Safeguards for research using large scale DNA collections

Plans for a major DNA collection in UK

In 1998 the Medical Research Council received £12m additional funding to support national DNA collections as part of its Post-Genome Challenge. This money has been channelled into the establishment of a series of regional DNA banks as well as a proposal to create a single very large new resource, the UK Population Biomedical Collection,3 which is a joint initiative with the Wellcome Trust.

The collection will be concerned with genetic epidemiology and understanding the interactions between genes, environment, and lifestyle. In particular, it will focus on the diseases of later life, such as cancer and cardiovascular conditions. It will contain DNA samples from up to 500 000 people, which will be linked to personal medical records and family histories through general practices. Furthermore, the prospective nature of the study will span many years and require the ongoing collection of data from research subjects. Genotyping would be done in centralised facilities; investigators would only have access to data, not to the samples themselves; and all proposals for research would be peer reviewed. Companies would also be able to access the data from the collection on a non-exclusive basis.

Despite considerable progress in developing the technical outline and management arrangements for the collection, several important ethical and public policy questions about its operation have yet to be resolved, including access to personal medical information, the prospective nature of the research, commercial involvement, and the form of oversight of research. These will be subject to consultation. In addition, the Wellcome Trust and MRC recently commissioned a market research organisation to examine public opinion on genetic research involving donated samples in order to help inform policy.

Although the design and aims of the population collection are different from the research being conducted in Iceland, the parallels are striking and the social and ethical issues raised are almost identical. It is therefore worth looking at events in Iceland as they highlight key issues for the United Kingdom.

The Icelandic experience

There has been extensive international debate about the proposed creation of the Icelandic Health Sector Database and the activities of the biotechnology company deCODE Genetics. At present DNA samples from large numbers of people who have common diseases, such as cancer and heart disease, are being collected by deCODE for genetic linkage analysis and association studies. This collection has been carried out with informed consent and access to patients has been obtained through general practitioners. In the longer term the company plans to integrate this database of individual genotype profiles with the medical records of almost every Icelandic citizen and publicly available Icelandic genealogies. These three separate databases will be linked under the administrative structure of the Health Sector Database to allow deCODE to carry out genetic epidemiological research.

(Credit: JANE SMITH)

The proposal to construct such a database was widely debated in the Icelandic parliament, the media, and the community. It provoked vocal opposition internationally, as well as within Iceland, and areas of concern that were highlighted included the speed with which the proposal had been made and the lack of consultation; the lack of consent for inclusion in the database; the security of the data and the danger of information being made public; third party access to information; the type of research the database would be used for; the threat of the database to scientific freedom within Iceland; and commercial ownership of the research findings.

Initially, it was proposed that individuals' medical records would be included in the Health Sector Database and linked to Icelandic genealogies and DNA samples, without the individual being asked for consent. Because of domestic and international pressure this was changed to an “opt out” system. The lack of consent has been one of the most contentious issues surrounding the proposal for the database, as it has been seen as a breach of the principles contained in the Declaration of Helsinki and the Icelandic Patients Rights Act 1997. Although explicit prior consent would be sought in the United Kingdom, the design of the Icelandic Health Sector Database provides a model for the review mechanisms that could be established in Britain.

The Icelandic Health Sector Database Act 1998 requires that the existing Data Protection Commission and two new bodies appointed by the government are involved in the planning and supervision of the database. The Data Protection Commission will ensure data security by approving the procedures that deCODE puts in place to collect, register, and process personal data during the establishment of the database and its subsequent operation. It has powers of investigation and can have free access to deCODE's premises for this purpose without having to seek a warrant.4 It will also have an active role when the database is running, as it will carry out the encrypting and coding of data and will oversee the procedures linking the different databases of medical information, genotypes, and genealogies. The newly created Monitoring Committee will oversee the day to day running of the database and report irregularities back to the Data Protection Commission and the minister of health.5 The other new regulatory body, the Interdisciplinary Ethics Committee, will approve the research questions submitted to the database and will be overseen by the National Bioethics Committee.

Essentially the role of these bodies is to ensure that the running of the database conforms to the conditions of the licence agreement and the provisions and regulations of the Health Sector Database Act 1998. They can report back to the minister of health, who has the power to revoke deCODE's license if the conditions are not satisfied or there are any breaches of confidentiality. Criminal sanctions and fines can also be imposed on individuals as well as the company. However, only when the database is fully operational in 2001 will the effectiveness of these committees, their independence, and this system of checks and balances be fully tested.

