1. Introduction

In her path-breaking work Ostrom (1990, 2005) provides theoretical and empirical evidence suggesting that individuals often overcome the problem of collective action and arrange privately for the provision and allocation of public goods, including informal property rights. Ostrom has also found that local experimentation and self-governance often produce more effective results than rulemaking by the state. In his Coase Theorem, Coase (1960) arrives at a somewhat similar conclusion. Ostrom and Coase both recognize that high transaction costs can block private rule making. The new literature on institutions, however, has jettisoned the model of a benevolent welfare maximizing state. For instance, the state does not as a rule assign the license to create property rights to those who are most likely to provide efficient solutions. Still, private individuals often find various opportunities to supply their own informal rules and governance systems. In this paper, I examine recent evolution of property rights in Iceland’s national health records. My findings a) support the hypothesis that the demand for exclusive and well-defined property rights depends directly on the value of the assets in question; b) show that de facto property rights, which are the effective economic rights, can deviate from the corresponding de jure rights; c) demonstrate the relevance of the Coase–Ostrom insight concerning the role of private ordering; and d) provide evidence that competition between mental models can have a major role in the evolution of property rights.

Various circumstances can give private groups the opportunity to self-organize independently of the state. When wars and social unrest undermine state power, private actors and their organizations sometimes step in and provide an institutional framework of their own.1 Yet, the impact of declining state power on the security of property rights is beyond generalization because it depends on idiosyncratic factors such as the entry of Olson’s (2000) roving bandits or the prevalence of norms of cooperation (Hechter and Opp 2001). In peacetime, information costs and policy failures can create pockets of opportunity for self-governance. When public policy has failed, private actors and organizations are sometimes allowed to introduce private order to replace or complement formal rules. In other instances, government officials may be unaware that private rules have (partly) replaced public rules or they don’t care (Ellickson 1991). Finally, all states pay at least minimal attention to questions of efficiency and may encourage self-governance in areas where such arrangements are particularly effective.

In a well-known paper on the evolution of property rights, Demsetz (1967) argues that property rights in a resource become more exclusive and detailed when new technology or other developments raise its expected value. A large body of empirical work confirms that such tendencies toward greater exclusivity exist (Libecap 1989). Yet, the property rights saga is often more complex. Property rights are a combination of duties and claims that, in principle, involve three groups (Riker and Sened 1991). The rule maker, who represents the supply side along with the duty bearers, who are called on to honor the rights; and, finally, the right holders who are on the demand side. An increase in the value of a resource eventually increases the demand for exclusive rights by potential right holders, but the response by the rule maker and the duty bearers – the supply side – is uncertain. Moreover, our knowledge of society and nature is incomplete. Major changes in formal property rights usually involve conflicts over power and material resources but also competition among mental models and campaigns of persuasion (Eggertsson 2005). As I explain later, the competition among mental models involves both models of specific social technologies and general social beliefs and theories.

In this paper I examine a course of events originating in scientific discoveries in microbiology and genetics that increased the expected value of health records. My case involves the health records of Iceland, which has a public health system of long standing. When the story begins in the mid 1990s, the de facto ownership of Iceland’s health records is with the doctors and scientists, primarily those who collected the data. The informal ownership arrangements are reminiscent of communal ownership, but the property rights are vague, and there is little concern by either patients or medical scientists for the privacy rights of patients. Below, I refer to the informal or de facto owners of the records as the insiders. In the second half of the 1990s an outsider enters: a commercial genetics corporation, registered in Delaware, offers the government of Iceland to pay considerable sums of money for the right to collect and manage, in a central electronic database, all of Iceland’s current and past health records. The government agrees and introduces the necessary legislation in Parliament, but the prospective duty bearers, the insiders, organize fierce opposition. The paper examines the ensuing struggle, which involves attempts by both sides to influence both legislators and the general public. Although material interests weigh heavily, the struggle has a strong ideological component. Parliament passes the Health Sector Database Act but the insiders prevent its implementation. Yet, the genetics corporation becomes a world leader in its field of research by making a Coasean bargain with the insiders that implicitly recognizes their de facto rights of ownership.

