[Personal identifiability in the Health Sector Database.]

Personal identifiability is a fundamental question in the debate about the Bill and Act on the Health Sector Database (HSD). If the data are personally identifiable, Iceland's international committments dictate that a priori consent be obtained from patients for the use of their health records data. The HSD Act presumes that one way encryption renders the data non-personally identifiable and that therefore an a priori consent is not required.

The history of the concept of personal identifiability during the debate on the HSD reveals changes made to the concept. In the first instance a reference was made to Recommendation R(97)5 of the Council of Europe Committee of Ministers which was changed by adopting a direct translation of the definition of personal data from the Directive 95/46/EC of the European Parliament and of the Council. These changes were made in response to the Data Protection Commission's opinion on the HSD Bill submitted to the Minister of Health that overturned the ideology previously used regarding indentifiability of persons. Information is identifiable if there exists a key and it makes no difference who holds the key. One way encryption was then adopted as a method that was supposed to mean that a key does not exist. Nevertheless, the database proponents now admit that a key exists. The making of keys for opening up the database is discussed. The database is a longitudinal collection and linkage of records on each individual and therefore the method of encryption must remain stable. Therefore, anyone with access to the method can easily make a lookup-table containing side by side the names and the personal numbers produced by the encryption. Although it may be hard to go from a personal number directly back to a name, given the table it always is possible to look up what personal number belongs to a certain person or what person stands behind a certain personal number. This is a key. If the method of encryption was lost or access to it was not available it would nevertheless be possible to make a key. The intention is to encrypt the genealogy of the entire nation using the same encryption method used for the HSD. The genealogy of the nation with names is also generally available. The patterns of family trees become unique when one family is connected to another through marriage and childbirth. A comparison of the encrypted genealogy containing personal numbers with the same genealogy containing names is therefore a method for making a key. Finally a key can be made from the context of general information. Even if the names were irreversibly removed there will be enough available bits of general information connected to a personal number to allow re-identification of the person in a large number of instances. This amounts to making a key.

The information in the Health Sector Database is personal information. Therefore it is both right and reasonable to obtain an a priori consent of patients for the transfer of their health data to the database as Iceland's international obligations stipulate. Anything less is unreasonable.