Analysis And Comment Ethics

Implications of data protection legislation for family history

BMJ 2006; 332 doi: (Published 02 February 2006) Cite this as: BMJ 2006;332:299
  1. Anneke Lucassen, senior lecturer (a.m.lucassen{at},
  2. Michael Parker, professor of bioethics2,
  3. Robert Wheeler, paediatric surgeon3
  1. 1 Wessex Clinical Genetics Service, Princess Anne Hospital, Southampton SO16 5YA
  2. 2 Oxford Genetics Knowledge Park, Ethox Centre, University of Oxford, Oxford OX3 7LF
  3. 3 Southampton University NHS Trust, Southampton SO16 5YA
  1. Correspondence to: A Lucassen
  • Accepted 4 January 2006

Clinical geneticists currently collect and store information on family history without explicit consent. Are they flouting the Data Protection Act?

Family history is important in many areas of medicine, but particularly clinical genetics. The family tree is an important clinical tool for answering questions about a patient's risk of developing a genetic disorder and appropriate management. Such records contain sensitive information, including family relationships, the health status of family members, and dates of birth, marriages, and pregnancies. The names and contact details of family members may also be recorded to facilitate further investigation. Information about family members is usually gathered from individual patients and recorded without relatives' consent or knowledge. The tacit assumption has been that such data are in the public domain because they have been shared within the family and that explicit consent is therefore not required. The Data Protection Act 1998 and an increasing cultural focus on consent and confidentiality, however, question this assumption.

Case history

Ms White, a 27 year old woman, attends the genetic clinic because of a concern about her family history of cancer. Her father had bowel cancer at the age of 42 and a paternal aunt had a gynaecological cancer at a similar age. She has two further paternal aunts about whom she knows little (figure). Ms White is advised to try to find out some more details about her family history since it could reflect a mutation in one of the genes predisposing to bowel or womb cancer. However, such details could also provide reassurance that there is a relatively low risk of such a mutation and Ms White's medical management therefore depends on such details. She is given standard consent forms for access to medical records to pass to her father and aunt.

Some time later, Ms White's aunt phones the department saying that she is disturbed to have been approached unexpectedly about a cancer she had five years ago and about which she preferred to have no reminders. She thought that the Human Rights Act prevented the genetics department from recording any information about her without her knowledge. She is concerned that such information could lead to discrimination and does not think either of her sisters would be pleased to learn that the department is storing information about them without their knowledge.

Some months after this Ms White's brother also attends the genetics department. He has not been contacted by Ms White but been independently referred by surgeons because of an episode of rectal bleeding. He is unaware of any family history of cancer except the cancer in his father; he asks to see his family tree, which is stored in the family notes he shares with his sister.

This case raises important ethical, legal, and practical questions. Should the consent of family members be required for the storage of information about them? Even if consent is not required, is there a duty to inform family members that such records exist? What are the ethical and practical implications for health services of contacting relatives who themselves have not sought contact? Does Ms White's brother have a right to find out details of the family tree originally provided by his sister but which is now a composite of freely available and confirmed evidence? The answers to these questions have implications for the successful delivery of genetics services as well as for the use of family histories in wider medical practice.1 We have discussed the role of confidentiality in clinical genetics and the breaching of such confidentiality in the interest of others elsewhere.2 3 Here we focus on the role of the Data Protection Act, the ethical issues involved in obtaining, recording, and disclosing a family history of disease, and the implications of contacting family members.

Data Protection Act

The Data Protection Act 1998 covers the obtaining, recording, and processing of personal data, including family medical histories. Among other things, the act requires that anyone about whom data are stored gives explicit consent for the processing of that data.4 Exemptions to the requirement of explicit consent exist if, for example, the data are to be used for emergency treatment or preventive medicine, data are already in the public domain, or there is substantial public interest. Which of these apply to clinical genetics?

Public domain exemption

Those who provide genetics services have argued that information such as Ms White's knowledge of her aunt's cancer is in the public domain.5 If this claim were accepted, such records would be exempt from consent requirements under the Data Protection Act. But is such information really public? Ms White's aunt clearly did not think so, and many people, irrespective of their views about whether information should be shared, would agree with her that telling close family members about cancer is different from making it public. Consequently, the claim that information I share with family members and friends is in the public domain requires further justification and cannot be taken for granted without empirical evidence about what those who provide such information consider themselves to be doing.

Preventive medicine exemption

The creation and storage of family histories can have tremendous clinical value in, for example, screening recommendations for both patients and their relatives. Use in preventive medicine may therefore be a more relevant exemption. Good clinical practice cannot, however, depend entirely on the information provided by patients. This information is often inaccurate or incomplete, and in practice many genetic services will try to confirm family histories by comparing them with hospital records or histology reports.6 7 Genetic services currently rely on patients to make contact with family members in order to obtain permission to access their records. If they consent, the family tree becomes more than a collection of freely available evidence.

