The private Irish genome research company GMI, which has ambitious (and alarming) plans to gather DNA from 400,000 Irish people, is back in the news.
GMI, a private, commercial genomic data company, was established in 2015. It has Irish State and Google investment, and was bought last year by Chinese genomics specialists WuXi NextCODE. This company was formed by Chinese group Wu Xi PharmaTech's acquisition of Icelandic population genomics pioneer deCODE Genetics.
Interestingly, Wu Xi PharmaTech is the target of a new class-action lawsuit in New York for share-selling irregularities.
Media coverage generally has focused on GMI's intention to hire 600 people, not the massive-scale DNA data acquisition plan its chief executive says will make Ireland a global hub for genomics.
A Sunday Business Post story two weeks ago, headlined "Genetic data company seeks clarity over new GDPR rules", stated that GMI had written to Department of Health officials to state it "urgently needs clarity" on "new" details that might affect its acquisition of data, and storage of DNA databases or so-called biobanks.
GMI fretted that “uncertainty” was affecting its ability to make “everyday business decisions”. The correspondence was interesting and revealing, though there is confusion regarding its context.
There are no “new GDPR rules” coming that relate to genetic data.
Asked about this correspondence, a GMI spokesperson told me: “In October 2018, GMI sought guidance from the Department of Health on how the new Health Research Regulations 2018 [HHR] would work in practice in relation to the processing of personal data for health research purposes in Ireland.”
Confused regulations
GMI also wanted to know "how the regulations would work in the context of research that had been approved by Research Ethics Committees in Ireland prior to the enactment of the regulations and whether or not there would be an extension to the deadline of April 31st, 2019, for submissions to the new Health Research Consent Declaration Committee."
The original Sunday Business Post story seems to have confused regulations, GDPR with HHR.
The HHR must comply with GDPR, not least because sensitive medical and DNA data is protected by stringent GDPR gathering, handling and storage provisions.
However, as a public note this week from the Department of Health indicated, more specific guidance is needed in HHR, with any changes serious enough to require consultation with the Office of the Data Protection Commissioner, the Department of Justice and the Attorney General.
The department’s note is an update in an ongoing, delayed process to clarify issues around consent.
On the department’s side, it beggars belief that these key issues were not worked out during the two-year transition period between GDPR’s publication and its enactment a year ago. Current uncertainty places researchers, health workers and citizens in an extended limbo.
Baffling
Some of GMI’s correspondence is baffling too, and the answers are already clear within GDPR.
GMI specifically wished to know if it could use databases/biobanks located outside the State, and potentially outside the EEA and asked for guidance as to whether such extra-Ireland databases/biobanks were subject to the regulations. It also wishes to know if it could obtain some exceptions to acquiring informed consent for DNA.
GMI warns the department that the “absence of clarity” might lead “potentially to research projects being located in other jurisdictions” – though this seems questionable given that GMI’s goal is acquiring and controlling the research goldmine of a massive databank of homogenous Irish DNA.
Clarification
It’s strange that an already operational EU-based DNA company is asking a government department for clarification on some basic GDPR data consent, transfer and governance issues.
Controversy regarding consent has already arisen over the transfer by Our Lady's hospital in Crumlin of the DNA records of 1,500 Irish children to GMI in 2016 .
"The requirements to have informed consent either for biomedical research or for processing personal data are far from new," says Dr Katherine O'Keefe, head of training and research, and ethicist with data consultancy Castlebridge, who has co-authored a book on data ethics. "All but one of the core data-protection principles have been in Irish law since 1988."
She adds: “Asking for an exemption from the requirements for consent for data that GMI already has, now raises the question why GMI doesn’t have the proper documentation of consent from when they obtained the data.”
Data controllers cannot transfer data obtained in the EU, outside the EU without giving it the same protections under GDPR. If the biobank were in China, this would also raise concerns as the state is widely considered a leading surveillance nation .
GMI may have laudable intent – new treatments for conditions and diseases via its DNA research. But this is not open, public research. GMI is a private business, seeking to monetise personal DNA data.
Currently, private companies funding or doing such research exist in a grey area of vague international regulation. This troublesmedical and data ethicists.
Let’s be clear: a private venture is very different from a state-run, government led, not-for-profit DNA research initiative.
Spectacularly lucrative
The Irish public’s DNA is GMI’s prime source of income for potentially spectacularly lucrative DNA research. In the same way, personal data fuels social media and internet companies, earning them billions.
Private DNA research, especially on (unpaid) national populations, remains highly controversial. Many Icelanders protested at their DNA being used by GMI antecedent DeCode.
While GMI wants “clarity” and answers from the government here, the Irish people deserve clarity and answers from GMI – and the Government. Given the scale of this DNA project, we are overdue an in-depth public and political discussion on this project to biobank a tenth of the Irish population’s DNA for private profit.
* This article was amended on Thursday, April 11th, 2019 and on Friday, April 12th, 2019
