Besides its high-profile partnership with Hoffman-La Roche, which could be worth more than $200 million, the startup is collaborating with Partners HealthCare of Boston to compare the results of population genomics in a relatively homogenous population (Iceland) with the results in a more heterogeneous one (Boston). Partners is conducting its own genomics studies on osteoarthritis, schizophrenia, asthma and narrowing of the arteries.

The Price of Privacy

Not everyone is thrilled about DeCode’s work, however. Opposition has been growing ever since the Icelandic Parliament, the oldest functioning parliament in the world, passed the Health Sector Database Act in 1998. The Act enabled the Ministry of Health to grant a license to create and operate a national database of medical records, and in January 2000 it awarded that license to DeCode.

Petur Hauksson is the psychiatrist who founded Mannvernd (an Icelandic word that means human protection), an organization formed to overturn the Health Sector Database Act. Hauksson says his countrymen haven’t been exploited to this degree since they broke free from Danish rule in 1944. To show one example, he points to what he sees as an unusual degree of collusion between DeCode and the Icelandic government. After all, it was Stefansson, DeCode’s CEO, who originally came up with the idea for the centralized database and supported legislation that established the database license.

"Many of my psychiatric patients and their relatives were very concerned about this from the beginning. They’re used to discrimination, and their health information is very sensitive," Hauksson says. "But I think all medical information is sensitive." Hauksson says people who become seriously ill or whose DNA may predict the likelihood of contracting some condition might also be discriminated against.

One of Mannvernd’s main complaints is that the Health Sector Database Act is based on the presumed consent of Icelandic citizens. Furthermore, Icelanders who consent to give blood for one of DeCode’s disease studies must agree to have their DNA used for other studies without knowing what those might be. Thanks to Mannvernd’s complaints, Icelanders can now opt out of having information entered into the database by filling out a form, and so far 20,000 of Iceland’s population of 280,000 have. Of course, if their information is already in the database, they don’t have the right to opt out.

But now Mannvernd has a new dragon to slay. Until March 2001, the medical data, blood samples and genealogical information DeCode has access to was sent first to the Icelandic government’s Data Protection Commission, where the personal identification numbers on them were encrypted and then sent on to DeCode. One or two government workers did the encryption, an iffy system that created some lag time. "It’s a definite security risk if a government worker has an encryption key in his wallet that he might lose," Gudbjartsson says.