2. The background

Since early in the 20th century, health workers in Iceland have systematically collected and stored information about their patients, using storage systems that range from files containing handwritten notes and memos by physicians to sophisticated electronic databases.2 The files contain general health records – the standard byproducts of healthcare activities – and also specialized information collected by enterprising medical professionals, such as the records of heart or cancer patients. Until the mid 1990s, the privacy of health records had low salience in Iceland. Scientists, who used personal medical data in their research, typically paid little attention to the privacy of their patients (although rarely abusing it), and neither did the patients show much interest in the matter. In 1998, the Ministry of Health submitted a bill concerning the use of human biological samples in research, which was enacted into law in May 2000 (Act on Biobanks, No. 110/2000).3 According to the law, scientists who collect human life samples, such as blood samples, must obtain informed written consent from the donors.4 Prior to the Biobanks Act of 2000, which does not cover the country’s health records, Iceland had no legislation governing the use of biological samples for scientific purposes. Since 1997, new laws and regulations have both clarified the privacy rights of patients and introduced or strengthened official regulatory agencies, especially the Data Protection Authority and the National Bioethics Committee. The new interest in privacy was in part stimulated by the struggle to control Iceland’s health records, which I discuss below.

The medical research establishment in Iceland, physicians, biochemists, biologists, and others, the insiders, includes a greater number of well-qualified and ambitious individuals than one might expect to find in a mini nation of about 300,000 inhabitants. Several Icelandic medical researchers are internally known for their work. It is the small size of the nation that paradoxically contributes to Iceland’s relatively large stock of high-grade human capital in the medical sciences (and other fields). Limited opportunities at home have compelled scholars to go abroad to major medical centers and universities for their graduate education and post-graduate work.

3. The entry

In the last part of the 20th century, new discoveries in molecular biology and genetics as well as new research instruments created hopes that revolutionary breakthroughs in the treatment of major diseases were immanent (Nelson 2008). Science appeared to be on the verge of discovering the genetic roots of diseases and finding ways to block the offending genes. Many scientists believed that the time interval between scientific discovery and practical application had shrunk, creating an opportunity to make substantial profits by combining basic research and marketable products (especially new drugs). One of these optimistic scholars was Kári Stefánsson, an Icelander who in the mid-1990s was professor of neurology, neuropathology, and neuroscience at Harvard University. With the help of colleagues, and aided by international venture capital Stefánsson set up a corporation registered in Delaware for the primary purpose of using Icelandic data to find the genetic causes of major diseases and their cures. He named the company Decode Genetics.5

Stefánsson and his colleagues believed that medical, biological, and genealogical resources in Iceland created an extraordinary opportunity for discovering the genetic sources of disease.6 First, the small nation has maintained national health records covering two or three generations, with some records going back even further. Second, the Icelanders possess extensive genealogical data, spanning 3–400 years for virtually the whole nation, in some instances extending back to the High Middle Ages.7 Third, the genetic structure of the population is relatively homogeneous and the Icelanders are closely interrelated.8 Finally, Stefánsson, who was born and brought up in Iceland, probably expected to find in his native country a relatively friendly regulatory environment and a cooperative government and public. With this in mind, Stefánsson and his colleagues concluded that the success of their project depended on setting up and operating a national electronic database containing Iceland’s health records. The health record database would then be linked to a DNA database, and a genealogical one.

4. Fighting over the control of Iceland’s health records

4.1. Introduction

In 1997 or thereabouts, Decode Genetics made an offer to the Icelandic government. The corporation was ready, at its own expense (plus paying a hefty license fee), to build and operate a national health sector database. The administrators of the public health system would have ready access to the HSD, as well as other scientists, unless they were in direct competition with Decode’s research projects.9 In 1997–1998, the idea of a health sector database was not new. In Iceland the discussion about a HSD goes back to 1975 when health administrators, physicians, and scientists had recommended that the government build a central medical database that would serve as a valuable tool for administering the national health system, improving health care, and conducting medical research.10 In 1975, the government was unwilling to bear the high cost of such a project, but about 20 years later the authorities quickly accepted the offer from Decode Genetics, and, in the spring of 1998 introduced a bill in parliament that eventually became the Database Act of 17th December 1998. The Act authorizes a licensee to build and operate a centralized health sector database, initially for a period of 12 years. Decode Genetics, which was the only applicant, was given the license.

