RIGHT OF REPLY
MEDICINE AND THE LAW

 

Genomic research and privacy: A response to Staunton et al.

 

 

D W Thaldar; B Townsend

PhD; School of Law, University of KwaZulu-Natal, Durban, South Africa

Correspondence

 

 

---

ABSTRACT

The Protection of Personal Information Act No. 4 of 2013 (POPIA) promises a new dispensation of privacy protection for research participants in South Africa. In a recent article, Staunton et al. proposed that a purposive interpretation of POPIA would allow for the retention of the status quo of broad consent in the context of genomic research. In this response article, we analyse the argument presented by Staunton et al., and conclude that it fails to convince: firstly, because Staunton et al. do not present empirical data for their factual assumption that moving up the consent benchmark is likely to stymie research; secondly, because genomic research does not have a monopoly on the public interest, but shares it with the privacy rights of research participants; and thirdly, because POPIA was designed to promote the protection of privacy, not simply to preserve the status quo as found in existing policy instruments. In contrast to the position advocated by Staunton et al., we suggest that a purposive interpretation of POPIA is aligned with the plain meaning of the statute - namely that specific (not broad) consent is a prerequisite for research on genomic information.

---

 

 

After a long process of consultation, the South African (SA) Parliament enacted the Protection of Personal Information Act No. 4 of 2013^[1] (POPIA) in 2013. However, the SA government placed the commencement of the substantive provisions of POPIA temporarily on hold, hence providing a hiatus for society to prepare to comply with it. From the commencement date of the entire Act, society will enjoy a further year's grace period to comply, which may also be extended. The only sections of POPIA that have commenced are the sections dealing with the appointment of the Information Regulator - the monitoring and enforcement mechanism of POPIA.

One of the sections of POPIA that is yet to commence is section 13(1), which deals with the conditions for collecting personal information. Given that personal information includes a person's biometric information, which in turn includes genomic information, this section is relevant to genomic research. It provides that personal information must be collected for a 'specific, explicitly defined and lawful purpose'. This requirement signals a departure from the status quo in SA of allowing genomic research participants to consent not only to current research, but also to future research using their genomic information - even though the precise nature of such future research may not be clear at present.^[2] Despite the unambiguous formulation of section 13(1), Staunton et al.^[3] recently argued that a 'purposive' interpretation of POPIA would not require a departure from the status quo. In this response article, we offer an alternative interpretation of POPIA with relation to genomic research, and critically engage with the argument by Staunton et al.

 

Purposive interpretation of section 13(1)

It is trite law that statutory provisions should be interpreted purposively. This means, quite simply, that the interpreter must ascertain the purpose that the provision is intended to serve, and then interpret the provision in the light of such purpose. To ascertain the purpose of a provision, one must consider the words used to articulate the provision, and more broadly the context of the statute as a whole.^[4] In the latter context, an interpreter should look at the preamble of the statute or at other express indications in the statute as to the object that has to be achieved; look at what led to the enactment (in other words, what was the mischief that the statute was intended to deal with); and draw logical inferences from the context of the enactment.^[5] While the purposive approach to interpretation is not legalistic (in the sense of being bound to the strict letter rather than the spirit of the law), it is also not divorced from the ordinary meaning of words. The Supreme Court of Appeal stressed the importance of the words used,^[6] and held that the 'inevitable point of departure is the language of the provision itself'.^[7] Similarly, the Constitutional Court held that a 'purposive reading of a statute must of course remain faithful to the actual wording of the statute'.^[8]

In light of the above, consider section 13(1) of POPIA, which deals with the first step to conducting genomic research - namely DNA sample collection. It reads: 'Personal information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party.' In the context of genomic research, the purpose of collecting a DNA sample (which contains personal information) can be defined in various ways. Typical examples are: (i) blanket consent (no study is defined, with no restrictions on the kind of research); (ii) broad consent (a broad range of studies is defined, which may be subject to specified restrictions); and (iii) specific consent (a specific study is defined). Section 13(1) of POPIA clearly chooses one of these typical forms of consent, namely specific consent, to the logical exclusion of blanket and broad consent. This is, in the words of the Supreme Court of Appeal, the 'inevitable point of departure'. Can the context of the statute as a whole cast any further light on how a 'specific, explicitly defined ... purpose' should be understood?

