parliament passed the Icelandic Biobanks Act, the world's earliest

attempt to construct binding rules for the use of biobanks in scientific research. The legislation

218 [Graeme, 2011], supra note 119. 219 [Cambon-Thomsen , 2007] supra note 23. 220 [Mallete, Tasse & Knoppers, 2013] , supra note 126. 221 Internal oversight is created by the biobank itself to meet a requirement or fulfill its role, to control the access to data and samples. 222 [Hotweiss & Kaye, 2012], supra note 94.

74

had the purpose of authorizing the collection, storage, handling and utilization of human

biological samples in a manner that would maintain confidentiality, safeguard the interests of

donors of biological samples, ensure that the utilization of the biological samples serves the

purposes of science and medicine, and also ensure that such utilization is conducive to the

public good.223 In sum, the purpose of this Act is to achieve a balance between the welfare of

the participants and the carrying out of the research. The Act contains provisions dealing with

requirements and conditions for obtaining a license from the Minister of Health.224 Also there

are specific provisions for biobank governance, such as (i) the need to establish a board which

shall monitor the operation of the biobank,225 (ii) how to obtain access and use of biological

samples,226 and (iii) consent of donors of biological samples and revocation of consent. In

addition, it gives the Data Protection Authority the power to monitor the security of personal

data in biobanks.227

Legislation can also be found in Estonia, which established the Human Genes Research Act in

2000.228 This Act was specifically designed to govern the establishment of a national biobank

by the Estonian Genome Project Foundation. This Act governs genetic research conducted with

the “Gene Bank” and mandates requirements for the maintenance of a biobank as well as for a

Data Protection Commissioner and a Supervisory Board to oversee the biobank.229

223 Iceland, Biobanks Act, No. 110/2000, as amended by Act No. 27/2008 and Act No. 48/2009.   224 Ibid at Art. 4. 225 Ibid at Art. 6. 226 Ibid at Art.9. 227

Ibid at Art. 12. 228 Human Genes Research Act, 2000 RT I 2000/10/685. 229 [Wallace et al, 2008], supra note at 125.

75

Another example is in Latvia, which in 2003 also adopted a biobank specific law, the Human

Genome Research Law.230 The purpose of this law is to regulate the establishment and operation

of a national genome database for the state population. There is a State Data Inspector who is

responsible for the oversight of the resource and for receiving complaints. The Central Ethics

Committee also has a governance role, to evaluate compliance with the principles of ethics in

genetic research and establishment and operation of the genome database.231 232

The above countries have in common their creation of statutes which create or give a mandate to

an existing body to monitor and oversee biobank activities. These statutes not only govern the

creation and establishment of these research structures under the law, but also they create a clear

legal framework that seeks to protect participants’ rights at stake.

5.2 Canada Initiatives

Currently, a large number of biobanks have a similar initiative with policies and procedures that

guide decisions and practices. In addition to this trend of self-regulation there are some initiatives

that complement and enhance the process of designing and developing these policies and

procedures.

One example that is worth mentioning is the Public Population Project in Genomics (P3G), a not-

for-profit international consortium that provides access to expertise, resources and up-to-date

information on public population genomics. P3G was initiated in 2003 with the aim of fostering

collaboration between researchers and projects in the field of population genomics, as well as to

facilitate the harmonization of samples and data from international biobanks. In 2008 the P3G

230 Ministry of Foreign Affairs of the Republic of Latvia, online: <http://www.am.gov.lv/en/?id=480> 231 Human Genome Research Law, 2002 (Latvia). 232 [Wallace et al, 2008], supra note at 125.

76

Ethics and Policymaking Core put forward a document identifying core elements to consider

when drafting an “Access Policy for Population Biobanks.” 233 More recently, P3G has updated

the document with “The P3G Model Framework for Biobank Governance (2013).” This updated

document incorporates an analysis of the last five years of legislation, policies and literature that

have influenced and shaped the governance of biobanks, and reflects the P3G vision of global

access to research tools.234 Members of P3G share their tools and their methodologies. This kind

of initiative is an important contribution to these research structures, since their goal is to facilitate

the establishment process for biobanks, but in a consistent, efficient and harmonized manner.