Decode’s offer, and the government’s favorable response infuriated many insiders – members of the local medical research establishment – as well as several high-profile intellectuals, and other individuals. In the initial stage of the game, the insiders’ obvious strategy was to influence the cabinet, administrators of the health system, and members of Parliament, either directly through persuasion or indirectly by shaping public opinion. The ideal solution would be to kill the Bill, but a second line of defense was to undermine the licensee’s control of the health records and raise its costs of transacting. In their campaign against the HSD Bill, the opponents gave special weight to two issues: the monopolization of science in Iceland, and the threat to patient privacy. The first issue reflected the insiders’ true concerns; the second issue was (primarily) a tool for turning public opinion against Decode Genetics.

The insiders faced a formidable entrant: a well-funded US corporation that in the near future was likely to dominate genetic and possibly other medical research in Iceland. The firm’s scientific human capital was huge relative to the comparable manpower stock in Iceland. As of December 31, 2003, when the HSD furor had mostly quieted down, “deCODE and all of its subsidiaries employed 414 full-time staff. Of the total number of Decode employees at the end of 2003, approximately 109 were located in the USA, and 305 in Iceland. More than 90 held PhD or MD degrees and approximately 250 held college degrees.”11 Iceland has several small colleges but only the University of Iceland has full-scale engineering and natural science faculties. In 2003, the total full-time faculty in all fields at the University of Iceland numbered 420.12

Theoretically, the commercial giant could in an important way restrict the insiders’ access to the proposed database. Although the Database Act promises the insiders free access to the health records, it is on condition that their projects do not directly conflict with the research projects of the licensee. The law specifies that an access committee of three members, one appointed by Decode, be in charge of controlling the insiders’ use of the HSD. At the time, many experts at home and abroad expected that Iceland’s health, DNA, and genetics data would in the near future yield fame and fortune.13 The proposed HSD access rules appeared to exclude the insiders from sharing the trophy, either acting alone, or, more likely, with major foreign partners.14 At the emotional level, the thought that a foreign corporation might earn huge profits by using data that the insiders, themselves, had originally collected made many local scientists and physicians furious. The international publicity surrounding Decode and the HSD also shrank the relative status of important insiders. These considerations seemed to outweigh potential positive effects, including synergy, critical mass and opportunities for cooperating with Decode. The eventual demise of the HSD project suggests that neither the right holders nor the rule maker anticipated the furor of the expected duty-bearers.

The second major issue in the debate surrounding Decode’s entry is the rights of patients to privacy. The critics claimed that an opportunistic licensee would be able to misuse personal information and impose serious damage on members of the public. Of course, the rights of patients are of major importance, but I argue below that the struggle over Iceland’s health records fundamentally did not involve the patients and their rights.

By mid-1998, the insiders must have realized that the government strongly supported the HSD proposal. The critics had no hope of killing the HSD Bill, but a better chance of modifying the legislation and later thwarting its implementation. Accordingly, the opponents’ second line of defense focused on raising the transaction costs of assembling and running the database. Three obvious ways of raising the licensee’s costs are: a) rules that require costly authorization from all patients before their records are entered into the database, and again when the data are used in a new project; b) requirements that the standards for encrypting the data be fail-safe (and therefore unachievable); c) collective disobedience by the insiders when they are asked to transfer their records to the HSD. As we see below, the second line of defense held, and the HSD project was abandoned.15

4.2. The HSD Bill: Transaction costs and methods for obtaining consent from patients

The transaction costs of assembling a national health sector database and using the data in a variety of scientific studies are strongly influenced by the methods the licensee uses to obtain consent from the patients. The Icelandic Law on Biobanks of 2000 requires informed consent, whereby all patients are informed ex ante each time their data are used in a scientific project. Informed consent obviously involves high transaction costs when applied to a multi-purpose national health sector database.16 The privacy principle governing the HSD Bill is assumed consent – consent is assumed until patients request that some or all of their personal information be withdrawn from the database. All personal data must be encrypted to prevent researchers from relating personal information to the person in question. If the licensee abuses the rules governing the database, the law stipulates severe punishments including fines, loss of license, and imprisonment of up to three years, depending on the nature of the transgression. The proponents of the bill maintained that assumed consent, when combined with encryption, is equivalent to informed consent. The insiders vigorously rejected the claim, arguing that fail-safe methods of encryption have never existed and never will. For a while, the op-ed columns of the daily press contained bewildering debates over the methods and limits of encryption. Árnason (2002) provides his point of view as well as references.

