Introduction

Confidentiality is the individual right by which personal information gathered in the context of an intimate relationship must be protected against disclosure without the person’s consent; it limits the access by third parties to knowledge of this information without authorization. This right is part of the principles of privacy and autonomy (Malem 2012; Pritts 2008). Patients or participants of a genomic research project have the right to protect their personal information and to decide on the sharing of such information to third parties. Clinicians and researchers must assure that personal information will be treated as professional secrecy and will only be accessible to other professionals directly involved in the research project and to external contributing researchers if prior authorization to share this information had been granted (Westin 1976; Nass et al. 2009). The right to confidentiality has reached high levels of attention nowadays, as a result of the advent of the modern telecommunication technologies and the rise of the global market economy. In the medical field, this concept has been present since the advent of the Hippocratic oath, which mandates preservation of medical secrecy. The right of confidentiality is protected by the laws of several sovereign countries and by the international law through regulations limiting the access to personal information. At this moment in history, confidentiality is regarded as a crucial requirement to enable legal information exchange and commercial transactions by information technologies, which also affect health economy (Bangemann Report 1994).

In the field of human genomics, confidentiality of genetic information is one of the most important concepts, because this information, in addition of being private, may be predictive of potential diseases and may allow identification of persons for legal and forensic purposes. Moreover, due to its hereditary transmission, it may allow ascertaining family risks, as well as community relationships and ethnic origin. This has the potential to serve as a basis for social stigma, discrimination and marginalization. These qualities of the human genome information attracted the attention of the bioethicists since the beginnings of the Human Genome Project. Thus, the division of ethical, legal and social issues (ELSI) was contemplated as part of the project from its inception (ELSI Planning and Evaluation History 2012). Apart from its biomedical, social, legal and commercial issues, the value of confidentiality protects an ethical principle above all, the preservation of human dignity.

In parallel with this, the global academic community has advocated for sample and data sharing to analyse and understand the different forms and effects of gene variants and the complex interactions between genomes and environment (Hayden 2013).

Genetic variation, ethnic groups and diseases

Human genetic variation is limited. The fixation index (FST) is a measure of the difference between two populations due to their genetic structures. FST values range between 0.0, when allele frequencies are the same in the two populations, and 1.0, if these frequencies are fixed in each population. FST analysis in pairwise populations of the 1000 Genomes Project shows that common genetic variants are weakly different between the continental ancestral groups (FST < 0.09), and that variation is more noticeable among individuals of the same geographic region (The 1000 Genomes Project Consortium 2010). Certain markers, however, allow decrypting a person’s geographical provenance with a high probability, and, although they do not support the concept of “race”, they are useful tools in population genetics and forensic studies (Barbujani et al. 2013). Most scientists reject the concept of “human races” and its sophisticated synonym “ethnic group”, but the concept is still common in medical practice and may be useful to define some risk factors for diseases that are relatively common in particular communities (Barbujani et al. 2013), as it is the case of the risk for type 2 diabetes mellitus in Mexican populations (SIGMA Type 2 Diabetes Consortium et al. 2014). Studies such as this are in large proportion derived from established international collaborations that allow comparisons of genomes, through complex bioinformatics analyses, and provide useful results for biomedical research.