With reference to POPIA's preamble and section 2, which sets out the purpose of the statute, POPIA's objective, in brief, is to define how personal information - including a person's genomic information -may be collected, retained, disseminated and used. The statute strives to strike a balance between persons' privacy rights in their personal information, and other rights and interests, such as the free flow of information without unnecessary impediments. Accordingly, in the context of genomic research, POPIA strives to strike a balance between a research participant's privacy right in his or her genomic information, and, inter alia, a genomic researcher's right to access information and freedom of scientific research. It is in this context that POPIA provides that a genomic researcher can in principle access and do research on a research participant's genomic information, but on condition that, inter alia, the research participant consents to his or her genomic information being collected for a specific, explicitly defined purpose. There is nothing in the context of POPIA as a whole that suggests that section 13(1) can refer to anything but a specific research study.

 

Analysing Staunton et al.'s argument

Staunton et al's main line of argument is that requiring specific consent 'would raise difficulties for many genetic research studies' and 'stifle current and future research and innovation', because 'all research participants for current and ongoing research for which broad consent was used would have to be re-contacted and re-consented'; given that genomic research is in the public interest, requiring a 'specific consent model for all research studies would undermine the public interest'; as such, the public interest demands that POPIA must be purposively interpreted to 'permit broad consent for the processing of personal information for research'.

Will specific consent stifle genomic research?

Clearly, re-contacting and re-consenting countless numbers of research participants would pose a significant obstacle. However, if one considers the actual past practices of SA biobanks, and the 'further processing' provisions of POPIA, we suggest that this scenario sketched by Staunton et al. is not necessarily - or even likely to be - the outcome of the specific consent requirement in section 13(1).

Allow us to explain: section 15 of POPIA makes provision for further processing (which would include further research) of information that has already been collected - without the need to obtain new consent again. But there are important conditions. One such condition is contained in section 15(1) of POPIA, which reads that 'Further processing of personal information must be in accordance or compatible with the purpose for which it was collected in terms of section 13.' As such, further processing is inextricably linked to compliance with the requirement in section 13 that personal information must be collected for a specific purpose. In other words, if the original consent was not for a specific purpose, there can be no further processing. Because of the past focus on broad consent to build biobanks, this requirement may at first glance seem unlikely to be complied with by SA biobanks. However, this is not necessarily the case: a common model used in SA to build biobanks for genomic research is to recruit research participants for a specific research study, and then simultaneously request broad consent for the storage of the samples after the study for an indefinite period, and to the use of the genomic information contained in such samples for the purpose of future research studies. Although the broad consent does not assist in the POPIA context, the original specific consent does. This is a crucial aspect of assessing POPIA's impact on genomic research. However, Staunton et al. failed to consider this aspect.

In effect, POPIA establishes a regime in which the initial specific consent at the time of collection functions as a blanket consent to future research studies. Stated differently, if specific consent is in place (in terms of section 13(1)), a research group can rely on POPIA's 'further processing' provisions (section 15) to conduct any bona fide research. Biobanks that were built on the simultaneous specific and broad consent model will therefore be able to continue with their activities; in contrast, biobanks that were built independently of specific research studies, and where only broad consent was obtained, will have to obtain new, specific consent from research participants. Once specific consent has been obtained, the endless horizon of unlimited future research projects beckons - at least in the POPIA context. Note that other legal and ethical instruments may have their own requirements, such as obtaining broad consent from research participants for further research. These requirements are not affected by POPIA, but continue to operate as independent layers within the legal-ethical regulatory system, and may constitute pertinent limitations on the effective blanket consent regime of POPIA.

We now return to the argument by Staunton et al. based on the premise that requiring specific consent 'would raise difficulties for many genetic research studies' and stifle research. Clearly, given our explanation above, this premise is all but self-evident. In the absence of solid empirical data that a substantial number of SA genomic research biobanks were indeed built using broad consent alone, with no original specific consent at collection, this premise cannot be accepted. It follows that the first argument by Staunton et al. fails to convince.

Public interest is multifaceted

Even if, for the sake of argument, one accepts Staunton et al's premise that requiring specific consent would stifle research, their first argument still fails to convince. Core to the argument is the reliance on the idea of public interest. We agree with Staunton et al. that genomic research is in the public interest. But so is the protection of research participants' privacy rights in their genomic information. Clearly, public interest is a double-edged sword in this context. POPIA represents a delicate balancing exercise by the legislature. In fact, the issue of research that is in the public interest has been specifically incorporated into POPIA: where research is in the public interest, the need for consent to such research may be obviated provided that certain protections are in place (section 27(1)(d)). Note, however, that this public interest exemption from consent for research (as a form of processing information) does not affect the requirement contained in section 13(1) of POPIA that there must be specific consent for the collection of personal information. Collection, of course, is the essential step before the processing of such information can take place. Our point here is that the legislature already considered the importance of research that is in the public interest and created a special exemption for it within the POPIA framework. Importantly, however, is that this special exemption for research that is in the public interest is within circumscribed bounds. There is no indication that the purpose of POPIA is to privilege public interest research above privacy rights to such an extent as to eliminate any aspect that may cause the researchers involved extra effort. The reliance on public interest by Staunton et al. therefore does not assist in advancing their purposive interpretation argument.

