Guthrie Cards in Scotland: Ethical, Legal and Social Issues

CHAPTER 4 - THE LEGAL BASIS OF THE COLLECTION

Key questions addressed by this chapter are:

• Is it lawful to continue to hold the collection when consent has not been obtained from the majority of people whose cards are kept?
• Which laws apply to the collection, who is responsible, and what are their obligations?

Key messages from this chapter are:

• Different legal regimes govern the Guthrie collections in England and in Scotland. In England, the collection would appear to be treated as 'tissue', and therefore subject to the Human Tissue Act 2004. This Act does not apply to Scotland, with the notable exception of section 45 (criminal offence of non-consensual DNA analysis). In Scotland, the collection appears to be treated as part of the health/medical record and is, therefore, subject to the provisions of the Data Protection Act 1998, which must also be read with the common law of confidentiality.
• The lawfulness of continued retention and use of the collection depends on compliance with the Data Protection Act 1998, the relevant provision of the Human Tissue Act 2004 (section 45), and the common law of confidentiality. Professional guidance and prior commitments made to the Scottish public might also constrain future retention and use.
• For the avoidance of doubt and to protect the full range of individual interests at stake, the Guthrie collection should be treated as both personal information and human tissue for the purposes of robust governance.
• Consent to use is not an absolute requirement of the law but should not be departed from lightly.
• Anonymisation can remove some legal obligations but not all obligations; moreover, it is not a complete answer to the challenges thrown up by the collection.
• Human rights are a consideration across all areas of law. All mechanisms, policies and procedures should be tested for human rights compliance.

DISCUSSION

4.1 The legal authority for the existence and continued retention of the Guthrie collection in Scotland is complicated. As an initial and broad consideration, all laws and practices must be viewed through the lens of human rights and all practices with respect to the collection must respect individuals' human rights. When considering which specific laws might apply to the collection, there are practical and jurisdictional variations within the United Kingdom which complicate the situation and the overarching influence of European law must also be considered. Practically, the cards contain both physical blood/DNA samples and personal information. We must therefore ask: is the blood spot collection itself a "thing" or information or both or something different altogether? This is not a trivial consideration. It matters very much how these collections are viewed because different legal regimes apply to information as opposed to tissues (and sometimes no specific laws apply at all).⁵¹

4.2 Further complications arise when we compare the position in England and Scotland. Whereas in England blood samples would appear to be regarded as human tissue, and therefore covered by the Human Tissue Act 2004,⁵² in Scotland they appear to be treated primarily as medical records; that said, a single but important provision from the 2004 Act also applies in Scotland and must also be considered (see 4.26-4.32 below).

4.3 For the purposes of discussion, then, we must consider whether the collection should be regarded as (a) information, (b) tissue, or (c) both. The pros and cons of each approach are considered below. All of this is subject to human rights considerations.

The collection as information

4.4 If the collection is seen as personal information, then the applicable laws are found, in the first instance, in the Data Protection Act 1998 which has application throughout the United Kingdom. The Act is the implementation by the UK government of the terms of the Data Protection Directive that is applicable across all 27 member states.⁵³ To the extent that the collection as a whole contains information relating to living persons, for example, names, addresses, medical and health data etc, and from which persons can be identifiable, then the provisions of the Data Protection Act 1998 apply to the storage and processing of these data. It is unclear, however, whether a sample such as that containing DNA is in itself also personal information for the purposes of these laws. On the one hand the Article 29 Working Party has observed that:

Human tissue samples (like a blood sample) are themselves sources out of which biometric data are extracted, but they are not biometric data themselves (as for instance a pattern for fingerprints is biometric data, but the finger itself is not). Therefore the extraction of information from the samples is collection of personal data, to which the rules of the [EU Data Protection] Directive apply. The collection, storage and use of tissue samples themselves may be subject to separate sets of rules.⁵⁴

4.5 More recently, however, in a ruling against the United Kingdom in the context of the National forensic DNA Database and indefinite retention of DNA samples of persons not convicted of a crime, the European Court of Human Rights ruled that the retention of DNA profiles and cellular samples constitute 'personal data' under the law.⁵⁵

4.6 There is, therefore, powerful legal support for the view that, as a minimum, the entire collection should be treated as 'data'. This means that we should be concerned with personal information held together with the blood samples and information derived from those samples as well as the samples themselves. The consequence of this is that the entire collection and its uses are subject to data protection law, and we discuss the implications of this in the paragraphs that follow. If this position is not adopted, and rather a distinction is drawn between the physical samples themselves and information derived from the samples or kept with the samples, then the legal position in Scotland is complex because, as we discuss in the next section - The collection as tissue - there is very little direct legal authority for this position and this creates uncertainty about the obligations of those responsible for the resource and the rights of people whose tissue are kept as part of the resource.