While Mexico is an attractive country to develop population genetics/genomics studies, because of the characteristics of its populations, the Mexican people may become vulnerable when handling confidential genomic information. Mexico had a population of around 112.3 million inhabitants, in 2010 (Censo INEGI 2010). The country has one of the largest urban population areas in the world located in the Mexico City’s Metropolitan area (around 20.1 million inhabitants), followed by two other large urban areas in the west (Guadalajara) and northeast (Monterrey), also highly populated (4.4 and 4.0 million inhabitants in 2010, respectively). In terms of ethnicity, most of Mexico’s population is mestizo (interethnic mixture of Native Americans and Spaniards, with a small contribution from Africans). Mexico also has the largest population of indigenous language speakers in the Americas, with 6.9 million people, in 2010, belonging to around 62 language communities distributed along its territory (Instituto Nacional de Estadística y Geografía 2010). It is also crucial to consider the literacy and education level of the Mexican population for devising general estimations on the grade of public awareness regarding the Human Genome Project and the personal right to protect privacy of their genetic information. The National Census of 2010 shows that 4.8 % of the people above the age of 15 years are illiterate and the average schooling years is 8.6 years (the educational system contemplates 2 and 6 years of preschool and elementary school, respectively) (Censo INEGI 2010). A report by Rodríguez-Yunta et al. (2005) regarding attitudes towards genomics in Mexico and other three Latin American countries shows that 29 % of lawyers, 12 % of scientists, 3 % of students and 1 % lay civilians expressed their concerns about privacy in genomic research. That report suggests that half of attorneys are more concerned about the legal issue of lack of confidentiality of genetic information than lay civilians who remain unaware of this legal weakness. In addition, the report shows that 14, 3, 9 and 11 % of the same groups, respectively, expressed a feeling of lack of information regarding the topic of genomics. These facts indicate that citizens are vulnerable to lack of genomic confidentiality and that effective educational efforts must be accomplished to inform the Latin American public.

In Mexico, as with other emerging economies, the most prevalent diseases and causes of death are similar to those of the developed countries. Maternal/child illnesses and contagious diseases have been largely controlled and are being surpassed by chronic degenerative diseases (i.e. cardiovascular diseases, cancer and diabetes mellitus) as the main public health burdens for the population (Dirección General de Información en Salud 2015).

The Genomic Sovereignty Act

International collaborative studies on genomics in Mexican populations are regulated by the Title 5th Bis (Articles 103 Bis) of the General Health Act enacted on November 16, 2011 (Ley General de Salud, Mexico, updated 2015a) (Table 1). These amendments are known as the Genomic Sovereignty Act. This law establishes that (1) the human genome is both individual and human heritage; (2) personal discrimination based on genetic information is not permitted; (3) participants have the right to safeguard their right to be informed of the results and consequences of a genetic study; (4) genetic information must be preserved in a confidential manner; (5) human genome research and developments must be regulated to assure that the medical and economic benefits derived from this knowledge warrant health protection and respect the human rights, the freedom and the dignity of the individual; and (6) research on human genomics remain under a federal regulatory framework to protect the genomic patrimony. Possibly, the last article of this Act was enacted to protect the Mexican’s human genome from neo-colonialist adventures (biopiracy), as referred by some scholars (Benjamin 2009; Schwartz-Marín and Arellano-Méndez 2012; Schwartz-Marín and Restrepo 2013; Siqueiros-García et al. 2013).

Table 1 Acts and laws related to genomic research and data protection in Mexico
Full size table

Articles 317 Bis and 317 Bis 1 of the General Health Act (1) establish that the collection and exportation of samples and tissues as sources of DNA to conduct population genetic studies must be approved by a national institution of scientific research (Article 100); (2) require a permission of the Federal Commission for the Protection against Sanitary Risk (COFEPRIS) of the Mexican Health Secretariat (Article 375); (3) a registry of these studies must be maintained by the National Institute of Genomic Medicine (INMEGEN); and that (4) the genetic material cannot be used for purposes different than those established in the authorized protocol. Mechanisms of law enforcement are omitted in the Act.

The definition of “genetic populations studies” used in this law deserves special attention. This is defined as “a study aimed at analysing one or more genetic markers in unrelated subjects that describe the genomic structure of a particular population, identify an ethnic group or identified genes associated with a trait, disease or response to drugs” (Ley General de Salud, Mexico, updated 2015b). This ambiguous description is a working definition to decide on the issue of sample exportation for DNA analysis. The sanctions for infringing the law protecting the movement of human DNA out of the country are defined in Article 461: imprisonment from 4 to 15 years and a fine equivalent of 300 to 700 days of the minimum wage. In addition, if the delinquent is a health care professional, technician or assistant, their rights to exercise their profession or work may be suspended for up to 7 years (Ley General de Salud, Mexico. Updated 2015c).

