Databases with patient health information have been used for a long time and have not been considered to create any problems. Databases have been used in various ways such as for quality control and research and health authorities have for some time used databases for citizen health information. It is important for example for the authorities to have information on infectious diseases that may cause much distress in society. Each database has a delimited and defined purpose even though in many cases they contain a large amount of information. Institutions have been established to issue licenses for databases (Data Commissions) and to ensure that the data is correctly used (Ethical Committees). Their use has not however been much discussed in open forums in recent years.

Iceland has a long tradition for the use of databases with health information as in other Western societies and they have not been questioned. The public has been confident that their information is used correctly and has been given no reason to think otherwise. Institutions have been set up to control them like in other countries and apparently the control has been effective.

In the spring of 1998 a bill was introduced for a central health sector database. It stipulated that all health information produced in the communication of physicians with all the country's patients be entered in a single database. It was also planned that all other health information created in health institutions be transferred to the database. At the same time it was introduced that this large database would be in charge of a private company that would have an exclusive right for the use of this information for a long time. Nothing was known of this plan until the bill was ready for parliamentary debate so that there had been no discussion among physicians, scientists, politicians or among the general public. It was as if a bomb had been thrown into the small Icelandic society and what followed was a great and heated debate which was to a large extent concerned with ethics and citizens' rights. Due to the criticism that emerged the bill was withdrawn from parliament in the spring session in spite of the fact that it was a government bill with a sizable majority in the sitting parliament. The bill was presented again in the autumn with some alterations and passed as legislation in December of 1998. A year later an agreement was made with DeCode Genetics concerning the operations of the database and the company got a 12 year exclusive right of operation. It has however proved very complicated to establish the database and it is still not ready.

Why were the company and the government so interested in the case and which issues were most debated? The idea was to gather as much information on the health of one nation as possible and then use data mining without a predetermined hypothesis to find connections between different sources of information in a manner that would not otherwise be possible. What made the database particularly valuable were possibilities to connect it to a database with genealogical information on all Icelanders. Today the genealogical database contains the names and genealogy of 680,000 Icelanders of the approximately one million that have lived in the past 1100 years. In addition the company had gathered genetic information with blood samples from tens of thousands of inhabitants which were possible to connect to the health information.

One reason why the idea was criticised so strongly and the debate became so heated was the speed with which the case was to be dealt with. Physicians and scientists were given no opportunity to discuss the issue before it was presented to parliament and a short time given for discussion there. There was also limited information on many important points such as which information was to be entered in the database, how far back in time information was to be sought, how it was to be used and where lay the great estimated cost (one hundred million pounds sterling). Issues of patient rights and whether others should be able to use the database were also debated.

The law stipulates that all information be entered into the database except from those patients who provide a written statement that they do not want it (presumed consent). This means in fact that only those who are most concerned about the issue will have such an initiative. Parents have the authority on behalf of their children but no one can oppose on behalf of the deceased. There is already before the courts a case of a young woman who does not want information on her deceased father to be entered in the database. The case was lost in a lower court and is now before the Supreme Court. It is expected that other issues will be tried before the courts. Most patients with mental illness and senility have a legal capacity and no one can oppose on their behalf. From the outset the Icelandic Medical Association (IcMA) took part in the discussion and has lead the criticism. Soon the main emphasis was placed on the issue of consent, i.e. that each individual be asked his opinion (informed consent) but other issues were considered as well. In this effort the association has sought the opinion of various parties domestically and abroad, among others on the issue of security. For this reason the association engaged in major disputes with Icelandic health authorities and DeCode: Soon it became clear that the ministry and the ruling parties did not mean to make any changes to legislation or the following regulation but DeCode was willing to reach a joint ethical vision of the database and talks began. Progress was slow with periods of no talks but last year an agreement was reached. The IcMA and DeCode agreed on two major points relating to deleting data already entered and that the database abide by the statement on health sector databases to be agreed by the World Medical Association (WMA).