4.7 There is support in Scotland for the view that the collection should be treated as information. The Guide to the required standards of practice in the management of records for those who work within or under contract to NHS organisations in Scotland (2012) includes newborn screening records and blood spots as health records.⁵⁶ The Health Records Retention Schedule draws a distinction between neonatal screening records (presumably for the health interests of the patient) and prescribes a minimum retention period of 25 years, while it provides that newborn blood spot screening cards should be retained for a minimum of 5 years for quality assurance purposes, but that longer retention is recommended in keeping with the Code of Practice of the UK Newborn Screening Programme Centre (2005).⁵⁷ Thus, the Guide links purposes and time periods with procedures for justifying on-going retention, although the justification for the periods chosen is less obvious. Unfortunately, helpful instructions from the last version of the document in 2008 - to the effect that parents should be alerted to the possibility of contact from researchers after the minimum period and that there should be a record of their consent to contact response - have been removed.⁵⁸ Best practice suggests strongly that these be reinstated.

4.8 The consequences of treating the entire collection as information are that it becomes subject to the Data Protection Act 1998. This in turn means that the 'data controller' - being Greater Glasgow & Clyde Health Board and (possibly also) National Services Scotland - is responsible for compliance with the provisions of the 1998 Act. This includes, for example, that the data are held lawfully and fairly; that the data are processed only for the original purposes for which they were obtained; that the data are not kept longer than necessary to meet those purposes; and that they should not be transferred to any other country which does not have similar levels of privacy protection.

4.9 A potential complicating factor is that much of the Scottish collection is not held in a systematic format; rather many cards are merely stored in boxes arranged by year. Normally, for the Data Protection Act to apply personal data must be held in a 'relevant filing system', that is, in an ordered and accessible way. There are, however, two reasons why no attempt should be made to rely on this as a means to evade the Data Protection Act. First, the data contained in the collection relate to the health of individuals and were collected for health purposes; as such, they constitute an 'accessible record' which automatically qualifies for legal protection under the 1998 Act. An additional consideration is the fact that the data are held by a public authority meaning that they are 'Category E' data⁵⁹ and also deserving of protection (albeit that not all provisions of the 1998 Act apply). In each case, the way in which nature of the holding is irrelevant.

The importance - or otherwise - of consent

4.10 Contrary to popular belief, it is not the case that the consent of the individual is necessarily required for the processing of his or her data; rather information about processing and purposes thereof must be available; moreover, certain exceptions apply to the processing of data. These include processing that is necessary for the protection of the vital interests of the individual, or for the prevention or detection of crime. Importantly, the Data Protection Act does not apply to data relating to deceased persons or to data which have been adequately anonymised, i.e., from which an individual cannot likely reasonably be identified. In all cases, a lawful basis for processing personal data must exist, but consent is only one of a range of possible lawful bases.

4.11 Section 33 of the Data Protection Act provides for the so-called 'research exemption'. This can be applied where the processing of personal data is only for research purposes, and where the following conditions are met:

• The data are not processed to support measures or decisions relating to particular individuals; and
• The data are not processed in such a way that substantial damage or substantial distress is, or is likely to be, caused to any data subject.

4.12 Three important consequences of the application of the research exemption are:

(a) personal data may be kept indefinitely;

(b) personal data may be processed for purposes other than those for which it was originally obtained; and

(c) data subjects need not be given access provided that they cannot be identified from results of the research.

This having been said, the arbitrary retention of records with the abstract hope that they might have a future research value is not acceptable. The Information Commissioner's Office has made it clear that: '[t]he exemption may only be used…if research is actually being carried out or there is a firm intention to use the records for that purpose.'⁶⁰ Data subjects should normally be informed of the prospect of this research use of their data. If, however, patients cannot be contacted without disproportionate effort then this requirement need not be met. The Information Commissioner's Office advises that this fact should be recorded.⁶¹ What constitutes 'disproportionate effort' is a matter of facts and circumstances in each case and the advice of the Information Commissioner's Office should be sought if there is any doubt. This does not preclude an effective and sustained public awareness campaign about the existence and use of a resource such as the Guthrie collection, as indeed was recommended by the Confidentiality and Security Advisory Group for Scotland in 2002.⁶²