Regulation and oversight of DNA collections in UK

Medical research in the United Kingdom is governed primarily by a system of regulation through guidelines issued by the Department of Health, the Medical Research Council, the General Medical Council, and professional bodies such as the royal colleges. In contrast to Iceland, the United Kingdom has historically left the regulation of medical research to the profession rather than to parliament. An example of this contrast is that in Iceland the Patients Act 1997 controls medical research on humans, whereas there is no such specific legislation in Britain. However, it is notable that in Britain there is long-established legislation controlling medical research on animals, which allows for an inspectorate to audit and enforce compliance with the statutory standards.6

This system of self regulation means that the professional bodies have the responsibility of ensuring that their guidelines on research are up to date. It also means that different regulations will apply to different professional groups. Currently no guidelines relate specifically to population collections. The operational guidance for the UK Biomedical Population Collection has not yet been drafted, although the Medical Research Council's guidelines on the use of biological samples and personal medical information will probably be used as source documents. 7 8 Although these provide a useful framework, they do not set in place all the computer security and review mechanisms that are needed for large population collections in order to safeguard privacy. The World Medical Association and the World Health Organization have announced that they will be drafting guidelines on databases.9 However, it must be asked whether an international body can draw up guidelines with sufficient specificity and sensitivity to local conditions to have a significant impact in the United Kingdom.

In the United Kingdom, research ethics committees play the central role in regulating medical research through their review of research proposals. However, they are unlikely to have sufficient expertise or training to oversee the research carried out using the population collection. Although ethics committees can request reports after research projects have started, most are concerned only with prior review and none have powers of enforcement or policing. The Data Protection Commission, which has a statutory responsibility for the security of data, requires that everyone who processes personal data must be registered. However the commission tends to rely on codes of practice developed by professional bodies to give effect to the Data Protection Act. Although the data protection commissioner has been given additional enforcement powers under the new act (1998), it is still uncertain how these will be used. Unlike its Icelandic counterpart, in the past the commission has tended to respond to complaints rather than taking a more proactive approach of oversight and investigation.

The challenges posed by advances in genetic technology and the erosion of public confidence in the ability of the medical profession to govern itself mean that new regulatory mechanisms may be required. The experience of Iceland shows the need for fully independent regulatory bodies that have sufficient powers of investigation and enforcement. The current situation in the United Kingdom is contrary to this, as the funders of research, the managers of the database, and the regulators can be the same institutions. To instil greater public confidence it will be important to establish a regulatory system where these functions are clearly separated and carried out by independent bodies.

Lessons from Iceland and proposals for the UK

Many of the questions raised in the Icelandic situation will inevitably be raised by the creation of the UK Population Biomedical Collection. For example:

• How will informed consent be given when the future research uses of the personal information is unknown?

• What measures will be taken to ensure the security of personal medical and genotype data? What sanctions will be taken if security is broken?

• What type of research will the collection be used for? Who will be involved in the development of policy?

• Which third parties will be able to have access to the data associated with the collection?

• How can the misuse of this data by insurers, employers, and other third parties be prevented?

• How will the commercial use of the collection be regulated?

In addressing these issues some important lessons can be learnt from the Icelandic experience. Firstly, a key component of winning popular support for the creation of population based DNA sample collections is to ensure that a widespread public debate is held involving all groups with an interest in this area. Secondly, there needs to be a clear legal framework within which such research activities take place. The current situation in the United Kingdom is inadequate compared with the measures taken in Iceland, and the government should review where the law may need to be strengthened. Finally, there need to be strong independent oversight mechanisms to ensure that legal and professional guidelines are adhered to. With a project of this size, complexity, and expense there is a serious risk that self regulation will fail to convince the public that sensitive genetic information will not be misused.

There are several possibilities for regulation. The benefits of a legislative approach are that it will provides a framework that can be uniformly applied to everyone and will cover publicly funded institutions as well as commercial enterprises. An example of effective legislation in Britain is the Human Fertilisation and Embryology Act passed in 1990. Perhaps a statutory national office for the licensing and inspection of genetic databases along the lines of the Human Fertilisation and Embryology Authority might be established. This could strengthen the role of local ethics committees and keep a national register of large DNA collections, as well as having an inspection function.

In recognition of the many important issues raised by the proposed collection the recently established Human Genetics Commission has identified this area as a priority for its work and will be launching a public consultation exercise in late November. In addition, the House of Lords Select Committee on Science and Technology is currently carrying out an inquiry into the general development of “genetic databases.” It is hoped that policy makers will learn from the experience of Iceland. Without widespread public support for population genetic studies there is a real danger that human genetics could become the next biotechnology scare.