Data privacy in human microbiome sequencing

Introduction

Human microbiome sequencing involves analysing the genetic material of microorganisms living in and on the human body, including bacteria, viruses, fungi and other microorganisms. These microorganisms are commonly found in the digestive system, skin, mouth and respiratory tract. Microbiome research helps scientists understand human health, immunity, metabolism, infectious diseases and the development of personalised medical treatments.

However, microbiome sequencing generates sensitive biological information that may reveal details about an individual's health conditions, dietary habits, lifestyle, environmental exposure and certain medical risks. When microbiome datasets are combined with genetic information or other personal records, they may create additional possibilities for identifying individuals.

Therefore, protecting privacy during microbiome sequencing is essential for maintaining confidentiality, obtaining informed consent and preventing unauthorised use of biological information.

Legal framework in India

1. Digital personal data protection act, 2023

The Digital Personal Data Protection Act, 2023, establishes India's legal framework for processing digital personal data.

Section 4 provides that personal data may be processed for a lawful purpose in accordance with the Act. Section 6 addresses consent, while Section 8 establishes obligations of data fiduciaries concerning compliance and security safeguards.

Microbiome sequencing records may constitute personal data when they relate to an identifiable individual. Although the Act does not separately classify microbiome information as a special category of sensitive personal data, identifiable microbiome records can still receive protection under its general framework.

Researchers must ensure that personal information is processed lawfully and that participants receive appropriate information about the research purpose.

2. Information technology act, 2000

The Information Technology Act, 2000, provides a legal framework for electronic records, cybersecurity and confidentiality.

Section 43 addresses unauthorised access and damage to computer systems. Section 66 covers specified computer-related offences, while Section 72 concerns breach of confidentiality and privacy by persons obtaining access through powers conferred under the Act.

These provisions may become relevant when microbiome sequencing databases are accessed, modified or disclosed without proper authorisation.

3. National ethical guidelines for biomedical and health research

The Indian Council of Medical Research (ICMR) issued the National Ethical Guidelines for Biomedical and Health Research Involving Human Participants in 2017.

These guidelines establish ethical requirements concerning informed consent, privacy, confidentiality, biological sample collection and research involving human participants.

They are particularly relevant to microbiome research because biological samples may contain information that participants did not initially expect researchers to investigate.

4. Biological diversity act, 2002

The Biological Diversity Act, 2002, regulates access to biological resources and associated traditional knowledge within its statutory framework.

Microbiome research involving biological resources may require consideration of applicable access, benefit-sharing and regulatory provisions. However, the Act does not automatically apply to every human microbiome sequencing project merely because microorganisms are studied.

Major privacy concerns in microbiome sequencing

1. Identification through biological information

Microbiome datasets may contain distinctive microbial patterns associated with individuals. When combined with other datasets, these patterns may increase the possibility of identification.

Consequently, removing names and contact details does not necessarily make a microbiome dataset anonymous.

2. Disclosure of health information

Microbiome analysis may reveal associations with digestive disorders, infections, metabolic conditions and other health-related characteristics.

Unauthorised disclosure may expose individuals to discrimination, social stigma or misuse of personal information.

3. Informed consent

Participants should understand the purpose of microbiome sequencing, the nature of collected samples, possible secondary research uses and data-sharing arrangements.

Consent procedures should also explain whether samples or sequencing records may be shared with commercial organisations or international research institutions.

4. Secondary use of research data

Researchers may wish to reuse microbiome datasets for future studies. Such reuse must comply with the original consent conditions, applicable legal requirements and relevant ethical approvals.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 of the Constitution.

The judgment recognised informational privacy and established that interference with privacy must satisfy constitutional requirements, including legality, legitimate purpose and proportionality.

Relevance: Human microbiome sequencing may generate identifiable health-related information. Researchers must therefore respect individual privacy and establish appropriate safeguards when collecting, processing and sharing microbiome datasets.

2. Samira Kohli v. Dr. Prabha Manchanda (2008)

The Supreme Court examined informed consent in medical treatment and explained that consent must be voluntary and based on adequate information.

Relevance: Microbiome research involving human participants requires meaningful consent. Participants should receive understandable information about sample collection, sequencing procedures, research objectives and potential future uses.

3. Common Cause v. Union of India (2018)

The Supreme Court recognised the importance of individual autonomy and dignity in decisions concerning medical treatment and end-of-life care.

Relevance: The judgment supports the broader principle that individuals should retain meaningful control over important decisions concerning their bodies and medical information. This principle is relevant to consent and participation in microbiome research.

4. S and Marper v. United Kingdom (2008)

The European Court of Human Rights examined the retention of fingerprints and DNA profiles of individuals who had not been convicted of criminal offences.

The Court found that indiscriminate retention violated the right to respect for private life under Article 8 of the European Convention on Human Rights.

Relevance: Although the case concerned forensic DNA rather than microbiome sequencing, it demonstrates the privacy risks associated with retaining biological information without adequate justification or safeguards.

Privacy protection and compliance measures

Research institutions and sequencing laboratories should establish comprehensive data protection procedures.

Important measures include:

Obtain informed consent before collecting biological samples.

Replace direct identifiers with coded research identifiers.

Restrict access to sequencing databases.

Encrypt biological and clinical datasets.

Establish clear data retention and deletion policies.

Review permissions before secondary research use.

Assess risks before sharing information internationally.

Maintain records of sample collection, processing and disclosure.

Pseudonymization should not be confused with complete anonymization because additional information may still allow individuals to be identified.

Conclusion

Data privacy in human microbiome sequencing is essential for protecting individual autonomy, confidentiality and scientific research integrity. The Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and ICMR ethical guidelines provide important protections for research involving identifiable biological and health information. Judicial decisions such as Puttaswamy, Samira Kohli and S and Marper establish important principles concerning privacy, informed consent and the retention of biological information. Research institutions must therefore adopt transparent consent procedures, secure data storage, controlled information sharing and appropriate anonymization techniques to ensure responsible microbiome research.