4.13 Apart from the Data Protection Act 1998 and the NHS Guide, a number of other laws and policy documents affect record keeping arrangements in NHS organisations.⁶³ In particular, legal and professional obligations must be complied with (arising from the common law duty of confidentiality and the NHS Scotland Confidentiality Code of Practice), including the role of Caldicott Guardians.⁶⁴ Caldicott Guardians play a very important role within the NHS as officers responsible for maintaining oversight of legal and ethical propriety of information flows with respect to patient confidentiality. A recent review has confirmed their central role in information governance, emphasising not only the enduring and vital importance of protecting confidentiality, but also now that "The duty to share information can be as important as the duty to protect patient confidentiality."⁶⁵ Prior professional undertakings to the public must also be taken into account especially if a shift in policy or approach is being contemplated.⁶⁶

4.14 The relevance of the common law duty of confidence is that this complements and in some ways goes beyond the requirements of data protection, most notably that the duty of confidence extends after death (albeit not indefinitely).⁶⁷ Thus, from the perspective of management of the collection, although data protection safeguards no longer apply to deceased persons, this does not give carte blanche for the use of records without considering the requirements of the common law. These include that disclosure must be justified on one or more of a limited number of grounds as laid out in the Human Rights Act 1998, that is, "...in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."⁶⁸ We discuss the full implications below.

4.15 Thus, conclusions to note about the collection as information are:

• As a matter of current practice, it would seem that the Guthrie collection is treated in Scotland as part of the health record; this has implications for retention periods and the legal regimes that apply;
• As a matter of law, the most relevant provisions are found in the Data Protection Act 1998 and the common law duty of confidence, both of which must be read in light of the Human Rights Act 1998;
• Individual rights of privacy over personal information are not absolute nor do they require as a strict matter of law the consent of the person; while consent is one means to legitimate processing of personal data, other justifications are possible but individuals should be able to know the purposes for which their data are being processed;
• Anonymisation of data can greatly minimise the privacy risks and, by association, the privacy claims of individuals; indeed appropriate anonymisation of data means that the Data Protection Act does not apply;
• There are merits in treating the sample in itself as personal information for the purposes of regulation although - as we discuss in the next section - other legal regimes must also be considered.

The collection as tissue

England

4.16 In England, blood samples (and, thus, newborn blood spot screening cards) are covered by the Human Tissue Act 2004 (HTA 2004), which provides a legislative framework for regulating the storage and use of human organs, tissues and cells from both living and deceased persons⁶⁹ for certain "scheduled purposes".⁷⁰ Part 1 of the Act regulates the removal, storage and use of "relevant material" for the purposes outlined in Schedule 1 of the Act, including "research in connection with disorders, or the functioning, of the human body". "Relevant material" is defined as material that has come from the human body, which consists of or includes human cells. Embryos outside the human body are excluded, but blood is included.⁷¹

4.17 Part 2 of the Act made provision for the establishment of the Human Tissue Authority (HTA), which oversees and licenses organisations that store and use human tissue for purposes such as research, patient treatment, post-mortem examination, teaching, and public exhibitions, and gives approval for organ and bone marrow donations from living people.⁷²

4.18 The HTA's Codes of Practice cover the main aspects of the removal, storage and disposal of human organs and tissue. The Codes make clear that material may be taken from the living in a variety of circumstances, for example:

• in the course of a diagnostic procedure (e.g., blood sample, biopsy)
• specifically for the purposes of research (e.g., a blood sample taken as part of a population screening programme)

4.19 This would seem to put beyond doubt that Guthrie Card collections in England are regulated by the HTA 2004 and the Human Tissue Authority.

4.20 The Code on Consent also notes that: "Under the HT Act, consent from the living is not needed for storage and use of tissue for:

• clinical audit
• education or training relating to human health (including training for research into disorders, or the functioning, of the human body)
• performance assessment
• public health monitoring
• quality assurance"⁷³

4.21 However, consent is normally required to store tissue from the living for:

• obtaining scientific or medical information about a person which may be relevant to any other person (now or in the future)
• public display
• research into disorders, or the functioning, of the human body and
• transplantation.

4.22 More specifically on research, the relevant Code of Practice states: "Tissue that was taken from the living for diagnosis and subsequently stored in a diagnostic archive can be valuable for use in research in connection with the disorders, or the functioning of, the human body. Diagnostic tissue can only be released for research under the following circumstances:

• When the patient has given consent for use of their tissue in research (the preferable scenario); or
• When the tissue will be released to the researcher in a non-identifiable form; and
• When the tissue will be used in a project that has approval by a recognised research ethics committee (for more information on ethics committees see the National Research Ethics Service (NRES): http://www.nres.nhs.uk/)⁷⁴

4.23 The HTA 2004 applies only to England, Wales and Northern Ireland EXCEPT certain sections, including section 45 - Non-consensual DNA analysis - which also applies to Scotland, and this is discussed further below.

