International and Economic Issues

There is also an economic point that the people of Iceland ought to consider. The future prosperity of Iceland, as of every country, is tied up to some extent with the information economy. For this reason, it would not be prudent to do anything that is seen as a grave breach of the letter (or even the spirit) of European data protection law. Even though governments can in theory grant exemptions to this law on the grounds of national interest, such exemptions are designed for police and national intelligence purposes. But transferring the medical records of non-consenting patients to a private company, which will sell access to them to clients who are outside the European Union, will be seen as outrageous. I quote a statement made about the DeCODE proposals by the Data Protection Commissioners of the EU and EES countries made in Santiago de Compostela in September 1998 at the 20th International Conference on Data Protection:

`(The Commissioners) stress the importance of the following elements:

• the principle of free and informed consent of the person concerned to the storage and further processing of his or her data must be fully respected. The data subject must also be given the right to withdraw from the base once his or her data have been entered. Exemption from these principles would only be acceptable for exceptional reasons and with adequate safeguards for the correct use of the data.

• the definition of "personal data" must be explicitly clear and the method of securing anonymity must be effective. In a country with a relatively small population, information or genetics is likely to indicate biological lineage and to reveal identities of persons concerned. The use of a code to replace identifiers is in any case not sufficient to secure anonymity.

• the commercial interests of the user must not lead to expansion of the original purpose of the register.

They express their serious concern about the matter and recommend the Icelandic authorities to reconsider the project in the light of the fundamental principles laid down in the European Convention on Human Rights, the Council of Europe Convention 108 on Data Protection and Recommendation (97)5 on medical data, and the EC Directive 95/46 on the protection of personal data.'