Direct-To-Consumer Genetic Testing: Empowering Eu Consumers and Giving Meaning to the Informed Consent Process Within the Ivdr and Gdpr Frameworks
Total Page:16
File Type:pdf, Size:1020Kb
Washington University Global Studies Law Review Volume 19 Issue 1 2020 DIRECT-TO-CONSUMER GENETIC TESTING: EMPOWERING EU CONSUMERS AND GIVING MEANING TO THE INFORMED CONSENT PROCESS WITHIN THE IVDR AND GDPR FRAMEWORKS SARA A. MAHMOUD-DAVIS Follow this and additional works at: https://openscholarship.wustl.edu/law_globalstudies Part of the Privacy Law Commons Recommended Citation SARA A. MAHMOUD-DAVIS, DIRECT-TO-CONSUMER GENETIC TESTING: EMPOWERING EU CONSUMERS AND GIVING MEANING TO THE INFORMED CONSENT PROCESS WITHIN THE IVDR AND GDPR FRAMEWORKS, 19 WASH. U. GLOBAL STUD. L. REV. 1 (2021), https://openscholarship.wustl.edu/law_globalstudies/vol19/iss1/5 This Article is brought to you for free and open access by the Law School at Washington University Open Scholarship. It has been accepted for inclusion in Washington University Global Studies Law Review by an authorized administrator of Washington University Open Scholarship. For more information, please contact [email protected]. Washington University Global Studies Law Review VOLUME 19 NUMBER 1 2020 DIRECT-TO-CONSUMER GENETIC TESTING: EMPOWERING EU CONSUMERS AND GIVING MEANING TO THE INFORMED CONSENT PROCESS WITHIN THE IVDR AND GDPR FRAMEWORKS SARA A. MAHMOUD-DAVIS* ABSTRACT Consumer genomics is an industry that is undergoing exponential growth. Although consumers in the United States (U.S.) currently purchase the bulk of online direct-to-consumer (DTC) genetic tests, the DTC industry’s business model depends on exploiting markets worldwide. DTC genetic testing companies increasingly seek to market and sell their services throughout the European Union (EU), which is one of the world’s largest economies and is home to a digital, educated, and wealthy consumer base. Since May 2018, the EU General Data Protection * Sara Mahmoud-Davis is a Virginia-licensed attorney and holds the CIPP/E credential (Certified Information Privacy Professional/Europe). In August 2019, she earned an LL.M. with distinction in European and International Business Law from the University of Vienna School of Law, Austria. She practiced regulatory law for six years at the U.S. Department of Transportation. Previously, from 2000-2007, she worked as a foreign policy analyst for the U.S. Government, including at the U.S. Embassy, Abu Dhabi, UAE. In 2010, she received her J.D. cum laude from Case Western Reserve University School of Law, with a concentration in health law. She has an M.A. in international relations from the University of Chicago, and an A.B. in government and French from Cornell University. I dedicate this article to my three daughters, Leila, Eva, and Serena, who have opened my heart, transformed my life for the better, and each day inspire me and teach me something new. My husband Charles deserves special recognition for tirelessly supporting my dreams and aspirations. I am grateful for my dear friend Michaela Golfinopoulos for her unwavering encouragement and support in all aspects of my life. I am thankful for the guidance of my advisor Dr. Maria Sturm, and Program Director Dr. Siegfried Fina, LLM Program in European and International Business Law, the University of Vienna, Austria. 1 Washington University Open Scholarship 2 WASHINGTON UNIVERSITY GLOBAL STUDIES LAW REVIEW [VOL. 19:1 Regulation (GDPR) provides EU consumers with enhanced data privacy protections and places stricter controls on genetic data. When EU consumers purchase online DTC genetic tests, they exercise two distinct fundamental rights—the right to data privacy and the right to informed medical consent. The article explores the intersection of these rights by examining relevant EU and other legislation, mainly the GDPR, the In Vitro Diagnostic Medical Devices Regulation, and the Council of Europe’s Oviedo Convention on Human Rights and Biomedicine. Additionally, the discussion highlights the challenges associated with protecting consumers’ autonomy and freedom to purchase online DTC genetic tests, while also safeguarding the bioethical standards of informed consent. The analysis explains that the online purchase of a DTC genetic test involves two distinct consent processes—one for data processing and the other for informed consent. These two consent processes are highly dependent upon each other to protect consumers adequately. Yet, the status quo reveals that informed consent is severely lacking in the purchase of online DTC genetic tests. This results in consumers’ loss of control over health and medical decisions, as well as over personal data. Consequently, as the DTC genetic testing industry continues to grow, there is a critical need for more robust online informed consent procedures. The article concludes