Munich

Fellow feeling: many Icelanders opted out of a database that would be used for genetic studies. Credit: NORDICPHOTOS/ALAMY

Iceland's supreme court has ruled that the transfer of a dead patient's health data to a proposed genetic database would infringe the privacy rights of the man's descendants.

The ruling — which was made late last year but published in English only last month — casts further doubt over the nation's plans for a Health Sector Database to hold centralized electronic health records on its population.

The plans attracted global attention when they were formulated in 1998 (see Nature 396, 395; 1998). They would use Iceland's population, claimed by some to be unusually homogeneous, to pioneer genetic population studies.

But the company contracted to build the database — deCODE Genetics of Reykjavik — has already postponed its development. The plans were quietly put on ice in 2002 after the company was unable to reach agreements with regulators about what information the database would contain or with hospitals about who would pay for it.

On 27 November, the court found in favour of Ragnhildur Gudmundsdottir, an 18-year-old student, who did not want her dead father's health records to be transferred to the database if plans went ahead. The court said that including the records in the database might allow her to be identified as an individual at risk of any heritable disease her father might be found to have had — even though the data would be made anonymous and encrypted.

The possibility of such identification is increased by the fact that the Health Sector Database would allow information to be linked with data from other genetic and genealogical databases, the court found.

The ruling has been interpreted to mean that the 1998 law governing the creation of the database is unconstitutional because it fails to protect personal privacy adequately.

But the construction of the database is already in doubt. DeCODE, which in 1999 was granted an exclusive 12-year licence to build it, was unable to agree with the Icelandic Data Protection Authority or Iceland's National Bioethics Committee about use of the data. To find genes associated with disease, the company had wanted to combine individuals' health data with genomic data from blood samples, which it was gathering from the community, and a genealogical database it has created. The company was also unable to reach agreement on who should pay for the project.

Sigrun Johannesdottir, head of the Data Protection Authority, says that it declined to grant deCODE the free access that it sought. European Union rules, she says, demand that only averaged data can be extracted from it, not the individual data, which are more scientifically valuable.

Magnus Petursson, director of the University Hospital in Reykjavik, which serves more than half of the population, says that the hospital began work on the project in 2000 but negotiations petered out. “We have not heard whether they will start again,” he says. Kári Stefánsson, chief executive of deCODE, says that the company is “still working with the government to put together the database”.

David Gunnarsson, secretary of Iceland's health ministry, says that the government is still interested and has been closely following the project's progress. He denies that the court ruling undercuts the 1998 act. “The first issue for the government,” Gunnarsson says, “is to find a way to resolve the discussions according to what the law allows, and to everyone's satisfaction”.

Edward Farmer, a spokesman for deCODE, says that the company has already collected blood samples from a total of 110,000 adults in Iceland — more than half the adult population — during 50 disease-related genetic studies. So far, deCODE is not permitted to use the samples collected in work on unrelated diseases.

The database plan was controversial in Iceland: more than 20,000 people actively opted out of it. Now long-term critic Skúli Sigurdsson, a science historian affiliated to the University of Iceland, predicts that the project will not happen “given the complexity of data mining and personal privacy issues, and the tremendous inertia of health politics”.

Additional reporting by Jim Giles, London.