Per the Common Rule, data or specimens are considered “identifiable” if the identity of the subject “is or may readily be ascertained by the investigator” or associated with the information/sample (45 CFR 46.102(e)(5) and (6). The IRB, and just about everybody else really, struggles quite a bit with the notion of “identifiability” in general, and when considering genetic information in particular.
As of this writing, the Common Rule does not consider genetic data to be individually identifiable if it is not linked to a code or other information that would allow reidentification of subjects. BUT — federal regulators, in the preamble to the Common Rule, say that their ultimate goal is “to implement the Common Rule in a way that is aligned with the evolving understanding of the concept of identifiability while protecting subjects and encouraging and facilitating valuable research” (82 Fed Reg 12, page 7169). The Common Rule’s text says say federal departments are to regularly assess whether there are technologies or processes that can yield identifiable information at least every 4 years (45 CFR 46.102(e)(7), and the preamble notes “the expectation is that whole genome sequencing will one of the first technologies to be evaluated… ” (82 Fed Reg 12, page 7169).
So what got us thinking about the identifiability of genetic information, anyway? This recent story, which tells us that the promises of anonymity made to sperm donors in the past don’t really hold up anymore, in the New York Times did. Ditto for people who gave babies up for adoption years ago — remember that other New York Times piece about how 60 percent of Americans of Northern European descent could be identified through databases like the one created by 23andme-type services, even if they’ve never joined one of those databases themselves?
So IRBs and PIs need to keep the notion of privacy and confidentiality in mind when reviewing or designing research projects. While genetic material itself may ultimately be identifiable, perhaps measures can be put in place to limit access to genetic information, or subjects can be told up front about any limits to privacy and confidentiality.