Why is it necessary to relate in such detail a discussion in one of the world's smallest societies and how does it concern other societies? The answer is mainly that the IcMA soon presented its views abroad, both to the Nordic medical associations and within the WMA. This has lead the WMA to deal specially with the ethics of databases, as the ethics of medical science has been one of the association's main tasks from the beginning. Thereby the issue of databases with health information has become the issue of all medical associations within the WMA. A workgroup was appointed in 2000 to work on a declaration in this field to be presented at the association's annual meeting in the autumn of 2002. It is hoped that the declaration will be agreed on as the policy of the WMA marking the course in that field for years to come.

The WMA has mostly completed its work on the declaration and it will contain certain basic principles. Most of them are to be found in the association's earlier statements such as the Declaration of Lisbon on the Rights of the Patient, the Declaration of Geneva (International Code of Medical Ethics) and the Declaration of Helsinki (Recommendations Guiding Physicians in Biomedical Research Involving Human Subjects). The main points regarding patients' rights are:

1. The right to be informed. Patients should be informed if information on them is to be made available to a third party. This information should be provided even in instances when the patient cannot oppose the use of his health information.

2. A person's right to oppose the use of that information. There will be a general rule that a patient can oppose the transfer of information on him to an indicated database and only in exceptional cases will he be unable to oppose.

3. The right to consent. Only in exceptional cases would information be transferred to a health database without seeking consent.

4. The right to confidentiality. A patient should be able to trust that his physician will not give to others information that the patient gives him in order to be cured of his ills.

5. The right to deletion of data. Should the patient change his mind he should be able to demand that his data be deleted if technically possible.

One of the difficult issues to solve is that patients' rights regarding the use of health information does not go against the interest of all. In some instances it is not difficult to support the interest of all, like health authorities must be able to monitor infectious diseases that pose a risk to public health such as tuberculosis and HIV infection. Databases on cancer have been used for a long time in some countries without them being questioned. Should patients have the right to oppose a transfer of information on their cancer to such a cancer register? There is a widespread use of databases to measure the success of a treatment in order to increase it (quality control) and in order for them to be useful it is important that information on every patient be registered. In none of these instances can it be asserted that patients providing information gain directly from the registration and it differs how easily one can argue for the interest of all even though it may apply in these examples. The case is different for databases that are only used for research. There seems to be agreement that each patient should be able to decide whether his information be transferred to a database used for research, such as when patients participate directly in research, as stated in the Declaration of Helsinki. This leaves two issues to be solved. What about existing databases with information gathered within the health system and which are only to be used for research but where patients were not asked their opinion? What is to be done about all composed databases, such as those who are set up for one purpose (e.g. quality control) but are then used for other purposes such as research? Many of these points have not been fully discussed but WMA and are yet to be resolved.

It is said that in the modern information society the key to power is information. Could it be that the same applies to health information? There are arguments to support this. If a database contains information that can be used to produce sellable material, such as medicine or a new type of treatment, the owner of that information can gain financially and even have power to control the progress of knowledge. It is therefore important to set up a framework for the ownership, use and access to databases to prevent abuse. At the same time the individual's right to control the use of information about him must be ensured. One of the key questions that has to be asked is whether they should have the same right if the data cannot be personalised. The European Union standard of personalisation has been quoted in this respect, where it is indicated that if it takes a considerable amount of capital and manpower to personalise information it shall be considered 'unpersonalisable'. It has been pointed out that technology progresses fast and sufficient safety today may not be sufficient tomorrow. It is a subject of politics to decide whether exclusive licenses for extensive databases with health information should be granted to companies that are run for profit, but in market driven societies it is likely to be supported. When setting up databases that are as extensive for a whole nation as is intended in Iceland the access of others to such data bases must also be guaranteed, both health authorities as other scientists.

The expected WMA declaration will have great influence on the progress of this cause in international context and its initiative on the issue is important. The WMA must carry on the experience of the countries that are first to come across this ethical problem to those that have yet to take it on. In the years to come the discussion will develop and the rules applying today will be altered along with new technologies and new attitudes.