Health research and the protection of personal information rights in international ethics and human rights law Colin M Harper Promoting Health Research and Protecting Patient Rights Irish Data Protection Commissioner 29 November 2006 International Ethics Codes вЂў Nuremberg Code вЂў Helsinki Declaration вЂў CIOMS Guidelines Nuremberg Code (1947) вЂў Aimed at outlawing gross abuses of human beings in medical research for вЂ�public goodвЂ™. вЂў Emphasis upon necessity of gaining consent of the human subject for all participation in research. вЂў No explicit reference to use of personal information constituting research, but not excluded either. вЂў вЂ�Prevention of вЂ�unnecessary mental sufferingвЂ™ might be interpreted broadly enough to cover use personal of information even after anonymisation. World Medical Association Declaration of Helsinki (1964/2004) The World Medical Association has developed the Declaration of Helsinki as a statement of ethical principles to provide guidance to physicians and other participants in medical research involving human subjects. Medical research involving human subjects includes research on identifiable human material or identifiable data. Para. 1 World Medical Association Declaration of Helsinki (1964/2004) It is the duty of the physician in medical research to protect the life, health, privacy, and dignity of the human subject. Para. 10 World Medical Association Declaration of Helsinki (1964/2004) The right of research subjects to safeguard their integrity must always be respected. Every precaution should be taken to respect the privacy of the subject, the confidentiality of the patient's information and to minimize the impact of the study on the subject's physical and mental integrity and on the personality of the subject. Para. 21 World Medical Association Declaration of Helsinki (1964/2004) вЂў Explicitly includes the research on вЂ�identifiable dataвЂ™ under its ethical protections. вЂў Emphasizes the principles of consent and the primacy of the person. вЂў It sets no limits on the ability of a person to restrict the use of their вЂ�identifiable dataвЂ™ for medical research. вЂў Makes connection between privacy, confidentiality and вЂ�physical and mental integrityвЂ™ and вЂ�personalityвЂ™ of the research subject. CIOMS International Ethical Guidelines for Biomedical Research Involving Human Subjects (2002) Patients have the right to expect that their physicians and other health-care professionals will hold all information about them in strict confidence and disclose it only to those who need, or have a legal right to, the information, such as other attending physicians, nurses, or other health-care workers who perform tasks related to the diagnosis and treatment of patients. A treating physician should not disclose any identifying information about patients to an investigator unless each patient has given consent to such disclosure and unless an ethical review committee has approved such disclosure. Guideline 18 CIOMS International Ethical Guidelines for Biomedical Research Involving Human Subjects (2002) For [epidemiological] studies it is usually impracticable to obtain the informed consent of each identifiable patient; an ethical review committee may waive the requirement for informed consent when this is consistent with the requirements of applicable law and provided that there are secure safeguards of confidentiality. Guideline 18 UN Human Rights Instruments вЂў Universal Declaration of Human Rights (1948) вЂў International Covenant on Civil and Political Rights (1966) вЂў UN Convention on the Rights of the Child (1989) вЂў UN Declaration on Bioethics and Human Rights (2005) Article 12 of the Universal Declaration of Human Rights (UDHR) (1948) No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks. Article 17 of the International Covenant on Civil and Political Rights (ICCPR) (1966) 1. No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation. 2. Everyone has the right to the protection of the law against such interference or attacks. Article 16 of the UN Convention on the Rights of the Child (1989) 1. No child shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation. 2. The child has the right to the protection of the law against such interference or attacks. Article 9 UN Declaration on Bioethics and Human Rights (2005) The privacy of the persons concerned and the confidentiality of their personal information should be respected. To the greatest extent possible, such information should not be used or disclosed for purposes other than those for which it was collected or consented to, consistent with international law, in particular international human rights law. Article 9 Regional European Standards вЂў European Convention on Human Rights (1950, as amended) вЂў European Convention on Human Rights and Biomedicine (1999) вЂў Additional Protocol to European Convention on Human Rights and Biomedicine on Biomedical Research (2005, not yet ratified) вЂў Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Data Protection Directive) вЂў European Standards on Confidentiality and Privacy in Healthcare (2006) Council of Europe Convention on Human Rights (ECHR) Article 8 of the Convention reads as follows: 1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of othersвЂќ. Definition of вЂ�Private lifeвЂ™ in