The problem of patients providing inaccurate information also raises the broader issue of the interest family members might have in the accuracy of such records and the question of whether such records are being processed fairly. One major thrust of data protection legislation has been to allow people to verify, and if necessary correct, their records. The Council of Europe, for example, has stated that “Everyone is entitled to know any information collected about his or her state of health,”8 and the NHS code of practice on confidentiality states that it cannot be assumed that patients are happy for identifiable information about them to be used for purposes other than their direct care.9 This implies that, whether or not consent is required, data controllers must inform people how their data may be used, including any possible disclosures. Thus, in the case above, Ms White should be adequately informed about the possible uses of the information she is providing, as should those about whom she has provided data, even if their consent to use is not required.

Fair processing

Approaching all people identified in a family tree to satisfy fair processing requirements, would clearly have enormous implications for practice. Such an approach is also not ethically unproblematic. It would, for example, in many cases indicate to relatives that they might be at risk of inherited and possibly untreatable disease, and although some relatives may welcome such knowledge, others will not. The issue of unsolicited contact to inform relatives has not been addressed in UK courts, although lower courts in the United States have come to differing conclusions.10 11 UK genetics departments usually make contact with relatives through the patient, but the question of what duties genetics departments might have when such communication is unsuccessful needs clarification.12 13

The act recognises that the fair processing of information when data are obtained from someone other than the data subject presents some difficulties.14 Exemption from the requirement for fair processing exists if it requires “disproportionate effort,” although the act does not define this term. The Information Commissioner, a government official appointed to oversee the Data Protection Act, has said that what amounts to disproportionate effort has to be determined in each separate case. Since Ms White can supply contact details of her relatives, tracing them is relatively straightforward, but the effort required could still be argued to be disproportionate for other reasons. One practical difficulty is the resources required for clinical departments to contact everyone mentioned in a family tree. These resources, such as time, might be better spent elsewhere. The public interest might therefore lie in avoiding the disproportionate use of resources to ensure fair processing.

Section 60 exemption

In other areas of health care—for example, the cancer registries—ethical and practical concerns about obtaining consent to data processing have been circumvented by an application to the secretary of state for health, who can make an order to permit processing without consent under section 60 of the Health and Social Care Act.15 This power, which was set up as a temporary measure, can be used only when gaining consent for processing is not reasonably practicable.16 Gaining consent from relatives will be impractical in some situations but easy in others.

Public interest exemption

A policy of contacting all relatives mentioned in a family tree would raise important questions about public interest other than the appropriate use of resources. For example, a policy that required disclosure to third parties might undermine trust and confidence in the health service more broadly and hence end up being harmful to patients. Patients who would otherwise come to clinical genetics services because of a concern about their family history might be reluctant to do so if they felt that the fact of their consultation and some of its content were to be disclosed to relatives (for example, where reproductive choices could be made as a result of this information). Patients might also be more reluctant to discuss inherited disorders with their doctors and more reluctant to provide family histories if disclosure were the norm. A counterargument to this is that contact could provide family members with access to beneficial interventions, such as screening or treatments, and that this benefit would outweigh the benefits of non-disclosure.


Routine clinical genetic practice entails the use of family histories which will identify and provide personal information about individuals other than the patient. We argue that there should be no requirement to obtain consent from all the family members described in an individual's family tree. The main reasons for this are that the public interest in high standards of confidentiality and in the clinical benefits to be gained from collecting family histories outweigh the arguments in favour of fair processing. This does not mean that family members should never be contacted after a patient has provided a family history. For example, there may be clinical reasons to make contact.

Summary points

A patient's family history may be important in medical management

Relatives are currently not routinely asked for their consent or told that such records exist

The Data Protection Act suggests that fair process requires that family members consent to their inclusion in a record unless a valid reason for exemption exists

The public interest in high standards of confidentiality outweighs the argument of fair processing of familial information

Clinical geneticists should not be obliged to contact all people mentioned in a family history unless there are clinical reasons

Taking a family history is not unique to genetic services. All branches of medicine, to a greater or lesser extent, use family history to influence diagnosis. Although these histories might be less detailed, with fewer demographic data recorded, the arguments above still apply. In the public interest, it would seem implausible that the courts would demand that all persons identified by a patient in the process of providing a family history, taken as part of clinical management, should be notified for the reasons of fair process alone.


  • See p 297

  • Contributors and sources AML is a clinical geneticist with particular interest in ethicolegal issues arising in practice. This article arose from discussions locally (Southampton hospital clinical ethics group) and nationally ( together with MP and RW, who have established expertise in ethical and legal issues of such cases. AML is guarantor.

  • Competing interests None declared.


  1. 1.
  2. 2.
  3. 3.
  4. 4.
  5. 5.
  6. 6.
  7. 7.
  8. 8.
  9. 9.
  10. 10.
  11. 11.
  12. 12.
  13. 13.
  14. 14.
  15. 15.
  16. 16.
View Abstract

Sign in

Log in through your institution

Free trial

Register for a free trial to to receive unlimited access to all content on for 14 days.
Sign up for a free trial