RIGHT OF REPLY
CORRESPONDENCE

 

Privacy rights of human research participants in South Africa must be taken seriously

 

 

To the Editor: The Protection of Personal Information Act 4 of 2013^[1] (POPIA) was enacted by the South African (SA) parliament in 2013 after a long process of public consultation. To allow all sectors of SA society sufficient time to prepare to be compliant with POPIA, the SA government deferred the entering into force of the substantive provisions of POPIA for several years. Throughout this hiatus period, POPIA was widely publicised in the SA media, as is evident from any internet search.

POPIA requires - in no uncertain terms - that consent by a research participant must be for a specific, explicitly defined research project, rendering so-called broad consent insufficient. However, of late, this core provision of POPIA appears to be causing concern for some with relation to its application to genomic research in SA. On 4 and 5 February 2019, a workshop was held in Cape Town on the topic of 'The governance of data sharing for genomic and other health-related data in Africa. According to a report on this workshop in Science,^[2] under the alarmist title 'South African law may impede human health research', some workshop attendees make the astonishing claim that they only discovered the specific consent provision of POPIA as recently as 2018 - a full 5 years after the enactment of the Act. If the report in Science is an accurate reflection of the mood of the workshop, instead of making expedited plans for compliance readiness, the workshop attendees rather contemplated plans of how to avoid compliance with POPIA's core provision of specific consent. The plans that were contemplated included requesting exemptions from the Information Regulator and even having POPIA amended by Parliament.

The most novel and extraordinary plan that emanated from the workshop was the idea that POPIA can be 'interpreted' to only require broad consent - not the higher benchmark of specific consent. This idea, expounded by Staunton et al.^[3] in an article published in this journal, is purportedly based on the legal doctrine of purposive interpretation. We have serious reservations about the legal merits of Staunton etal's argument, which we set out in the article above.^[4]

Responsible scientists take the privacy rights of human research participants seriously. In the coming era of POPIA, this would require adoption of specific consent. We call on the SA scientific community to embrace this new legal requirement, as it shows respect for the autonomy and privacy rights of research participants. In this compliance-orientated paradigm, it would be worthwhile considering the use of dynamic consent models that use technology (such as cellphones) to facilitate specific consent and, more generally, to facilitate regular communication between research teams and research participants.

Donrich Thaldar, Beverley Townsend

School of Law, University of KwaZulu-Natal, Durban, South Africa thaldard@ukzn.ac.za

 

1. South Africa. Protection of Personal Information Act 4 of 2013. https://www.justice.gov.za/inforeg/docs/InfoRegSA-POPIA-act2013-004.pdf (accessed 30 November 2019).         [ Links ]

2. Nordling L. South African law may impede human health research. Science 2019;363(6429):802. https://doi.org/10.1126/science.363.6429.802        [ Links ]

3. Staunton C, Adams R, Botes M, et al. Safeguarding the future of genomic research in South Africa: Broad consent and the Protection of Personal Information Act No. 4 of 2013. S Afr Med J 2019;109(7):468-470. https://doi.org/10.7196/SAMJ.2019.v109i7.14148        [ Links ]

4. Thaldar D, Townsend B. Genomic research and privacy: A response to Staunton et al. S Afr Med J 2020;110(3):172-174. https://doi.org/10.7196/SAMJ.2020.v110i3.14431        [ Links ]

 

---

 

Staunton et al. respond: The Protection of Personal Information Act No. 4 of 2013 (POPIA)^[1] is due to come into force on 1 April 2020, but there is some uncertainty as to its practical implications with regard to the use of health data for research. In particular, our recent article on the legal status of broad consent under POPIA,^[2] and Thaldar and Townsend's response,^[3] demonstrate that there is debate as to the legal status of broad consent under the terms of POPIA within the academic and scientific communities.

In our article, we argue that the legal status of broad consent under POPIA will have a considerable impact on the sharing of health data for research in SA. However, the premise of our position is not that specific consent would undermine research in SA, as stated by Thaldar and Townsend. Indeed, specific consent is a long-established legal basis for processing personal information in many countries around the world, and we acknowledge and value this legal position. However, specific consent is not the only model for responsible research, and our argument is that broad consent for further processing of health data (which include genomic data) for scientific research purposes is legally permitted in terms of POPIA.

Section 13(1) of POPIA requires personal information to be collected for a 'specific, explicitly defined and lawful purpose'. Read in isolation, this would appear to permit specific consent only. However, in response to Thaldar and Townsend's argument^[3] that there 'is nothing in the context of POPIA as a whole that suggests that section 13(1) can refer to anything but a specific research study', we posit that broad consent is permissible. Section 15(3)(e) permits further processing of personal information if it is to be used for research and the personal information will not be published in an identifiable form. POPIA therefore appears to require specific consent, but then states that further use of the personal information is not incompatible with the original purpose for which it was collected if it is used for research purposes. There is no indication that another, fresh consent from the data subject must be obtained prior to this further use. This implies that broad consent, i.e. a consent from the research participant at the point of collection that allows for future processing for scientific research, is legally permitted.