The critics failed to replace the principle of assumed consent with the rule of informed consent, but they managed to add a clause to the second version of the HSD Bill that created a convenient procedure for patients to opt out of the HSD by signing a simple form.

4.3. Post-legislation strategies I: Mass withdrawal of personal data

The passage of the Data Bank Act in December 1998 did not silence the debate over patient privacy in the HSD. The insiders now mounted a campaign asking the citizens to opt out of the database by signing the special form that the law had provided for. The opting-out campaign was coordinated by a lobby organization called Mannvernd, which the opponents of the HSD project had established.17, Pálsson and Hardardóttir (2002) provide a careful overview of HSD dispute, both during the parliamentary debate and immediately afterwards, covering a 28-month period, beginning in April 1998 when the HSD Bill was first introduced. In this period, several hundred articles appeared in the press, and numerous television programs were aired. The authors analyze in detail 569 articles (news reports and op-ed pieces) that appeared in the country’s leading newspaper, Morgunbladid. The statistics for op-ed essays show that, in most months, a majority of the writers had a negative view of the HSD-Decode project. The data also show that physicians wrote more op-ed pieces about the case than any other occupational group, and they overwhelmingly opposed the project. “Only in the … category representing the general public did positive items outnumber negative ones” (Pálsson and Hardardóttir 2002, 278).

During the campaign for withdrawal, Mannvernd reported regularly on its website how many individuals had already opted out of the HSD. By the end of June 2003, 20,426 individuals had opted out, almost all of these withdrawals occurring in the years 1999–2001.18 It is fair to say that the opting-out strategy failed. The insiders did succeed in blocking the HSD project, but it was not with the help of their opting-out strategy. The arguments advanced by the insiders, focusing on privacy rights, monopoly, and commercialization of science, did not turn the general public against Decode Genetics. Decode had high success rates in persuading people to participate in its programs. In 2003, about 100,000 volunteers (in a nation of <300,000 inhabitants) had participated in more than 50 different disease programs, and some 95% of those who were asked to participate had agreed to cooperate.19

Decode’s successful campaign for public support played both on material incentives and the framing of ideas in terms of the Icelanders’ general belief systems. Put crudely, the firm appealed to the Icelanders difficult historical experience and portrayed them as a small nation destined to find cures for mankind’s major illnesses.20 The prospect of finding cures for health conditions such as heart diseases or diabetes also created expectations of very large profits. In 1998, when the HSD Bill was hotly debated in Parliament, Decode put stocks in the company on the market in Iceland. The stocks, which had lost all value in 2010, sold like hot cakes in Iceland, reaching US$ 65 per share.21

4.4. Post-legislation strategies II: disobedience by the duty-bearers

In formulating their political theory of the origins of property rights, Riker and Sened (1991, 995), propose the following conditions for the emergence of property rights: (1) the underlying resource must be scarce, (2) the prospective right holders must desire the rights, and (3) the rule maker must be willing to grant the rights. There is also a fourth condition, which is often forgotten: (4) the duty-bearers must acquiesce. According to Riker and Sened, in one sense condition (4) is a qualification of condition (3): “Rule makers cannot successfully proclaim rights if duty-bearers do not respect them. Thus duty-bearers are merely a cost of enforcement. … Yet in a deeper sense, this condition is indeed independent. Rights require the acquiescence of most participants, which can be extremely costly if the duty-bearers must be militarily coerced. So one must distinguish between the will of the officials to grant the rights and the will of the duty-bearers to respect them” (Riker and Sened 1991, 955).

