Generation Genome: the future is here – IP, regulatory and data protection challenges
This article was first published in Digital Health Legal, August 2017 edition.
On 4 July 2017 Professor Dame Sally Davies (England’s Chief Medical Officer) published her 8th annual report which this year was titled “Generation Genome” focussing on genomic medicine and calling on clinical staff, managers, those in the biotech sector and the Government to work together to make wider use of revolutionary genetics techniques in the battle to improve cancer survival rates and identify rare diseases faster so patients can get the right care at the earliest opportunity. As she explains in her introductory chapter "Genomic medicine has the potential to save costs and improve quality of care by targeting treatment, maximising benefit and reducing side effects…The new science of genomics is opening up better diagnoses for patients, better and safer treatments, opportunities for screening and the possibilities for prevention. These will all improve as we learn more about genomes and their relation with illness and treatment response".
The report has been welcomed by many, including Jeremy Hunt (Health Secretary), who said that it was crucial to “push the boundaries of modern science" for the benefit of NHS patients. However before genomic medicine can perhaps achieve the heights projected and indeed urged upon us by this report the developing technology needs to address a number of legal, ethical and regulatory challenges.
In this article we consider some of the intellectual property issues that remain unresolved as well as privacy and wider regulatory issues.
Intellectual property challenges
The advances and growth in genomic technology raise specific intellectual property (IP) related challenges. Although there is no global harmonisation of intellectual property (IP) rights, some harmonisation has been achieved by international treaties, agreements and conventions with The Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) being the most important treaty in establishing minimum levels of protection for IP.
With regards to patents, for example, TRIPS provides that patent protection must be guaranteed for products and processes in all fields of technology but also allows WTO members to exclude from patentability inventions where the prevention of their commercial exploitation is necessary to protect public order or morality, including to protect human life or health. In the EU, this has been implemented in the context of biotechnology inventions through the Biotech Directive 98/44/EC.
There are a number of exclusions to patentability included in the Biotech Directive relevant to the genomics industry including:
- the simple discovery of the sequence or partial sequence of a gene, although its isolation by means of a technical process may constitute a patentable invention even if the structure of that element is identical to that of a natural element;
- processes for cloning human beings;
- processes for modifying the germ line genetic identity of human beings;
- uses of human embryos for industrial or commercial purposes; and
- processes for modifying the genetic identity of animals which are likely to cause them suffering without any substantial medical benefit to man or animal, and animals resulting from such processes.
Despite the above exclusions, until recently, protection of inventions through the patent system was seen as the key route by which organisations would seek exclusivity for their genomic related technology. However, many genomes have been sequenced and are in the public domain, and many techniques for isolating and manipulating DNA are now considered to be routine such that it is becoming increasingly difficult to rely on the patent system for protection. This is particularly in light of recent decisions from the US Supreme Court which have had a knock-on effect on what is sought by way of patent protection in Europe.
Some companies are increasingly relying on trade secrets for protection instead of patent protection but there may be other IP rights which business might well rely on more heavily in the future such as copyright, design right and database rights. We are, however, entering into unchartered territory because there is no court guidance yet as to how the English courts would determine the extent of copyright, design right and database right protection for DNA molecules (whether found in nature or synthetic) or, indeed, the short-hand code for such molecules written down as a string of letters to represent a sequence of nucleotides (e.g. ATGC…etc.).
If one considers copyright and unregistered design right under English law, in relation to DNA sequences found in nature, protection is likely to be limited to copyright in the DNA code and design right is unlikely to subsist in the DNA molecules themselves. In contrast, copyright is likely to subsist in synthetic DNA codes and, moreover, design right is likely to subsist in the synthetic DNA molecules. The many DNA databases available to make it easier for researches and businesses to find relevant information and manipulate DNA using a range of tools may also be protected by database rights. Until organisations start to assert their rights and we have a few test cases, we will not know for certain the extent of IP protection for genomic-based technology.
Data protection challenges
European data privacy law is being updated by the General Data Protection Regulation (2016/679) ("GDPR"). This new law will be fully in force from 25 May 2018. It can be seen as either a significant re-write and updating of data protection in the EU (which previously dated from the mid-1990s), or the "hard-baking" of best practice into the law, depending on one's point of view. The impact of this is that, in many cases, if an organisation had already complied with pre-existing data protection law, and the best practice expected by EU data protection regulators, the change to the GDPR is not so significant. If not, then the change to the GDPR will be a shock to the system.
This point also applies to organisations handling genetic data. For example, under the GDPR genetic data will be included in the definition of personal data: but this could have been expected by looking at EU data protection regulators' guidance. Additionally, the GDPR recognises, for the first time, pseudonymous data (for example key –coded data, where the substantive data is held in association with a key, and separately the key is held in association with the name, patient number or other identifiers). The GDPR classifies pseudonymous data as personal data, but acknowledges that with the disassociation of the identifiers, the risks to the individual patients are reduced. This reflects good practice prior to the GDPR.
Many issues in data privacy compliance will reflect good medical practice including the need for clear and understandable patient consent forms. What the GDPR adds in this area is the need for any consent to be explicit, the ability to revoke consent and granularity of consent (so not "bundling" different issues into one all-encompassing consent). The patient consent forms will also need to include increased transparency on key information such as on individual rights, any transfers outside the EU and data retention periods, to pick some of the more problematic areas.
Data protection has long had limitations on the transfer of personal data outside the EU. The GDPR continues those limitations, with small changes. International research collaborations will need to comply with extra compliance steps to overcome these limitations.