Sections 13(1) and 15(3)(e) might appear to be in conflict. We argue, however, that a purposive interpretation of POPIA as a whole provides guidance and provides a coherent, consistent reading of the statute: POPIA makes it clear that the constitutional right to privacy is not absolute and may be subject to limitations 'that are aimed at protecting other rights and important interests', and section 2 specifically states that these important interests include 'the free flow of information within the Republic and across national borders'. We therefore agree with Thaldar and Townsend that a study that recruits research participants for specific consent and simultaneously requests broad consent for future research is legally permitted under POPIA. In addition, we described in our article that a purposive interpretation of POPIA makes it clear that broad consent alone would also be legally permitted under POPIA. The purpose of the workshop in February 2020 was to discuss the legal challenges facing the sharing of health data for research in Africa. As reported in Science,^[4]the uncertainty surrounding the legal status of broad consent under POPIA was highlighted to the scientific community in advance of the workshop. During the workshop, discussion centered on the sharing of data for genomic research in a manner that is compliant with ethical guidelines and good international practice, as well as POPIA and other SA regulatory frameworks. On this point it is worth noting that the General Data Protection Regulation similarly requires 'freely given, specific, informed' consent, but the European Data Protection Supervisor recently stated that broad consent can be permitted 'in the case of special categories of data on which much scientific research relies'.^[4] In such cases the data controller will be expected to do more to ensure that 'the essence of the data subject rights to valid consent are served, including through as much transparency as possible and other safeguards'.

Discussions on appropriate consent models for genomic research are ongoing and we welcome debate on the strengths and weaknesses of, as well as legal bases for, specific consent, tiered consent, broad consent and dynamic consent. This debate is urgent and essential in providing clarity for a variety of stakeholders, including the scientific community and research participants. The discussions so far in the SAMJ on the legal status of broad consent are a crucial part of this debate, but they form only one part. The issues raised to date point to the need for much wider engagement on this matter, including by the general public and the academic community. With the coming into force of POPIA, clarity on the legal status of broad consent under the Act is essential. As such, we call on the Information Regulator to exercise its power to consult in terms of section 40(1)(c), to engage with stakeholders on this matter and to issue a Code of Conduct as per section 40(1)(f) that clarifies matters, including the legal status of broad consent under POPIA.

Ciara Staunton

School of Law, Middlesex University, UK; and Institute for Biomedicine, Eurac Research, Italy c.staunton@mdx.ac.uk

Rachel Adams

Human Sciences Research Council, Pretoria, South Africa; and Information Law and Policy Centre, Institute of Advanced Legal Studies, University of London, UK

M Botes

Biolawgic (Pty) Ltd, Johannesburg, South Africa

Edward S Dove

School of Law, University of Edinburgh, Scotland

Lyn Horn

Office of Research Integrity, University of Cape Town, South Africa

Melodie Labuschaigne

Department of Jurisprudence, School of Law, University of South Africa, Pretoria, South Africa

Glaudina Loots

Department of Science and Technology, Pretoria, South Africa

Safia Mahomed

Department of Jurisprudence, School of Law, University of South Africa, Pretoria, South Africa

Antonel Olckers

DNAbiotec (Pty) Ltd, Pretoria, South Africa

Michael S Pepper

Department of Immunology and Institute for Cellular and Molecular Medicine, Faculty of Health Sciences, University of Pretoria, South Africa

Anne Pope

Department of Private Law, Faculty of Law, University of Cape Town, South Africa

Michele Ramsay

Sydney Brenner Institute for Molecular Bioscience, Faculty of Health Sciences, University of the Witwatersrand, Johannesburg, South Africa

Nora Ni Loideain

Information Law and Policy Centre, Institute of Advanced Legal Studies, University of London, UK

Jantina de Vries

Department of Medicine, Faculty of Health Sciences, University of Cape Town, South Africa

 

References

1. South Africa. Protection of Personal Information Act 4 of 2013. https://www.justice.gov.za/inforeg/docs/InfoRegSA-POPIA-act2013-004.pdf (accessed 4 February 2020).         [ Links ]

2. Staunton C, Adams R, Botes M, et al. Safeguarding the future of genomic research in South Africa: Broad consent and the Protection of Personal Information Act No. 4 of 2013. S Afr Med J 2019;109(7):468-470. https://doi.org/10.7196/SAMJ.2019.v109i7.14148        [ Links ]

3. Thaldar D, Townsend B. Genomic research and privacy: A response to Staunton et al. S Afr Med J 2020;110(3):172-174. https://doi.org/10.7196/SAMJ.2020.v110i3.14431        [ Links ]

4. Nordling L. South African law may impede human health research. Science 2019;363(6429):802. https://doi.org/10.1126/science.363.6429.802        [ Links ]

5. European Data Protection Supervisor. A preliminary opinion on data protection and scientific research. 6 January 2020. https://edps.europa.eu/sites/edp/files/publication/20-01-06_opinion_research_en.pdf (accessed 4 February 2020).         [ Links ]