that current EU regulations fail to sufficiently address the issues specific to online DTC genetic tests. Furthermore, an EU regulation on informed consent, in general, is not feasible. Thus, the article considers opportunities for the EU and its Member States, consumers, and industry to work together to both empower and protect consumers who purchase online DTC genetic tests. Finally, the article discusses methods for industry to improve the online informed consent process. ABSTRACT DEUTSCH Der Markt für Verbraucherprodukte im Bereich Genomik wächst rapide. Während derzeit die überwiegende Mehrheit der online direkt an VerbraucherInnen vermarkteten (Direct-to-Consumers, DTC) Gentests in den USA gekauft wird, ist der Erfolg des DTC-Geschäftsmodells vom Zugang zum weltweiten Markt abhängig. Unternehmen, welche DTC- Gentests anbieten, vermarkten und verkaufen ihre Dienste zunehmend auch in der Europäischen Union (EU), einer der größten Volkswirtschaften der Welt mit einer durchwegs digitalisierten, gebildeten und kaufkräftigen Bevölkerung. Seit Mai 2018 genießen europäische KonsumentInnen durch die europäische Datenschutz-Grundverordnung (DSGVO) erhöhten https://openscholarship.wustl.edu/law_globalstudies/vol19/iss1/5 2020] DIRECT-TO-CONSUMER GENETIC TESTING 3 Datenschutz und einen nun strenger regulierten Umgang mit genetischen Informationen. Erstehen KonsumentInnen in der EU DTC-Gentests online, machen sie von zwei verschiedenen Grundrechten Gebrauch: dem Recht auf Datenschutz und dem Recht auf Aufklärung vor der Einwilligung im Medizinbereich. Basierend auf einer Analyse relevanter EU- und anderer Gesetzgebung, darunter insbesondere der DSGVO, der In-vitro-Diagnostika-Verordnung und des Oviedo-Übereinkommens über Menschenrechte und Biomedizin des Europarats, untersucht die vorliegende Arbeit die Schnittstellen dieser beiden Rechte. Zudem wird die Herausforderung thematisiert, die Autonomie und Freiheit von KonsumentInnen, online DTC-Gentests zu erwerben, zu schützen und gleichzeitig die bioethischen Standards der informierten Einwilligung zu wahren. Die Analyse zeigt, dass der Online-Erwerb eines DTC-Gentests zwei unterschiedliche Einwilligungsprozesse umfasst: einerseits hinsichtlich der Datenverarbeitung, andererseits in Bezug auf die informierte Einwilligung. Für den ausreichenden Schutz von KonsumentInnen ist eine enge Interdependenz dieser beiden Einwilligungsprozesse erforderlich. Die informierte Einwilligung im Rahmen des Online-Kaufes eines DTC- Gentests ist in der Praxis jedoch hochgradig mangelhaft. Als Folge verlieren KonsumentInnen die Kontrolle über Entscheidungen hinsichtlich ihrer Gesundheit und medizinischer Verfahren wie auch in Bezug auf ihre persönlichen Daten. Angesichts des anhaltenden Wachstums des Marktes für DTC-Gentests besteht dringender Bedarf an robusten Online- Verfahren zur Einholung einer informierten Einwilligung. Die Arbeit zieht die Schlussfolgerung, dass die bestehenden EU-Verordnungen in Hinblick auf die spezifischen Problemstellungen bei Online-DTC-Gentests unzureichend sind. Gleichzeitig wäre aber eine EU-Verordnung zur informierten Einwilligung grundsätzlich nicht umsetzbar. Die Arbeit beleuchtet daher die Chancen der Kollaboration von EU, Mitgliedstaaten, KonsumentInnen und Anbietern mit dem Ziel, KonsumentInnen von online erworbenen DTC-Gentests zu stärken und zu schützen. Abschließend werden für Anbieter intendierte Methoden zur Verbesserung von Online-Verfahren zur Einholung einer informierten Einwilligung vorgestellt. Washington University Open Scholarship 4 WASHINGTON UNIVERSITY GLOBAL STUDIES LAW REVIEW [VOL. 19:1 LIST OF ABBREVIATIONS CJEU Court of Justice of the European Union DPO Data Protection Officer DoH Declaration of Helsinki DSM Digital Single Market DNA Deoxyribonucleic Acid DTC Direct-to-Consumer DTCGT Direct-to-Consumer Genetic Testting ENVI Environment, Public Health, Food and Safety ECtHR European Court of Human Rights EU European Union ESHG European Society of Human Genetics FDA United States’ Food and Drug Adminiistration GDPR General Data Protection Regulation GSK GlaxoSmithKline HGP Human Genome Project ICO Informed Consent Officer IVDD In Vitro Medical Devices Directive IVDR In Vitro Diagnostice Medical Devices Regulation MDCG Medical Device Coordination Group SDM Shared Decision-Making TFEU Treaty on the Functioning of the European Union U.S. United States of America WMA World Medical Association https://openscholarship.wustl.edu/law_globalstudies/vol19/iss1/5 2020] DIRECT-TO-CONSUMER GENETIC TESTING 5 I. INTRODUCTION ............................................................................... 6 II. OVERVIEW OF DIRECT-TO-CONSUMER (DTC) GENETIC TESTING COMPANIES AND ONLINES SALES IN THE EU ...................................... 8 III. ANALYSIS OF EU LEGISLATION: THE DEBATE SURROUNDING GENETIC TESTING, GENETIC COUNSELING AND INFORMED