This legislation has some positive assertions, particularly those concerning the protection of the confidentiality of the genetic information and the statements encouraging the genomics scientific and technological developments in Mexico. However, there is no statute in the law to cover flow of genomic data outside the country, and law enforcement mechanisms for protection of genome confidentiality are not considered. As illustrated, the Act emphasizes exportation of DNA samples or its sources, but it does not contemplate any regulation on the protection of the genetic information stored in electronic formats derived from human DNA sequences. This situation may create bioethical problems. For instance, this law would be out of scope, if a Mexican laboratory conducts population genotyping studies and sends the data in electronic format to a foreign pharmaceutical company interested in developing a medicine for a particular community (even if the lab safeguards the non-genomic personal information properly). A national law that does not give the required importance to the preservation of the confidentiality, including electronic data sets, is an incomplete and flawed law and may allow violation of genomic sovereignty.

The INMEGEN and the Genomic Sovereignty Act

Enormous financial and political efforts of the Government and private consortia enabled the creation and operation of the INMEGEN in Mexico. The institute is aimed mainly at the development of projects based on the genome of the Mexican communities and the implementation of its public health and medical applications. Many of the arguments to justify its creation were constructed on the controversial concept of the Mexican “race”, as a unique ethnic premise resulting from the historic population admixture (Benjamin 2009; Schwartz-Marín and Arellano-Méndez 2012). Mexican policymakers were greatly attracted by this concept, particularly for its nationalistic character, and for the proponent’s promises that the products of a Mexican Genome Project would booster the national bio-economy, a promise that remains unproven (Oliva-Sánchez et al. 2013). The founding consortium of this institute was an important driver of the Genomic Sovereignty Act (Jiménez-Sánchez 2003; Taylor-Alexander and Schwartz-Marín 2013) and supported the concept of “population genetics” as enunciated in the same Act.

Genomic data protection

Currently, several national laboratories generate electronic data based on the genome of diverse Mexican communities, bypassing the needs to export biological samples. Several international laboratories analyse samples of Mexican immigrant settlers, like those living in California or Texas (Benjamin 2009), and their data cannot be protected by the Mexican agencies. It is also expected that next-generation sequencing instruments, recently approved for clinical diagnosis by the FDA (Collins and Hamburg 2013), will be imported and will enhance the sequencing capabilities to produce vast amount of data in the country. It can be expected that these data may run out of the legal control, challenging the data protection efforts, as has been pointed out by researchers involved in the Human Heredity and Health in Africa (H3Africa) Initiative (Wright et al. 2013). Tendencies like this have been observed already, particularly involving genotyping services for direct-to-consumer testing (Patch et al. 2009), a growing business in Mexico.

In any case, it is important to state that the genomic information generated is very complex and the development of this research field relies on the education of local bioinformaticians and international cooperation to accomplish the pledged benefits of the “omics” sciences for public health and health care. At the same time that these benefits are generated, a new kind of menaces, concerning the illegal identification of individuals or populations involved in genomic studies, for blackmail or other delinquent purposes, are arising. These threats generate genuine public concerns. For this reason, national and international consortia of informatics regulatory agencies and companies are struggling to develop instruments and mechanisms to encrypt genomic information and assure the confidentiality of the shared data sets. Many of these consortia are currently responsible of the success of ongoing international cooperation efforts aimed at establishing correlations among genetic variants and disease phenotypes. As mentioned above, modern “genome sovereignty laws” should reconcile confidentiality protection with the needs for international data exchange for local development of the human genomics.

At first glance, it may look that the legal weaknesses in the genome Sovereignty Act regarding confidentiality, the lack of effective mechanisms for genomic data protection and the unclear working definition of “population genetics” do not hamper the efforts of Mexican researchers for engaging into international collaborations, but this requires attention. The first reason is that when demanding protection of personal data to foreign institutions or agencies, Mexican regulatory agencies should demonstrate the existence of laws protecting genome confidentiality and effective mechanisms to assure it. The second reason is that most likely, international regulatory agencies will require demonstration of reliable systems of genomic data protection to decide on grant awards or the participation of a local group in international research networks and consortia.