In retrospect, the duty-bearers in the HSD case had an invincible strategic position: the database project could not go ahead without their voluntary cooperation. First, the health records were in the possession of various organizations such as hospitals and research centers. According to the 1998 law, the workers of the various organizations, under the supervision of the public Data Protection Authority, were given the task of assembling, encrypting, and transferring the records to the HSD – after reaching an agreement with the database licensee. These are sensitive tasks, with innumerable opportunities for sabotage, which the state could not effectively force the health professionals to undertake. Second, a government is likely to give a higher priority to a smoothly operating national health system than to a HSD. In Iceland, the Ministry of Health and Social Security has formal legal authority over the employees of the national health system, but there is no evidence that the ministry was ready to profoundly upset the relationship between health professionals and the government. The 1998 HSD Act, itself, provided no mechanisms for dealing with an uprising by the health workers. The Act authorizes the licensee to receive health records into the HSD after obtaining the consent of health workers and their organizations. Yet the law is vague about the negotiation processes, and silent about procedures and remedies if the licensee and the health workers fail to agree. In particular, the Act does not explicitly define a role for the Ministry if negotiations break down.22

The vaguely worded HSD Act gave the health workers the opportunity to block the transfer of data simply by prolonging the negotiations with the licensee, for instance by questioning the methods proposed for encrypting the data. The Industrial Organization literature reports that industrial interests sometime capture the regulatory agencies that are set up to supervise them (Laffont and Tirole 1991). The evidence from the HSD struggle is consistent with the capture hypothesis, although no direct proof exists. The Data Protection Authority consistently rejected on technical grounds Decode General’s costly proposals for encrypting personal data destined for the databank. Later, when Decode had switched from the central database approach to a decentralized solution, the Data Protection Authority took directly over the task of decoding personal data for Decode’s projects and found without a hitch satisfactory encryption methods and ways to protect patient privacy.23

Following the passage of the HSD Act, Decode Genetics soon recognized that the insiders had defeated its centralized HSD project. Nonetheless, the corporation survived the setback and became a world leader of scientific research in its field.24 Yet, inaccurate reports in the international media frequently claim that the corporation owes its success to the HSD.

4.5. The endgame: Coasean bargaining

When insurmountable obstacles to the HSD strategy became obvious, Decode switched to a decentralized strategy. The main elements of the new game plan include the following steps: the firm defines individual projects and their data requirements. Each project usually is aimed at finding the genetic base of a particular disease. The next step is to locate the informal owners of the relevant health records, the relevant insiders, and engage in Coasean bargaining over the transfer of property rights. The deal gives Decode the right to use the relevant medical records in return for cash or payments-in-kind. The arrangements frequently make qualified insiders participate directly in the research projects. For instance, contracts are made with physicians, who obtain informed consent from their patients, collect individual biological samples (usually blood samples), interview patients, and make all the information available to Decode, along with the patients’ health records. With these data in hand, Decode uses its genealogical database to identify relatives of the patients for inclusion in the project.25 The relatives (and control groups) also provide DNA data and health information. At various stages in this process, Decode resorts to the Data Protection Authority; neither Decode nor the insiders are involved in the encryption process.26

5. Competing mental models: social technologies and general social beliefs

Our knowledge of society and nature is incomplete; in the organization of economic activity, we rely on incomplete theories and models. For our purposes, we can divide the wide range of incomplete mental models into two broad categories: Models and theories that involve a) the overall social functionality and legitimacy of particular technologies and social structures (general social beliefs), and b) the practical issue of how to set up and operate specific activities (social technologies) – such as biogenetic research programs. Incomplete knowledge, moreover, gives rise to competition among mental models and corresponding campaigns of persuasion. The persuaders sometimes act strategically by promoting beliefs that they, themselves, do not consider true, but they are also often sincere in their beliefs. The outcome of competition among incomplete mental models can have decisive impact on the evolution of property rights.27

In the late 20th century, the rapid emergence of modern biotechnology in the United States was in part made possible by critical court decisions concerning property rights in the new industry. In their decisions, the justices were often sharply divided on issues such as the property rights of patients to their discarded body parts and whether inventors could take out patents on genetically modified microorganisms. In these cases, the judges relied on personal interpretations of general social theories (such as jurisprudence) to reach often fateful and divergent conclusions about the place of novel technical phenomena in the wider social system.28 General social beliefs also guided members of the Icelandic public when they decided whether or not to cooperate with Decode Genetics in the firms DNA disease studies, as Pálsson (2007) has analyzed. Unlike experts, such as judges, philosophers or religious leaders, the public usually does not rely on complex theoretical system but instead frames the issues in terms on symbols and metaphors drawn from informal social theories.

