privacy data-protection consent identification
Would it be legal to sequence human DNA from wastewater?
<h3>DNA can Identify Individuals</h3>
<p>I have asked <a href="https://biology.stackexchange.com/questions/101455/would-it-be-possible-to-sequence-human-dna-from-wastewater-treatment-plants">this question</a> in the biology stackexchange. Below the law part:</p>
<blockquote>
<p>I know that there are some efforts from scientists working with bladder cancer to perform  liquid biopsy from urine for detection and monitoring of the cancer such as <a href="https://pubmed.ncbi.nlm.nih.gov/31803629/" rel="nofollow noreferrer">this one</a>.
I've been searching online - but the &quot;wastewater&quot; search term gives me tons of hits about &quot;microbiome&quot; and several types of pathogens.
However, I am really interested in sequencing the sewage to find and analyze <strong>human DNA</strong>. I have been wondering about liquid biopsies to get an estimate of the cancer status of a population.</p>
<p>I can immediately think of several problems:</p>
<h3>Laws and Ethics</h3>
<ol>
<li>Is it legal in the US or European Union?
<ul>
<li>It could be difficult to get informed consent of all people who are connected to a certain sewage system. You may get informed consent from all residents but what about visitors?</li>
<li>It could be difficult to opt out of such study the
wastewater without a) moving to a different place b) using a septic tank.</li>
<li>I only found <a href="https://massivesci.com/articles/wastewater-environment-disease-epidemiology-covid19-privacy/" rel="nofollow noreferrer">this</a> elaborating <strong>other</strong> privacy issues: its just about Cov-19 and drug testing; both of which are <strong>not</strong> able to identify individuals at a genomic level.</li>
</ul>
</li>
</ol>
</blockquote>
<p>An additional question:</p>
<ol>
<li>Could a sewage provider offer service to people only if they consent that their DNA present in the sewage will be monitored? Such as airline and other companies will only offer their service to people who consent to their terms of service.</li>
</ol>
<p>The biologists have referred me to the law stack exchange for the first part of the question.</p>
<ol start="2">
<li>Given the laws in a) US or b) EU would I even be required to get informed consent?</li>
</ol>
<p>I am <strong>NOT</strong> looking for answers regarding drug testing or microbiome data!</p>
<p>Thanks for sharing your <strong>references</strong> and expertise with me.</p>

<p>I assume US as the jurisdiction, and don't purport to have checked all 50 states for laws deviating from federal law. The question is not clear as to what exactly is being done (something that has a reasonable relation to &quot;consent&quot;), so to be concrete, I assume the proposal is to take samples from waste water and analyze cells for the presence of a specific genetic property. I also adopt the convenient fiction that from that cell, one can extract information that allows an absolute match between the sample and an individual (or set of individuals in the case of identical twins), if you have a sample from the individual.</p>
<p>Consent would be required to draw a blood sample or take a saliva or skin sample from the individual. Otherwise, collecting the sample is assault. No consent is required to pick up a cup that a person has used and discarded (it would be assault to grab the cup from them). &quot;Informed&quot; consent is special kind of consent applicable to medical care, and reduces to the requirement that the medical care provider explain the risks and benefits, so that the individual will agree to undertake some action (let them cut into you, prod you, give you drugs). None of those considerations exists in the proposed experiment.</p>
<p>HIPAA imposes a requirement of maintaining privacy w.r.t. health information, mainly via the <a href="https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/combined/hipaa-simplification-201303.pdf" rel="nofollow noreferrer">Privacy Rule</a>. A clear application of the rule is that if a patient is diagnosed with cancer, the health care provider cannot publicly disclose the patient's name and diagnosis. If the record is anonymized, the diagnosis can be disclosed. (The full information can also be &quot;shared&quot; between parties with a statutorily-defined interest in the record, e.g. the insurance company). An important limit on HIPAA is that it does not apply to everybody, it only applies to &quot;covered entities&quot;, and is limited to healthcare providers, healthcare clearinghouses, and health plans. Genetic researchers are not healthcare providers, so they are not covered entities, so they are not subject to HIPAA.</p>
<p>There is also what is known as <a href="https://www.hhs.gov/ohrp/regulations-and-policy/regulations/common-rule/index.html" rel="nofollow noreferrer">&quot;The Common Rule&quot;</a>, which is a restriction on what you can do in research if you receive federal funds. Let us assume that the research is federally funded. <a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=691e3626df2ba602bca49f492d3a2527&amp;mc=true&amp;tpl=/ecfrbrowse/Title45/45cfr46_main_02.tpl" rel="nofollow noreferrer">§46.102</a> defines a &quot;human subject&quot; in subsection (e), which is very long. The core of the definition is that the researcher</p>
<blockquote>
<p>(i) Obtains information or biospecimens through intervention or
interaction with the individual, and uses, studies, or analyzes the
information or biospecimens; or</p>
<p>(ii) Obtains, uses, studies, analyzes, or generates identifiable
private information or identifiable biospecimens</p>
</blockquote>
<p>(i) is not applicable: the question is whether the cell is &quot;identifiable private information or identifiable biospecimens&quot;</p>
<p>We move on down the definition to learn that</p>
<blockquote>
<p>Identifiable private information is private information for which the
identity of the subject is or may readily be ascertained by the
investigator or associated with the information.</p>
</blockquote>
<p>and that</p>
<blockquote>
<p>An identifiable biospecimen is a biospecimen for which the identity of
the subject is or may readily be ascertained by the investigator or
associated with the biospecimen.</p>
</blockquote>
<p>An individual is not, in the general case, <em>readily</em> identifiable from their DNA, even if <em>theoretically</em> you could identify an individual by taking DNA samples from everybody and matching to the water sample. This research is not human subjects research, so the rule is irrelevant.</p>
<p>The regulation doesn't say what &quot;readily identifiable&quot; means, so of course technol9ogy or circumstances could change and this planned research could <em>become</em> human subject's research. In the universe in which that happens, it simply complicates the process. Then the researcher must submit the proposal to their IRB, which will check that the protocol protects the anonymity of the &quot;subject&quot;. That would probably preclude publishing the specific information plus the full whole genome sequence. Here, we would have to engage in wild speculation as to how having an anonymous DNA sample makes identification &quot;readily available&quot;.</p>
<p>Of course if Congress rewrites the law to include &quot;imaginably identifiable&quot;, that changes everything.</p>
