[ Pobierz całość w formacie PDF ]
the Health and Social Care Act 2001, under which a Patient Information Advisory Group
(PIAG) was established to deal with cases where informed consent is not feasible. The
legislation has led to confusion, mainly about the type of anonymisation required to
ensure that information is not patient identifiable . A recent consultation document on
revising section 60 of the 2001 Act makes it clear that obtaining informed consent for
any further use of information remains the default position: The Government has
made it clear that informed consent is the fundamental principle governing the use of
patient identifiable information by any part of the NHS or research community
( Consultation 2.1). Section 60, as it currently stands, gives the Secretary of State
powers to authorise the use of patient identifiable information without informed
consent for a limited range of purposes suchas: worktoanonymiserecords ; workto
identify and contact patients to gain their consent ; analysis of geographical data ;
communicable disease surveillance ; clinical audit and monitoring of healthcare
provision ; and others ( Consultation 3.3). The first two are in-house uses of data;
the others are uses that do not require linkable data. But much research needs linkable
data, and is impossible if anonymisation destroys links. On the account we offer here,
there need be nothing ethically impermissible about uses of information that is in
principle linkable to individuals, provided that it is effectively (although reversibly)
anonymised. PIAG s guidance can be found at http://www.advisorybodies.doh.gov.
uk/piag/HealthRecords.pdf; the consultation document is available at http://
www.dh.gov.uk/assetRoot/04/07/14/32/04071432.pdf.
116 Rethinking Informed Consent in Bioethics
information about a data subject is initially obtained, if only because
future research cannot be foreseen at that point. Yet recontacting
data subjects at a later date may be impossible, impractical or
prohibitively expensive. Recontacting is also likely to lead to many
problems: data subjects may find it hard to understand why they are
being recontacted, or what is being done with their information; if
some sorts of people are more likely to refuse to give consent than
others, the data made available for research by recontacting may not
be representative.
DPA 98 identifies a broad class of actions as impermissible simply
because they process personal data. It might seem that the obvious
solution is to insist upon anonymisation of personal data, so as to
ensure that it does not fall under DPA 98. However, weaker forms of
anonymisation do not satisfy the requirements of the Act, and
stronger forms do not meet the needs of research. One weaker
form of anonymisation, that has traditionally and routinely been
used in medical and research practice, is potentially reversible ano-
nymisation, where work is done on data that have no identifying
labels (such as patient names, NHS numbers) although others (e.g.,
the hospital or those who have gathered the data, or the custodians of
a database) retain information that could be used to link those data to
the data subject, for example, by looking up a name or an NHS
number. In this case the anonymisation is reversible: the data are not
actually de-linked, they are merely reversibly anonymised or pseu-
donymised . It remains possible, in principle, to de-anonymise such
data and to link them to individual data subjects. Traditionally this
sort of anonymisation was held to provide adequate informational
privacy for patients. However DPA 98 applies to all use of data in
which the data subjects remain identifiable even by indirect
means.16 Under DPA 98 research may be done without consent
only if personal data are subjected to a second, stronger form of
16
For definitions of identifiable data and of reasonably identifiable data see
Department of Health, Confidentiality: NHS Code of Practice, 2003, p. 9, http://
www.dh.gov.uk/assetRoot/04/06/92/54/04069254.pdf; the Code has been
endorsed by the Data Protection Commissioner.
Informational privacy and data protection 117
anonymisation, which removes links that could be used to identify
data subjects. In that case the data are de-linked or irreversibly
anonymised, nobody can reverse the anonymisation and the data
subject will be unidentifiable not only by the researcher but by
others. Irreversible anonymisation is a highly problematic require-
ment on the use of personal data in research. Many kinds of
research, including much epidemiology and all secondary data anal-
ysis, require linked data (these data can, of course, be anonymised in
the weaker sense). For example, researchers may need to find out
whether there is a correlation between those who were treated with
radiotherapy and those who later developed skin cancer. DPA 98
counts all data that are linkable to any identifying information as
personal data:17
. . . data which relate to a living individual who can be identified (a) from those
[ Pobierz całość w formacie PDF ]