Social technologies involve explicit and practical how-to questions. When setting up systems of governance for natural science and technology, rule makers that pursue rapid technical change must answer questions such as: What form of governance is most effective for basic scientific work? Do we need a separate incentive structure for basic research and applied research? How do we distinguish basic from applied research? Is it efficient to set up for-profit research and development firms? Is it efficient to rely on a single national health sector database for conducting studies of the genetic causes of disease? As always, we have incomplete knowledge of these issues, and people’s how-to beliefs can differ widely. Consider briefly the last two questions above.

Iceland’s centralized health sector database, as described in the 1998 Act, was supposed to serve many purposes: it was intended as a database for all of Decode’s disease studies; as tool for administering and streamlining the country’s public health system; and a general data source for health-related research by the country’s scientists. For the privilege of running the HSD, Decode Genetics offered to cover the start-up cost, pay a substantial annual license fee (of about one million dollars); and (in addition to regular taxes) contribute about 6% of its annual profits to the government. If we consider only economic efficiency, it is reasonable to expect that the corporation’s pursuit of an all-embracing national HSD reflected beliefs about positive economies of scale in building and running databases. Yet, it is not obvious that the pure scale argument is correct. The health records are heterogeneous to a large degree, and so are the data requirements of the various projects. With widely varying data and research goals it would have been difficult and costly to structure the HSD to meet the different needs. In retrospect, and in view of Decode’s success with the decentralized strategy, the HSD may have been a white elephant – if we only consider economies of scale.

In addition to the scale argument, I can think of two possible reasons why Decode initially pursued a national databank strategy. First, the Iceland HSD was a very effective marketing tool. The idea of a central database, containing the health records of an exotic yet modern mini-nation, captured the interest of the media and almost instantly made the project world famous. The spontaneous appeal of the HSD helped Decode find collaborators and finance its operations. A second (and possibly complementary) hypothesis is that Decode saw the HSD strategy as the least-cost method for obtaining control of the country’s health data, bypass costly negotiations with multiple informal owners, and keeping (foreign) competitors out. As it turned out, the firm underestimated the relative power of the de facto owners of the records and ended up negotiating with them individually.

Consider next the logic of the new organizational form, of which Decode Genetics is typical: the for-profit research-and-development firm, which became common late in the 20th century, especially in biogenetics. Previously, R&D activities typically took place in divisions within large enterprises – or were carried out in university laboratories. From the outset, some economists doubted the viability of the new business model, which so far has produced mixed results (Nelson 2008). The logic of doing for-profit basic research must involve a belief that in some fields the traditional gap between basic scientific discoveries and commercial applications had narrowed. In the scientific department, Decode Genetics did extremely well relative to most of its competitors, but the commercial department was a failure: the firm never fully developed and marketed any drugs. In 1996, when Kári Stefánsson introduced his corporation to the Icelanders he said: “What we are really doing here is setting up a big research laboratory disguised as a company. The work [done in the company] is not driven by anything else than the desire to create new knowledge which then can be used to improve people’s lives, ease their pain and prevent illnesses.”29 Stefánsson probably did not realize how accurate he was when he described Decode Genetics as a “big research laboratory disguised as a company.” In 2009, when Decode General filed for bankruptcy, the firm’s assets were about $70 million, and its debt $313 million. And now the very scientific research program used by Decode Genetics and comparable firms is being questioned. The New York Times in a survey article dated June 12, 2010, states: “Indeed, after 10 years of effort, geneticists are almost back to square one in knowing where to look for the roots of common disease.”30

6. Conclusion

The purpose of this paper is to use a small empirical case to demonstrate that we seldom travel on a straight road from rising value of resources directly to the creation of efficient exclusive and detailed property rights, as Demsetz (1967) appears to suggest. There are many hindrances on the way: political economy sometimes sends the travelers off the road into a quagmire of inefficiency; de facto owners can upset the cart; and unclear road maps and fog often misdirect the travelers toward unworkable governance models and unsound scientific ideas. Under uncertainty, the failure of hotly pursued governance strategy can bring success, and acclaimed scientific discoveries sometimes evaporate.