Another initiative found in the international and national context is the establishment of advisory

bodies as part of the governance structures. To date, biobanks will typically have a scientific

advisory board and data access committees, and sometimes these are established by statute as in

the case of the British Columbia Stewardship Committee discussed in Chapter 4. But, but as also

discussed in that chapter these committees can be also part of the self-governance system such as

the ICGC.235

As mentioned before, this thesis does not suggest that such particular type of legislation is the only

solution for biobank governance nor does such governance involve a one step process for

achieving a complete legal framework. Instead it is argued that a legal framework is needed which

will provide some statutory shape and regulate oversight and sanctions mechanisms for these

biobank structures. Thereafter, any gap in legislation or regulations should be addressed through

governance.

233 Susan Wallace, P3G Sample and data Access Policy: Core Elements, Centre de Recherche en Droit Public (CRDP), (Université de Montréal 2008) [Wallace, 2008], online: <http://www.p3g.org/biobank-toolkit/p3g-sample-and-data-access-core-elements>. 234 [Mallette, Tasse & Knoppers, 2013], supra note 121. 235 See [ICGC Policies] supra note 185.

77

6 Conclusion

Traditionally in the biobank context, while dealing with ethical issues, attention has been mainly

focused on the nature and scope of the informed consent. As discussed elsewhere in this thesis,

biobanks have started to shift the focus from informed consent to giving greater attention to the

governance system as a mechanism to deal with biobank issues. As a consequence, biobanks

have started to develop and establish a self-governance system.

In Canada, despite the diversity of regulatory bodies, statutes and guidance that apply to medical

research, very little of this has relevance for biobanking. Currently Canada does not have a clear

regulatory system on biobanking, therefore the burden of developing rules and procedures relies

on biobanks themselves, which need to exercise considerable judgment about the best sources of

guidance to follow. If the funder or REB did not clearly outline what should happen, biobanks

are forced to select from a wide range of sources to identify standards and practices that are

relevant for biobanks. The system appears to depend on self-regulation or soft law. In addition

to these difficulties, the current biobanking governance framework in Canada depends on

“informal” oversight methods. Furthermore, the “informal oversight” approach also raises the

challenge of ensuring that all biobanks have proper governance.

This thesis has made the argument that a competent statutory authority should carry out

supervision of biobanking activities to ensure that biobanks have in place good governance

practices to safeguard participants’ interests.

One criteria could be that all biobanks with a significant sample size and storage time for

relevant research material surpassing five years must be licensed and overseen by the authority,

in this case by federal and provincial privacy commissioners, who should be included within the

regulatory framework for biobanks created for research.

78

Canada needs to determine the degree of governance required. One option is legislative

amendments that are more likely than legislative constructions. For example PIPEDA – federal

level – should be amended to allow the inclusion of some regulatory framework for biobanks,

including greater sanctions against breach of privacy. However this could be controversial due

to constitutional parameters, such as the provincial jurisdiction over health related matters, as

well as the fact that this statute is limited to the private sector. Other options, and more feasible,

are at the provincial level. These include amending privacy statutes to better incorporate

specific related issues236, and giving power to the provincial privacy commissioner to monitor

and oversee biobanks with sufficient sanctioning and enforcements powers for the breach of

privacy and confidentiality of the participants.237 Adaptation of existing legislation in order to

incorporate the characteristics of biobanks will be desirable as a provincial approach for the

standardization of the existing personal health information legislation.

The legislative proposal is based on the idea that the law has validity and authority which is

lacking in administrative standards such as internal policies and procedures, and that the law

provides greater consistency. The consistency makes the regulation predictable in order to give

stability and certainty to those who are being regulated.238 Another advantage of a law is that it

has longevity that administrative standards lack and the various stakeholders can therefore trust

the stability of the applicable rules.

Also legislation connects with the public, who have a substantial interest in participating and

collaborating in donating their samples to biobanks to facilitate research that may more

236 [Paediatric Report, 2011], supra note 132 at 58. 237 Ibid. 238 Jane Kaye et al, Governing Biobanks-Understanding the interplay between law and practice, 1st ed (US and Canada: Hart Publishing, 2012), at 311.

79

effectively prevent, treat, and cure disease. Thus, the public interest is formally entrenched on

both sides of the interests to be balanced. Some essential reforms are unique to biobanks.

Therefore the establishment of a statutory oversight authority is a necessity.