WRITTEN QUESTION E-2402/01

by Erik Meijer (GUE/NGL) to the Commission

(21 August 2001)

Subject: Implications for citizens' rights and commercial interests of compulsory participation in large-scale genetic research in Iceland

1. Is the Commission aware that Iceland has adopted legislation making the country an international test area for large-scale genetic research, which involves the compulsory participation of its inhabitants as test subjects? Is it aware that this means that personal medical information held by GPs and hospitals and DNA data for the whole population are able to be stored centrally in a database and linked to family trees recorded over many centuries, and that this material is able to be made available to the company Decode, which uses it for purposes of research for the international pharmaceutical industry, whilst citizens of Iceland are not allowed, as a result of court judgments, to have data on themselves or their ancestors removed from this central database?

2. Is Iceland also making itself, through this legislation, an international test area for the ethical and legal aspects of protection of privacy in respect of genetic data, with considerably less protection being provided than is currently usual at an international level? Is the Commission aware of any other countries taking similar measures, apart from Singapore which is comparable in some respects? Is this course of action at odds with EU rules on privacy?

3. Does the Commission agree that, under the Icelandic model, commercial interests are strongly favoured over individual interests when balancing the three interests concerned, namely the general interest in medical research, the individual interests of human beings who may be disadvantaged by this and the commercial interests of the pharmaceutical companies concerned? And if not, why not?

Source: Norwegian documentary Decoding the Icelanders, broadcast by IKON-TV Netherlands, 1 August 2001

Joint answerto Written Questions E-2402/01 and E-2403/01given by Mr Bolkestein on behalf of the Commission

(25 October 2001)

Directive 95/46/EC on the protection of personal data was incorporated into the agreement on the European Economic Area (hereinafter EEA) by Decision No 83/1999 of the EEA Joint Committee. This means that the Member States of the EEA i.e. the 15 Member States of the European Union, plus Iceland, Liechtenstein and Norway are obliged to implement the provisions laid down by law, regulation or administrative action required to comply with this Directive. Accordingly, the Member States of the EEA may neither restrict nor prohibit the free movement of personal data between themselves for reasons relating to the protection of fundamental rights of individuals, in particular their privacy, when it comes to processing these data.

The task of ensuring compliance with the obligations arising from the EEA Agreement by the member states of the European Free Trade Association (hereinafter EFTA) which are party to this agreement (Iceland, Liechtenstein and Norway) is the responsibility of the EFTA Surveillance Authority. In this respect, the Commission intends to ask the EFTA Surveillance Authority for further information on the transposition of Directive 95/46/EC in Iceland, in accordance with the procedures set out under the EEA Agreement.

In accordance with the rules of the EEA Agreement, the adoption of Icelandic legislation in this field is notified to the EFTA Surveillance Authority and not to the Commission. The Commission is, however, aware of the existence of both the December 1998 law on databases in the health sector and of the licence granted to the Decoded company.

According to the information at the Commission's disposal, the data processed by the Decode company should be regarded as personal data under the terms of Directive 95/46/EC. A number of the data processed should also be regarded as data on health which are specifically protected under the same Directive. The processing of such data is prohibited in principle but may be authorised on the basis of the data subject's explicit consent. According to the information available to the Commission, the data are not processed by the Decode company on such a basis. At any rate, the Commission would point out that the very notion of consent is problematic with regard to genetic data, as the nature of genetic data is to provide information not just on the data subject, but on persons belonging to his/her genetic line.

Directive 95/46/EC also authorises the processing of data on health under other circumstances, the most relevant of which being when based on the national law of a Member State, for reasons of substantial public interest, subject to the provision of suitable safeguards. This Directive also allows the data collected to be re-used for other specific purposes for statistical or scientific use only if Member States provide appropriate safeguards. The Commission does not, however, have sufficient information to assess the quality of the safeguards applied to the processing of the data in question.

The Commission would also stress that all the obligations and rights arising from Directive 95/46/EC apply to such data processing, in particular the obligations to process personal data fairly and lawfully, to limit the data processed to those which are adequate, relevant and not excessive, to inform the data subject, to grant the data subject the right to access, object to and rectify the data concerning him/her, to ensure the security of the data, not to take individual decisions affecting a data subject based solely on the automated processing of data, in addition to the provisions on cross-borders flows of data.

The Commission would draw attention in this respect to the statement made by the European Data Protection Commissioners at their meeting in Santiago de Compostela on 18-20 September 1998, in which they had voiced their grave concern about what was, at the time, only a draft and had asked the Icelandic Government to reconsider their plans with respect to the protection of personal data.

The Commission would also like to mention the rule of medical secrecy which exists in Europe and places strict limits on the communication of medical data for reasons unrelated to a therapeutic relationship.

In addition, the Commission would stress that Article 3 of the Charter of Fundamental Rights of the European Union guarantees everyone the right to his/her physical and mental integrity, that Articles 7 and 8 recognise everyone's right to respect for his/her private and family life and the right to the protection of personal data concerning him/her, and that Article 21 prohibits any discrimination based on genetic features.

Finally, the Commission does not have any specific information regarding the possible use of the Icelandic data by companies established in the Member States. Nor can it comment on either the risk or the probability of a Member State agreeing to the wish of a private company to have data identical to those possessed by Decode. In any case, if a Member State were to adopt similar regulations to the Icelandic law of 1998, the Commission would assess how they conformed with Community rules, particularly those relating to the protection of personal data. In this context, the Commission would consult the independent working party on data protection set up by Article 29 of Directive 95/46/EC, this working party being composed of European data protection commissioners.