A State-backed company that plans to collect the DNA of hundreds of thousands of Irish people is being probed by the Data Protection Commissioner, following complaints about the way it gathers information.
The DPC has confirmed to privacy campaigners that it has commenced a "widespread compliance and supervision" examination of how the company, Genomics Medicine Ireland, processes genetic data it has gathered from Irish people.
The new exercise follows months of engagement between the commissioner and the company, and extends to how data is being processed in some of the largest hospitals in the State.
In a letter from the commissioner's office to privacy group Digital Rights Ireland (DRI), which has been seen by The Irish Times, the DPC states the commissioner's office, "arising from the course of consultative engagement with Genomics Medicine Ireland, has commenced a widespread compliance and supervision exercise into the processing of personal data by GMI and its clinical research partners".
‘Statutory enforcement’
GMI, which counts the State's Ireland Strategic Investment Fund (ISIF) among its financial backers, has embarked on genetic research projects with several large hospitals. ISIF invested $70 million in the company last year.
While a full investigation has not begun, the letter states that “any information which the DPC receives in the course of this exercise may be used by the DPC in the context of a statutory enforcement process pursuant to applicable data protection legislation”.
If the DPC decides to investigate and sanction GMI, fines or other penalties could follow, including the deletion of data gathered by the company.
‘Necessary safeguards’
TJ McIntyre, chair of DRI, welcomed the development. “The DPC will be able to determine whether the necessary safeguards are in place and whether medics and researchers are complying fully with European and Irish law,” he said.
In a statement, GMI said that it was engaged in an ongoing dialogue with the DPC regarding supervisory and compliance matters. “We welcome any recommendations the DPC may have to ensure we maintain best-in-class compliance standards in a complex regulatory environment.”
GMI has plans to spend up to €800 million collecting DNA data from 400,000 Irish people. It has not confirmed publicly how far it has progressed towards this goal. However, it and its parent company have attracted criticism both here and abroad over data protection concerns, and its links to investors alleged to be connected to the Chinese government.
