Intended for healthcare professionals

Rapid response to:


Undermining data privacy in health information

BMJ 2001; 322 doi: (Published 24 February 2001) Cite this as: BMJ 2001;322:442

Rapid Response:

Confidentiality and criminal prosecutions

Editor - Ross Anderson[1] reviews the continuing conflict between
confidentiality of personal data and desire of government, corporations
and other authorities for access to stored data. One purpose such data can
be used for is exemplified by the recent unique case of a prosecution
under Scottish common law associated with a case of HIV transmission. The
prosecution case depended heavily on data published in the BMJ, obtained
under confidentiality agreements. The accused had volunteered a sample as
part of a study on the extent of the outbreak of HIV in Glenochil
prison[2] and the complainant as part of an MRC-funded study on genetic
diversity of HIV in Scotland[3]. The identifiers on the samples used for
this investigation were encoded, following usual practice, and names were
not associated with the samples or data in my laboratory.

In collecting evidence for the prosecution case, police investigators
used a standard warrant which permitted them to seize any material they
considered relevant to their case. They broke the codes by following the
route the blood samples took from the clinics who had treated the
patients, thus, the confidentiality agreement under which the samples were
donated became effectively worthless. Under direction from the Procurator
Fiscal the police attempted to seize the research samples themselves, but
eventually accepted that under HSE regulations they could only be released
to an appropriately qualified laboratory.

From the way this investigation was carried out it appears
confidentiality agreements can be ignored, codes can be broken and
material seized as a way of obtaining genetic data on individuals who do
not wish to provide samples to the police in criminal investigations. The
implications for the success of studies involving contact tracing and for
many other epidemiological investigations are immense.

Yours sincerely

Professor Andrew Leigh Brown

Department of Pathology,
University of California San Diego
Centre for HIV Research,
University of Edinburgh

Reference List

1 Anderson R. Undermining data privacy in health information. BMJ
2001; 322:442-443.

2 Yirrell DL, Robertson P, Goldberg DJ, McMenamin J, Cameron S, Leigh
Brown AJ. Molecular investigation into outbreak of HIV in a Scottish
prison. BMJ. 1997; 314:1446-1450.

3 Leigh Brown AJ, Lobidel D, Wade CM, et al. The molecular
epidemiology of human immunodeficiency virus type 1 in six cities in
Britain and Ireland. Virology 1997; 235:166-177.

Competing interests: No competing interests

05 March 2001
Andrew J Leigh Brown
Visiting Professor, Department of Pathology, University of California San Diego
UCSD Treatment Center, 150 West Washington Street, San Diego, CA, 92103, USA