European Convention on Human Rights (ECHR) вЂў вЂ�gender identification, name and sexual orientation and sexual lifeвЂ™; вЂў вЂ�right to identity and personal developmentвЂ™; вЂў вЂ�right to establish and develop personal relationships with other human beings and the outside worldвЂ™; вЂў вЂ�physical and psychological integrityвЂ™; вЂў вЂ�the development without outside interference of the personalityвЂ™; вЂў вЂ�moral integrityвЂ™; вЂў вЂ�preservation of mental stabilityвЂ™; вЂў вЂ�individualвЂ™s physical and social identityвЂ™; вЂў вЂ�personal autonomyвЂ™. EU Directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data вЂў A Directive is a piece of European Union legislation which is addressed to Member States. вЂў Once such legislation is passed at the European level, Member States must ensure that it is effectively applied in their domestic legal system. вЂў The Directive prescribes an end result. The form and methods of the application is a matter for each Member State to decide for itself. Aim of the Data Protection Directive Directive 95/46/EC on data protection aims to enable the free flow of personal data from one Member State to another for the purposes of the internal market, whilst at the same time ensuring that fundamental rights and freedoms of individuals (in particular, privacy) are safeguarded by ensuring a high level of equivalent protection of these rights and freedoms in all the Member States. Article 8 of Directive 95/46/EC вЂў Deals with the processing of special categories of data, including data concerning health. вЂў Member States must prohibit the processing of those special categories of data. вЂў Except in certain situations, including those (a) вЂ�where the data subject has given his or her explicit consentвЂ™; (b) вЂ�where the processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving his consentвЂ™ (Art. 8/2). вЂў Directive 95/46/EC is thus broadly in keeping with other international and European norms in this area. Data Protection Directive Article 8 (3) Paragraph 1 shall not apply: вЂў where processing of the data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of healthcare services, AND вЂў where those data are processed by a health professional subject under national law or rules established by national competent bodies to the obligations of professional secrecy or by another person also subject to an equivalent obligation of secrecy. European Convention on Human Rights and Biomedicine (1997/99) Article 10 вЂ�Private life and right to informationвЂ™: 1. Everyone has the right to respect for private life in relation to information about his or her health. 2. Everyone is entitled to know any information collected about his or her health. However, the wishes of individuals not to be so informed shall be observed. 3. In exceptional cases, restrictions may be placed by law on the exercise of the rights contained in paragraph 2 in the interests of the patient. European Convention on Human Rights and Biomedicine Article 26 Limitations on the right to privacy 1. No restrictions shall be placed on the exercise of the rights and protective provisions contained in this Convention other than such as are prescribed by law and are necessary in a democratic society in the interest of public safety, for the prevention of crime, for the protection of public health or for the protection of the rights and freedoms of others. Comparison of the limitations on right to privacy in ECHR and ECHRB вЂў вЂў вЂў вЂў вЂў вЂў in the interest of national security in the interest of public safety the economic well-being of the country the prevention of disorder or crime the protection of [public] health or morals the protection of the rights and freedoms of others (Italicised items not in ECHRB) Additional Protocol to European Convention on Human Rights and Biomedicine on Biomedical Research (2005/awaiting ratification) Article 25 вЂ“ Confidentiality Any information of a personal nature collected during biomedical research shall be considered as confidential and treated according to the rules relating to the protection of private life. Key difficulty for health sector Understanding the complex set of interlocking norms which protect patient information: вЂў ethics; вЂў data protection law; вЂў human rights law; and вЂў law of confidentiality. Difficulties in protecting patient rights? вЂў Ethics places greater importance upon gaining consent for research use of information than human rights law. вЂў Human rights law seeks a balance between privacy rights of the research subject, specified public interests and the rights and freedoms of others. вЂў Status of consent for information use remains a disputed issue between ethics and human rights law. вЂў Increasing convergence apparent international instruments, but unclear how this will ultimately impact on practice. Difficulties in promoting health research? Health research is perhaps itself an ethical and legal obligation: An indispensable condition for fulfilment of the right to health? An ethical obligation on researchers and healthcare professionals to discover new and improve existing treatments? Something all of us are ethically obliged to participate in? Conclusion To promote health research is to protect patient rights. Patient rights cannot be fully protected without health research.