Lastly in this section on data privacy, an area where we expect to see growing activity is individual rights. One of the aims of the GDPR was to enhance the rights of individuals, both by expanding those rights and improving enforceability of those rights. We have already seen a right of access to personal data, this is now joined by a right to portability of data (i.e. to have a reusable copy of the data), and a right to erasure (commonly called the "right to be forgotten"). These are not blanket rights and do not apply in all cases, however, where a patient wishes to access his/her genetic data, this is vastly different to an employee wishing to access his/her employment record. The dataset will be huge, and unintelligible to all but a person skilled in bioinformatics.
Having said that, we do not have the final picture on how these rights will be applied to research data. The GDPR was implemented as a Regulation, and therefore there is no need for local implementing legislation for the law to take effect in Member States (unlike the previous Data Protection Directive 95/46/EC). However, there are many provisions of the GDPR where Member States are allowed flexibility to provide their own perspective on the law. One of those areas is research. As a result, we are waiting for Member States to implement local laws which will set out any exemptions from individuals' rights to access, portability and erasure that will be extended to the use of genetic data within research. Additionally, those local laws will flesh out an alternative to explicit consent as the justification for using genetic data in research.
Regulatory and ethical challenges
In addition to the specific issues around data privacy and the concerns about the sharing or seeking of such sensitive personal data there are broader regulatory and ethical challenges. Just two examples of these include the ability to undertake far more accurate and lower risk non-invasive prenatal testing ("NIPT") and the issues around confidentiality as highlighted in ABC v St Georges[1].
In relation to NIPT, the recent Nuffield Council of Bioethics highlighted that increasing the availability of such testing (to the NHS) for rare genetic conditions is likely to lead to an increase in the number of diagnoses of rare genetic conditions, and possibly an increase in terminations. As with the development of pre-implantation genetic diagnosis techniques and the existing law on abortion[2] consideration must be given to the message this may give out to people with existing genetic conditions and their families. The term ‘significant medical condition or impairment’ is used to provide grounds for lawful termination under the ‘fetal anomaly' ground and a 'serious physical or mental disability, a serious illness or any other serious medical condition’ is part of the test before testing is allowed on embryos to be selected for implantation or to be discarded.
If NIPT and potentially whole genome sequencing becomes more readily available, detailed genetic data about a fetus may be offered to prospective parents. Society may demand a new layer of regulation to govern the ethical difficulties raised by such detailed information which might relate not only to health but other characteristics and attributes. For example the extent to which non-medically useful data can be obtained, how to respect the autonomy and protect the interests of the future child or adult and how to guard against the termination of pregnancies on the basis merely that the child does not fit with its parents definition of normal, rather than on the basis of properly defined fetal abnormality. In response to this particular concern the CMO recommended that the Medicines and Healthcare Products Regulatory Agency ("MHRA") should work closely with Genomics England and NHSE to ensure that the EU ‘In Vitro Diagnostic Devices Regulation’ is applied appropriately to future genomic medicine services.
In relation to confidentiality a new concept of familial confidentiality is being discussed as a result of the recent Court of Appeal decision in ABC. The medical team caring for a father confirmed through genetic testing that he had Huntingdon's disease. The father did not want his daughters to know about his diagnosis, notwithstanding that one of them had recently announced her pregnancy. Sometime after giving birth the daughter was accidentally informed of the diagnosis and later tests confirmed that she too was affected. Her claim is based on the argument that the professionals treating her father (with whom she had taken part in family therapy) owed her a duty of care to properly consider whether they should inform her of his diagnosis, so that she might have terminated the pregnancy rather than run the risk that her child might in due course be dependent on a seriously ill single parent or become an orphan, and the risk that her child might have the disease herself.
The Royal College of Physicians, the Royal College of Pathologists and the British Society of Human Genetics have produced guidance[3] which suggests "Where consent to release information has been refused The Human Genetics Commission, the Nuffield Council on Bioethics and the GMC have all expressed the view that the rule of confidentiality is not absolute. In special circumstances it may be justified to break confidence where the aversion of harm by the disclosure substantially outweighs the patient’s claim to confidentiality". In allowing the claim to continue the Court distinguished genetic information from other health conditions (such as sexually transmitted or other highly contagious diseases) saying "only in the field of genetics that the clinician acquires definite, reliable and critical medical information about a third party, often meaning that the third party should become a patient." The Court indicated that a duty of care might exist and those with genetic information of relevance to family members should properly balance the potentially conflicting interests if there is no consent to disclose.
In Generation Genome the authors suggest that a new social contract that allows such information to be available for use by clinicians in the appropriate care of family members (for example, testing for the particular familial mutation to determine if extra surveillance is warranted) would be publicly acceptable. This is another area where professional ethic guidance and patient understanding will be required.
Comment
This is an incredibly exciting period for genomics and it is incumbent upon governments to provide the right framework to reward and not stifle innovation whilst protecting human dignity, privacy and fundamental rights and ethics.
[1] ABC v St George's Healthcare NHS Trust & Ors [2017] EWCA Civ 336 (16 May 2017)
[2] section 1(1)(d) of the Abortion Act 1967 and paragraph 1(ZA) of Schedule 2 to the Human Fertilisation and Embryology Act 1990
[3] “Consent and Confidentiality in Genetic Practice, Guidance on Genetic Testing and Sharing Genetic Information”.