Challenges with anonymising genetic data

Under the GDPR, anonymous information is information which doesn't relate to an identifiable natural person. Whether a person is identifiable depends on all of the means reasonably likely to be used to identify someone. This is a question of factors such as the cost and time associated with re-identifying someone, taking into account developments in technology.

A common approach to anonymisation of genetic data is to ensure that it is not held along with any information that could be used to directly or indirectly identify the individual from whom the genomic information was derived. Such information might include an individual’s name, date of birth, address, social security or other government issued identification number. Whether this approach is sufficient to render the data anonymised will depend on:

1. the nature of the genetic data;  and
2. the nature of current technology, including means by which the data could be cross-referred with other information.

Of course, not all genetic data is created equal. A small set of polymorphisms detected in a subject’s genome would probably present a remote risk of identifying an individual, particularly if these are common genetic alterations possessed by a high proportion of the population. On the other hand, sometimes genetic data will indicate that a patient may have been diagnosed with a very rare disease, which substantially narrows the pool of individuals that the genetic information could have come from.

And then there’s whole genome sequencing: while a person’s complete set of genes is inherently unique and therefore capable of identifying a particular individual, whether it could be reasonably used to re-identify someone will depend on the means available to someone in possession of this information. Through developments in technology, such as AI-mediated merging of datasets, and the increasing volume of information that is collected and stored about individuals, this is likely to become increasingly feasible. In fact, it was suggested in a paper by the former Article 29 Data Protection Working Party (the predecessor to the European Data Protection Board), that in the context of tissue donors, even publicly available resources such as genealogy registers combined with the metadata about DNA donors (time of donation, age, place of residence) can reveal the identity of certain individuals even if that DNA was donated “anonymously”.

Evidently, anonymisation of genetic data can present some challenges – we will explore this further in our next post.

Find out more about our experience in diagnostics and medical devices at www.herbertsmithfreehills.com/our-expertise/sector/diagnostics-and-medical-devices.

Authors