Tissue in Scotland

4.24 If the collection/the physical samples are seen as "tissue" then the legal position in Scotland is less clear. As stated above, the Human Tissue Act 2004 does not, in the main, apply in Scotland, with the notable exception of section 45 (see below). Moreover, the equivalent legislation for Scotland - the Human Tissue (Scotland) Act 2006 - does not extend to the Guthrie card collection because it is concerned only with material taken from deceased persons or from living persons for transplantation purposes. It may therefore be the case that a lacuna in the law exists with respect to tissue from the living generally. The common law, that is, judge-made law, is of little assistance.⁷⁵ Almost all of the cases relate to material taken from deceased persons⁷⁶ or are concerned with the criminal law, for example, theft of human material.⁷⁷ It might be possible to argue that the physical samples are owned by those who have created and hold the collection - on an old rule about ownership going to those who exercise labour and skill to create something new - but there is no direct modern Scottish authority on this point.⁷⁸

4.25 On questions of property, it is important to be aware of an important decision of the Court of Appeal in England in which it was held that men who deposited sperm in a fertility clinic and which perished because of negligent storage had a property claim against the NHS Trust for resulting emotional harm.⁷⁹ The influence of this in Scotland is open to question because (a) decisions of the English Court of Appeal are not binding on Scottish courts, (b) this is an unprecedented decision with unclear legal basis, and (c) the decision itself was contingent on the circumstances, that is, sperm was deposited with the express expectation that it be returned to the donor at some future date. This having been said, two points should be taken from this turn of events: (1) it may signal a shift in judicial attitudes towards property-type claims in human material, and (2) there might be an analogy with Guthrie spots, viz, one purpose for retention is the longer-term health interests of the individual and therefore a connection or continuing claim might remain between an individual and his or her sample.⁸⁰

4.26 The only statutory provision of direct relevance to the Guthrie collection in Scotland is Section 45 of the Human Tissue Act 2004 (Non-consensual DNA Analysis). This in effect creates an offence of 'DNA theft'. It is concerned with DNA analysis only, not with the holding of tissue per se. The basis for this legislation is consent, reflecting the cultural and attitudinal shifts which have occurred in the last few decades with respect to biomedical collections and practices. That said, while consent is now the norm to legitimate actions done with or to biomedical collections is in not required in all circumstances.

Lawfulness of continued retention

4.27 Section 45 of the Human Tissue Act 2004 came into force on 1 September 2006. Its effect is to create a criminal offence of non-consensual DNA analysis, albeit with exceptions, but it does not create a statutory legal basis for the holding of human tissue in Scotland. It is, in fact, difficult to find a clear positive legal entitlement for continued retention. Arguably, however, in such cases an old maxim of the law applies: nulla poena sine lege (no penalty without law). Put another way, 'that which is not illegal is legal'. It does not follow, however, that the Guthrie collection can be used freely because wider ethical considerations must also be borne in mind, as should the possibility of the criminal offence of non-consensual DNA analysis.⁸¹ Moreover, there is an important distinction to be drawn between hard and soft law. Hard law, such as Acts of Parliament or case law, is a more formal expression of the legal system and political will. Soft law, in the form of guidance or governance arrangements, can be equally and sometime more effective. It is certainly the case that NHS Scotland has a robust system of research governance procedures. NHS Scotland has brought the collection within the remit of these procedures to help to ensure appropriate oversight. We assess these measures in chapter 7.

Lawfulness of use - section of the 45 HTA 2004 (Non-consensual DNA analysis)

4.28 Section 45 of the Human Tissue Act 2004 provides that a person commits a criminal offence⁸² if he has any bodily material⁸³ intending that any human DNA in the material be analysed and (a) there is no consent to such analysis, or (b) the results of the analysis are not for an 'excepted purpose' as prescribed by the law. These purposes include the prevention or detection of crime, conduct of a prosecution and purposes of national security.

4.29 This provision of the law has two important qualifications of relevance to the Guthrie Collection. First, the legal position regarding 'existing holdings', i.e., material held prior to the section coming into force (1 September 2006), and, second, the research exemption which relates to material taken from living persons after that date.

4.30 As regards existing holdings, DNA analysis is lawful for a finite list of purposes even if the samples are identifiable and even if no consent has been obtained. This list includes clinical audit, research in connection with disorders, or the functioning, of the human body, and obtaining scientific or medical information about a living or deceased person which may be relevant to any other person (including a future person).

