Over the last decade there has been a rapid increase in investment and influence in genomic technologies in a range of sectors. The technology offers well-known benefits in areas like advanced disease treatment and personalised healthcare, and there is a drive to deliver a genomic-focused healthcare system. However, the rapid growth of applications in sectors like insurance, education and law enforcement also have the potential to affect everyone.
The ICO aims to increase public trust in how organisations process personal information through responsible practice. It says that it wants to empower people to safely share their information and use innovative products and services that will drive the economy and our society. Its strategy includes the ICO’s commitment to set out its views on emerging technologies to reduce burdens on businesses, support innovation and prevent harms.
In 2023 it set out an initial area of concern around polygenic risk scores; probabilistic assessments of traits and characteristics derived from genomics that could inform how organisations deliver healthcare and other services in the future.
It has now published an updated report which considers regulatory and privacy issues raised by the wider development of genomics. It shows how these may arise through scenarios that cover potential uses of the technology in and beyond healthcare, including in direct-to-consumer services, insurance, education and law enforcement. The issues covered in the report include:
- the challenges of understanding when genomic data may be considered personal information. Genomic information relating to the deceased, or once thought unimportant or even unidentifiable in terms of personal information, may have an increasingly large significance as personal data as research rapidly advances;
- the complexities of using and sharing third party information (including both genomic information and inferences derived from it) given how much of a genome and the information derived from it is shared, even on a familial level;
- the associated risks and challenges of anonymising and pseudonymising genomic information in a way that embeds privacy by design without compromising innovative and necessary research; and
- the significant risks of bias and discrimination emerging from the processing of genomic information. Inaccurate models trained on unrepresentative datasets may emerge, or inferences used to support unfair decisions even when using accurate information.
The ICO plans to carry out engagement with key stakeholders including using its Regulatory Sandbox to engineer data protection into uses of genomic information. It will also monitor and highlight developments in this area through its Tech Horizons reports, where it will set out future programmes of work on the issues as they arise. It will pay particular attention to the sharing of third party genomic information and direct-to-consumer genomic services linked to polygenic risk scoring.
The report includes a section on regulatory issues here.