 

POPIA and other policy instruments

Staunton et al. point out that POPIA 'does not exist in isolation, but is one of a number of pre-existing frameworks that govern genomic research'; and these other legal instruments and guidelines only require broad consent, and not specific consent. However, the fact that these 'pre-existing frameworks' require a lower benchmark (broad consent) for collecting genomic information from research participants than the new legislation (POPIA) in no way compromises the new legislation's higher benchmark (specific consent) for collecting genomic information from research participants. In fact, it can be argued that the distinctly higher benchmark introduced by the new privacy-specific legislation can be perceived as a deliberative legislative reaction to the insufficient privacy protection afforded by the non-privacy-specific 'pre-existing frameworks'. In other words, the lower benchmark of broad consent can well be the mischief that POPIA was intended to deal with. As such, a purposive approach to interpreting POPIA in the light of 'pre-existing frameworks' would underscore the importance of the new specific consent requirement in section 13(1).

 

Conclusions

We have shown that when section 13(1) of POPIA is interpreted according to the tenets of purposive interpretation, its meaning is as clear as the words chosen by the legislature: 'specific, explicitly defined ... purpose' means just what it says. And, although section 13(1) deals with the collection of personal information, the next step, namely the processing of personal information, which includes research that is conducted on the genomic information of research participants, will only be legal if the initial collection was in compliance with section 13(1). As we have shown, once specific consent has been obtained, POPIA effectively deals with the specific consent as a blanket consent for research, subject to certain conditions and privacy safeguards. However, the notion that POPIA can be purposively interpreted to require broad consent at any stage of a research project has no merit. Going forward, genomic researchers in SA would be well advised to take measures to ensure compliance with POPIA's new dispensation of specific consent.

Declaration. None.

Acknowledgements. None.

Author contributions. Both co-authors contributed to the conception and drafting of the work, approved the final version of the work to be published, and agreed to be accountable for all aspects of the work.

Funding. This work is based on the research supported in part by the National Research Foundation of South Africa (grant no. 116275) and by the African Health Research Flagship of the University of KwaZulu-Natal.

Conflicts of interest. None.

 

References

1. South Africa. Protection of Personal Information Act No. 4 of 2013. https://www.justice.gov.za/inforeg/docs/InfoRegSA-POPIA-act2013-004.pdf (accessed 16 October 2019).         [ Links ]

2. National Department of Health, South Africa. Ethics in Health Research: Principles, Processes and Structures. 2nd ed. Pretoria: NDoH, 2015. https://www.ru.ac.za/media/rhodesuniversity/content/ethics/documents/nationalguidelines/DOH_(2015)_Ethics_in_health_research_Principles,_processes_and_structures.pdf (accessed 16 October 2019).         [ Links ]

3. Staunton C, Adams R, Botes M, et al Safeguarding the future of genomic research in South Africa: Broad consent and the Protection of Personal Information Act No. 4 of 2013. S Afr Med J 2019;109(7):468-470. https://doi.org/10.7196/SAMJ.2019.v109i7.14148        [ Links ]

4. S v Zuma 1995 (2) SA 642 (CC) [15].         [ Links ]

5. Stopforth v Minister of Justice; Veenendaal v Minister of Justice 2000 (1) SA 113 (SCA) [21].         [ Links ]

6. South African Airways (Pty) Ltd v Aviation Union of South Africa 2011 (3) SA 148 (SCA) [25]-[30].         [ Links ]

7. Natal Joint Municipal Pension Fund v Endumeni Municipality 2012 (4) SA 593 (SCA) [18].         [ Links ]

8. Bertie Van Zyl (Pty) Ltd v Minister for Safety and Security 2010 (2) SA 181 (CC) [22].         [ Links ]

 

 

Correspondence:
D W Thaldar
thaldard@ukzn.ac.za

Accepted 17 October 2019