Protection of confidentiality in Mexico

The Federal Act of Transparency and Access to Public Information, enacted on June 11, 2002, recognizes the right of Mexican citizens to access public information, defines the protection of personal information and establishes exceptions and protection for this kind of information (Ley Federal de Transparencia y Acceso a la Información Pública Gubernamental, Mexico, updated 2014) (Table 1). The concept of personal data is defined in Article 3, fraction II, of this act as follows: “the information concerning a person, identified or identifiable, among others, related to his/her ethnic or racial origin, or that refers to his/her physical, moral or emotional characteristics, or to his/her affective and family life, his/her domicile, telephone number, patrimony, ideology and political views or religious or philosophical beliefs, his/her physical or mental state of health, sexual preferences, or other similarly affecting his/her privacy”. Article 4, fraction III, guarantees the protection of personal data in possession of its obligors. Article 18 of this law defines that confidential information is “the information delivered with such character by individuals to the obligors” and “the personal details requiring the consent of the individual to its dissemination, distribution or marketing” (obligors correspond mainly to some government officials and judicial personnel). Article 20, fraction I, establishes that personal data will be safeguarded and monitored by the Federal Institute of Access to Information and Data Protection (IFAI), and Article 37, fraction IX, establishes that the IFAI will establish guidelines and policies for the management, maintenance, security and protection of personal data which are in the possession of Government agencies and entities. The law does not establish clear mechanisms or technological means to preserve the information, particularly electronic information like data sets (the form in which genomic data are recorded and stored), or that the genetic information will be protected and preserved by an autonomous instance or similar, such as a particular agency of the Secretariat of Health. As da Cunha-Lopes pointed out, this law does not explicitly consider the protection of genetic information, although this legal vacuum could be saved by arguing that this is implied in Article 4, mentioned above, which guarantees the protection of personal data as defined in Article 3, fraction II. It is also implied in the General Health Act, which recognizes the principle of confidentiality, and in Article 16 of the Political Constitution of Mexico, which that establishes the right to privacy (Table 1). Compared with the state of the art of personal data protection in developed countries such as the USA, the European Union or Japan, protection of genetic/genomic information is vague in Mexico (da Cunha-Lopes and López-Ramírez 2010).

In addition to the apparent lack of laws to protect individual genetic information, another important deficiency in the Mexican administration is the lack of policies and systems for the safe storage and administration of such personal information, which, as mentioned above, has special features that may entail significant risks to the person in case of misuse. At a first glance, the IFAI looks as the appropriate agency to conduct and administrate these tasks. The central management of this information by the government involves many risks, as the potential for direct malicious use. Additionally, the government’s administration system in their daily work generates crossflows of information that can reach potentially unforeseen instances that may instigate erroneous use of this data, such as persecutory enforcement agencies, employment services or insurance companies, among others. Nonetheless, the implementation of these policies and systems should result from legislation on protection of genetic information that has not been considered yet.

Advances in genetic data protection around the world

As previously mentioned, genetic information should be effectively protected because it not only concerns the privacy of the individual regarding health status, but it may also provide information about his/her kin or ethnic community. Moreover, the controversy derived from the disclosure of the HeLa cell line genome revealed that genetic information might also affect future generations (Callaway 2013). HeLa is a cell line established from a cervical tumour of the US citizen Henrietta Lacks; her descendants questioned the release of her genomic information on grounds that the disclosed information belongs to the family and may harm their privacy.