4.31 As regards the research exemption, the results of DNA analysis may be used for research in connection with disorders, or the functioning, of the human body without consent, providing that:

• the bodily material concerned is from a living person; and
• the research is ethically approved in accordance with regulations made by the Secretary of State; and
• the researcher is not in possession, and not likely to come into possession of information that identifies the person from whom it has come.

4.32 In other words, scientifically sound, ethically approved and adequately anonymised research for human health purposes is lawful under the 2004 Act.

The Human Tissue Authority provides advice on the application of this section of the 2004 Act to Scotland.

4.33 Conclusions to note about the collection as tissue:

• There is no clear legal basis in Scotland to regulate the collection as tissue, with the exception of section 45 of the Human Tissue Act 2004;

• This section merely concerns DNA analysis and creates an offence for which exemptions apply;
• The existence of the collection as an existing holding does not require specific consent but careful attention is required to questions of access and use;
• As with data protection, anonymisation of the collection for use can elide a number of legal concerns (see further below under Consent, Chapter 5)
• Appropriate ethical oversight of the collection is required in order to conform with the provisions of section 45 of the 2004 Act.

The human rights dimension

4.34 All laws and practices must respect the human rights of UK citizens. Thus, in order to obtain the complete legal picture with respect to the Guthrie collection it is essential to consider the human rights dimensions.

4.35 The ruling of the European Court of Human Rights in Marper, see above, has cast some light on these dimensions with respect to DNA collections (albeit in a forensic setting). It was held in that case that the blanket policy of the UK to retain DNA profiles and samples indefinitely when taken from persons without their consent and who had not been convicted of a crime was an unjustified breach of their human rights. Indeed, it held that the mere retention of DNA, even without use, was an interference with the right to respect for private life because of the possible implications that future uses could have for individuals. This might raise obvious questions for elements of a Guthrie collection for which current explicit consent is not operating, i.e., the historical collection. But it does not follow that long-term retentions must cease; it might mean, however, that the procedures for governance should be strengthened.

4.36 Human rights law seeks balance and even interference with individual rights can be lawful so long as it is justified. Justification is a three-prong test:

I. In accordance with the law

This means that measures must have a basis in domestic law; the law must be adequately accessible and foreseeable and with sufficient precision for individuals to know how it operates; and there must be sufficient protection from arbitrary decisions and clarity of the scope of discretion. Whether these criteria are met depends on all circumstances in a given context. As has been demonstrated, there is an absence of any specific hard law basis for taking and retaining blood spots in Scotland. This places all the more emphasis on the soft law conditions attached to, and arrangements for, the storage and use of the collection. This issue was of particular concern for the European Court of Human Rights in Marper and suggests that robust, transparent policies and procedures are essential. We return to this below.

II. Legitimate aim

This means that the measure must further one of the aims mentioned above. The health of individuals and others, social welfare and the prevention of disorder or crime are all legitimate aims; but these are further qualified by the final criterion.

III. Necessary in a democratic society

This means that the measure must show that it addresses a "pressing social need", that its operation is proportionate and that the reasons advanced for its existence are "relevant and sufficient". It is the obligation of authorities to demonstrate that they meet these criteria.

4.37 Conclusions to note about the human rights dimension.

• All laws and practices must be compliant with human rights
• To test human rights compliance, we must ask if (1) a measure is in accordance with the law, (2) pursues a legitimate aim, and (3) is necessary is a democratic society. If this test can be met then a measure is lawful even if it engages individual human rights.
• In the context of DNA collections, the Marper case held that it was the blanket and indiscriminate nature of the policy which was unjustified.
• The fact that consent provisions have been introduced to the regulation of the Guthrie collection indicates that no such charge could be levelled in the current context. But the question of the historical collection remains as this affects persons is categories 1, 2 and 4 in Chapter 3.

The options for the future of the collection include:

(a) complete destruction,

(b) attempts to obtain informed consent for people whose cards are held as part of the collection,

(c) a clear, well-publicised, accessible and efficient opt-out system.

In deciding between options the guiding parameters are whether the ultimate decision embodies a proportionate and justifiable policy.

POINTS TO CONSIDER AND RECOMMENDATIONS FROM CHAPTER 4

• The Guthrie collection should be treated as both personal information and human tissue for the purposes of robust governance.
• The existing collection is not unlawful but careful attention must be paid to matter of governance, especially those concerning future use and access.
• Consent to use is not an absolute requirement but should not be departed from lightly.
• Anonymisation can remove some legal obligations but not all obligations; moreover, it is not a complete answer to the challenges thrown up by the collection.
• Human rights are a consideration across all areas of law. All mechanisms, policies and procedures should be tested for human rights compliance.