Law in Quebec

After consulting stakeholders, commissioning research papers, and holding roundtables in the area of genomics and privacy, the Office of the Privacy Commissioner of Canada issued an eight-page policy statement asking the health and life insurance industry to extend their decade-long voluntary ban against asking applicants or existing policy holders to undergo genetic testing. More controversially, the OPC is also asking the industry to extend the moratorium to applicants who have already taken genetic tests. But the OPC’s policy statement is not definitive. Recognizing that the state of medical technology is changing rapidly, it admits that its position should be reviewed periodically.

“The thing that really jumped at me is that the OPC’s finding is preliminary, qualified, and based on its own research,” noted Daniel Michaluk, chair of information management and privacy practice group at Hicks Morley Hamilton Stewart Storie LLP in Toronto. “If the industry thinks it has a different justification, based on evidence or facts, that may in fact justify the use of genetic testing, that may change the (OPC’s) conclusion.”

With genetic testing becoming quicker, more affordable, and more readily available, growing number of Canadians are turning to genetic testing for reproductive planning, to explore their ancestry, or to find out whether they have a genetic predisposition to diseases. Others still undergo genetic testing to participate in long-term research projects such as Canada’s ambitious Personal Genome Project, which is recruiting volunteers willing to share their genome sequence with scientists to study.

Canada is the only G-8 country without a policy or legislation on the use and collection of genetic information for non-research or health purposes. The legislative absence has spurred privacy concerns and fears that individuals will be discriminated against because of genetic markers and be denied coverage or be charged prohibitively expensive rates.

“This is a strongly-worded recommendation,” said Carman Baggaley, senior international strategic policy analyst at the OPC. “We certainly hope that the industry will take it seriously. We’ve had what we thought was a positive dialogue with representatives of the industry.”

But the life and health insurance sector intends to stand its ground. While it will not “under any circumstances” ask applicants or existing policy holders to undergo genetic testing, the industry does expect clients who have already taken genetic tests to share those results with life and health insurers, said Frank Zinatelli, vice-president and general counsel to the Canadian Life and Health Insurance Association Inc., a non-profit industry group.

“I don’t think it is a proper call,” remarked Zinatelli. “The privacy commissioner says that you shouldn’t use these tests until they are necessary and effective. We think that many tests are already effective and necessary.”

The notion of “good faith” and “material information” lies at the heart of the conflicting positions. The industry maintains that insurance contracts are based on good faith, and that both parties have an obligation to disclose any information that may be relevant to the contract – a principle that is entrenched in insurance legislation in each province. Genetic test results are deemed by the industry to be material information because it allows insurers to be able to properly assess risks associated with clients and to charge “correct levels” of premiums, said Zinatelli. “The insurance industry has been dealing with sensitive information from the very beginning,” added Zinatelli. “We have in place safeguards and protections so that information is maintained consistent with all privacy rules now in place.”

The privacy watchdog is far from convinced. The policy statement asserts that the industry association does not define what constitutes material information. Nor does the industry differentiate between different types of genetic tests or the purposes for which the testing was done, according to the statement. “Where we disagree is around the issue of what’s material,” said Baggaley. “It would certainly appear that all of these tests are not material, and that from a consumer’s perspective it would be desirable if there was clarity around the concept of what is material.”

The OPC has yet more concerns, principally centering around the notion of reasonableness. After examining the issue through the use of a four-pronged test, the OPC concluded that the collection and use of existing genetic test results does not appear to be necessary at present, that the validity and accuracy of individual genetic tests cannot always be guaranteed, that its collection and use is not proportionate to the benefits the industry would gain from using test results, and that there are other less privacy invasive alternatives available to the industry. (See sidebar).

“The four-point test is a bit of a sticky point for organizations, and the OPC has applied it differently at different times,” said Michaluk. “It’s not about consent at all. It’s about reasonableness and proportionality. The fourth part of the test, involving less privacy invasive alternatives, is the one that organizations view as the most aggressive because it tends to rule out better means that are more intrusive – and it has been applied in a very strict manner.”

Other privacy experts, while sympathetic to the industry’s position, warn life and health insurers that to ignore the OPC’s policy statement is to do so at their peril. The Privacy Commissioner has very broad investigative powers and the ability to take organizations to court, said David Fraser, a privacy lawyer with McInnes Cooper in Halifax. While the Privacy Commissioner can only make recommendations, and not orders, under the Personal Information Protection and Electronic Documents Act (PIPEDA) the Commissioner may apply to the Federal Court for a hearing. The Federal Court in turn can order an organization to change its practices and award damages to a complainant.

“There is also a potential public relations fallout if it ends up in the media that the Privacy Commissioner specifically told you not to do this, and you went out and did it anyway,” said Fraser. “So they should be cautious and prudent and think twice before they went out against the statement.”

That the OPC forged ahead with a policy statement without launching an investigation into the matter is unusual and revealing, said Kris Klein, a privacy lawyer with NNovation LLP in Ottawa. The OPC has long complained that they do not have enough powers to compel organizations to comply, pointed out Klein. “When you read their statute, they do have the power to conduct research but it is the way that they are sort of using it as an enforcement tool that I think is quite interesting,” said Klein, who has advised the Privacy Commissioner. “It is an indication that they are frustrated with their own powers, and they are really pushing the envelope when it comes to trying to find other ways to get compliance.”

Privacy experts are concerned about the reach of genetic testing and its privacy implications, but they are also mindful that life and health insurance companies need to make fully informed decisions based on risk, which is why all have praised the OPC for demonstrating “sensible flexibility.”

“They want to reserve for themselves freedom of action in the event that they are presented with a case,” said Fraser. “The amount of information you can get from genetic material is going to change over time, and so too is its reliability. Under PIPEDA, you can only collect information that is reasonable and necessary, and because PIPEDA is principle-based, what is reasonable and necessary can change over time. Their conclusion shows some sensible flexibility.”

———————————————————

Sidebar:

The OPC used a four-point test to analyze the issue of whether genetic test results should be used by health and life insurance industry:

• Is the collection and use of this personal information necessary to achieve a business legitimate business purpose?

• Is the personal information likely to be effective in achieving that purpose?

• Is the collection and use proportionate to the benefits gained?

• Are there less privacy-invasive alternatives?