WRITTEN QUESTION E-2403/01

by Erik Meijer (GUE/NGL) to the Commission

(21 August 2001)

Subject: Implications of large-scale genetic research in Iceland for the protection of privacy and patients' rights in the EU

1. What are the implications of the Icelandic scheme referred to in my previous series of questions, which makes participation in large-scale genetic research compulsory in respect of cooperation agreements between Iceland and the EU?

2. To what extent are Icelandic data used by companies established in EU Member States? By what companies?

3. Does the Commission anticipate pressure from businesses to adopt the Icelandic model in EU Member States?

4. Does the Commission expect Member States to agree to the wishes referred to in question 3? Does it take a negative or positive view of such a possibility?

5. How does the Commission envisage preventing particular medical centres from misusing such personal data by putting the latter the way of friendly commercial businesses such as insurers, which are able to exclude persons with an increased health risk and their descendants from the care to be paid for by the insurer or to charge them a higher premium?

6. What provisions currently exist in EU law for upholding privacy with regard to the risk referred to in question 5?

7. Is the Commission preparing measures to prevent misuse of the Icelandic system within the EU?

Joint answerto Written Questions E-2402/01 and E-2403/01given by Mr Bolkestein on behalf of the Commission

(25 October 2001)

Directive 95/46/EC on the protection of personal data was incorporated into the agreement on the European Economic Area (hereinafter EEA) by Decision No 83/1999 of the EEA Joint Committee. This means that the Member States of the EEA i.e. the 15 Member States of the European Union, plus Iceland, Liechtenstein and Norway are obliged to implement the provisions laid down by law, regulation or administrative action required to comply with this Directive. Accordingly, the Member States of the EEA may neither restrict nor prohibit the free movement of personal data between themselves for reasons relating to the protection of fundamental rights of individuals, in particular their privacy, when it comes to processing these data.

The task of ensuring compliance with the obligations arising from the EEA Agreement by the member states of the European Free Trade Association (hereinafter EFTA) which are party to this agreement (Iceland, Liechtenstein and Norway) is the responsibility of the EFTA Surveillance Authority. In this respect, the Commission intends to ask the EFTA Surveillance Authority for further information on the transposition of Directive 95/46/EC in Iceland, in accordance with the procedures set out under the EEA Agreement.

In accordance with the rules of the EEA Agreement, the adoption of Icelandic legislation in this field is notified to the EFTA Surveillance Authority and not to the Commission. The Commission is, however, aware of the existence of both the December 1998 law on databases in the health sector and of the licence granted to the Decoded company.

According to the information at the Commission's disposal, the data processed by the Decode company should be regarded as personal data under the terms of Directive 95/46/EC. A number of the data processed should also be regarded as data on health which are specifically protected under the same Directive. The processing of such data is prohibited in principle but may be authorised on the basis of the data subject's explicit consent. According to the information available to the Commission, the data are not processed by the Decode company on such a basis. At any rate, the Commission would point out that the very notion of consent is problematic with regard to genetic data, as the nature of genetic data is to provide information not just on the data subject, but on persons belonging to his/her genetic line.

Directive 95/46/EC also authorises the processing of data on health under other circumstances, the most relevant of which being when based on the national law of a Member State, for reasons of substantial public interest, subject to the provision of suitable safeguards. This Directive also allows the data collected to be re-used for other specific purposes for statistical or scientific use only if Member States provide appropriate safeguards. The Commission does not, however, have sufficient information to assess the quality of the safeguards applied to the processing of the data in question.

The Commission would also stress that all the obligations and rights arising from Directive 95/46/EC apply to such data processing, in particular the obligations to process personal data fairly and lawfully, to limit the data processed to those which are adequate, relevant and not excessive, to inform the data subject, to grant the data subject the right to access, object to and rectify the data concerning him/her, to ensure the security of the data, not to take individual decisions affecting a data subject based solely on the automated processing of data, in addition to the provisions on cross-borders flows of data.

The Commission would draw attention in this respect to the statement made by the European Data Protection Commissioners at their meeting in Santiago de Compostela on 18-20 September 1998, in which they had voiced their grave concern about what was, at the time, only a draft and had asked the Icelandic Government to reconsider their plans with respect to the protection of personal data.

The Commission would also like to mention the rule of medical secrecy which exists in Europe and places strict limits on the communication of medical data for reasons unrelated to a therapeutic relationship.

In addition, the Commission would stress that Article 3 of the Charter of Fundamental Rights of the European Union guarantees everyone the right to his/her physical and mental integrity, that Articles 7 and 8 recognise everyone's right to respect for his/her private and family life and the right to the protection of personal data concerning him/her, and that Article 21 prohibits any discrimination based on genetic features.

Finally, the Commission does not have any specific information regarding the possible use of the Icelandic data by companies established in the Member States. Nor can it comment on either the risk or the probability of a Member State agreeing to the wish of a private company to have data identical to those possessed by Decode. In any case, if a Member State were to adopt similar regulations to the Icelandic law of 1998, the Commission would assess how they conformed with Community rules, particularly those relating to the protection of personal data. In this context, the Commission would consult the independent working party on data protection set up by Article 29 of Directive 95/46/EC, this working party being composed of European data protection commissioners.