Iceland's database is ethically questionable

Last December the Icelandic parliament, Althingi, passed an act on a health sector database. The legislation was instigated by a Delaware corporation, deCODE, a biotechnology company operating in Iceland (2 January, 11).

The company will receive an exclusive licence to construct a database containing the entire country's health records and permission to combine and analyse them with genetic and genealogical data.

“Some issues … should be left out of politicians' hands”

The Icelandic government and deCODE maintain that the project will uphold patients' rights and conform to international obligations and will serve as a model for similar databases elsewhere (20March, p 806).

Few geneticists dispute the usefulness of databases. Rather, the debate focuses on how deCODE, through the act, has been permitted to break fundamental principles of scientific conduct: the requirement that research plans should be evaluated and approved by independent ethics committees before recruiting patients for studies. Without submitting a research plan, deCODE convinced the Icelandic government that it should pass a law which avoided the necessity for review by the bioethics and data protection committees, the official regulatory bodies. While the government asked for the opinion of these committees after the bill was written, their recommendations on key issues, such as consent and exclusivity, were not followed.

deCODE has also been allowed to preclude patients' second line of defence by not obtaining informed consent from participants. The implementation of informed consent in the strictest sense may be difficult for the database envisioned by deCODE. However, it seems fair to require a general consent outlining the type of information entered and its potential use, benefits, and risks.

We have been repeatedly told that the database will be anonymous (non-personally identifiable); the main argument for avoiding informed consent. However, old medical records, which might otherwise never have been examined, will now be read and the data entered into the database; at that stage there will be no anonymity. Also, while identity will be encrypted after the data have been entered, individuals will be easily identifiable in our small society. More importantly, health data on individuals will be added in “real time,” and, to permit this, the identity of individuals will be encrypted, not anonymised. Thus, a key linking Icelanders' names to their database information will be in continuous use, and despite one way coding the owner of a particular set of health information can be quickly found by sequentially entering the names of Icelanders.

What if studies using the database reveal that some Icelanders carry mutations predisposing them to serious diseases for which preventive measures are available? It seems fair that patients contributing to the database should be able to obtain potentially lifesaving information from the database. Doctors and scientists involved with the database should also be obliged to provide this information, provided that an individual wants to know and ethics committees deem contacts appropriate. Therefore, it is troubling that deCODE and the Icelandic government maintain that the database is anonymous when it is clearly not.

Much has been made of the so called “opt out” clause allowing Icelanders to decline participation. But the mechanism is crippled because patients who halt participation are not allowed to withdraw their data after entry into the database.

As justification, deCODE and the government claim that the act results from an informed democratic decision. But only 13% of the nation considered themselves to have a good grasp of the bill, according to a Gallup survey in November 1998.

deCODE, helped by Iceland's former president, Mrs Vigdis Finnbogadottir, and prime minister, Mr David Oddson, swayed public opinion and pushed the act through parliament before the public understood the issue. While the decision was democratic, if defined as a majority vote in parliament, such a decision should not supersede individual consent when it comes to participation in human investigations. The history of unethical state sponsored research that fulfills this criterion emphasises the obvious fallacy of deCODE's argument. Clearly, some issues, including the ethical evaluation of research and databases, should be left out of politicians' hands.

We have to embrace attempts to attract foreign capital. But it seems only fair that the company should submit its plan, for example, to institutional review boards affiliated with Harvard University in the Boston area in the United States where major shareholders are located. Plans analogous to the Icelandic database would never be approved in the United States. Neither should the expatriate activities of deCODE in Iceland.