Of more general concern is the fact that a sophisticated algorithm can link genomic information with personal information disclosed on online social platforms (social networks, direct-to-consumer services, genealogy websites, census, financial and health insurance data sets, etc.) to identify family-related individuals, with criminal purposes. There is also the risk that law enforcement agencies use genetic information obtained from a detainee during the process of the judicial investigation, to affect one of their family members or relatives. The feasibility to identify research participants by using published research data and genealogy websites has been demonstrated (Gymrek et al. 2013; Telenti et al. 2014). Issues like those presented here may affect centres and laboratories of excellence in human genomics and should be prevented. International initiatives aimed at correlating clinical phenotypes with genome variants, screened by high-throughput technologies, are working to neutralize these informatics menaces by creating novel and sophisticated informatics resources that allow encrypting sets of clinical and genetic information and provide access to limited subsets of health and genomic information to physicians and researchers authorized to decrypt them, such as the Human Variome Project, the NIH ClinVar initiative, the Gene2Phen Consortium, the Global Alliance for Genetics and Health, etc. This challenge has attracted the attention of bioinformatics communities everywhere, which are trying to solve different technological issues to support the ethical conduction of genomic information transactions, like GenomePrivacy.org (https://genomeprivacy.org) (Telenti et al. 2014) and iDASH (http://idash.ucsd.edu) (Jiang et al. 2014).

There are sufficient regulatory frameworks and policies and technological progresses to assure confidentiality to support the ethical exchange of genomics and clinical data and contribute to the scientific understanding of the intricate relationships between genes and environment. Despite these progresses, cultural contexts define how each national government defines the rules and policies when confronting major global scientific and technological developments, like human genomics, that inevitably will reach their societies. This has been exemplified by Kuo (2011) regarding the implementation and outcomes of the national biobanks and human genome projects of Japan and Taiwan, both grounded in nationalistic visions, aimed at developing pharmacogenomics to protect their pharmaceutical industry and control clinical trials in favour of their communities.

Séguin et al. (2008) describe how large-scale human genotyping initiatives in emerging economies like Mexico, India and Thailand arise from combinations of political will, institutional leadership, prospects in public health, genomic sovereignty and the desire to boost a knowledge-based economy, which taken together, differentiate these scientific programmes from the ones pursued in developed countries (Séguin et al. 2008; Benjamin 2009). Kuo also illustrates how important sociopolitical issues are involved in the development of national genomics programs: while Japan’s genomics agenda were fitted to the national regulatory norms for clinical trials, and were effectively supported by the government, the Taiwanese programme was affected by difficulties to obtain the approval of the Academia Sinica’s Institutional Reviewing Board (IRB), due to unsolved ethical and political concerns. Social and political issues affect the creation and adoption of the bioethical guarantees required for the harmonized development of human genomic research and have a direct effect on the regulatory policies aimed at protecting privacy and confidentiality, while facilitating the crucial exchange of scientific information.

Conclusions and recommendations

The first conclusion is that the Mexican Genome Sovereignty Act fails to protect confidentiality in an effective manner, because it is inaccurate regarding protection of the genomic privacy. Current law is mainly aimed at controlling the exportation of biological samples as sources of genetic material, but little or no attention is given to the exit of genomic data in electronic formats outside of the country. This not only compromises confidentiality but is also potentially detrimental to the protection of the intellectual property based on genomic research.

Part of the deficiencies in the Act derived from flaws in how the Personal Data Protection Act that supports the General Health Act, which does not consider the protection of genomic information as a human right. Mexican laboratories involved in human genomics must abide to the Genomic Sovereignty Act, but, as any law, this act is susceptible to amendments and may evolve to adapt to technological changes, the demands of scientific development and the modern challenges involving the protection of personal data, with particular emphasis on electronic data sets.

In addition to future law amendments, further actions are required to implement information technologies to protect genomic data, educate and train health care professionals and researchers in electronic data management, and implement encryption techniques. These tasks may be conducted by the IFAI, as designated by law; no new agencies are necessary to take on these responsibilities.

Another pending task, in which there is little progress, is to educate and empower the general community about the facts and potential of the human genome, the particular features of genetic information and its social and legal implications, potential benefits that may be derived from genomic research for health care and the inherent risks derived from the loss of privacy regarding genetic information.

The final conclusion is that any modifications to the Act must reconcile the personal data protection with the growing demands from the public and private laboratories to share information with foreign genomic research groups and bioinformaticians, not only to meet the needs for clinical diagnosis but also to develop fields like pharmacogenomics and knowledge-based economy. These modifications should allow less bureaucratic legal procedures, in order to facilitate scientific data exchange. It is also crucial to implement policies and systems to monitor storage and flow of personal genomic information.