IN PRACTICE
MEDICINE AND THE LAW

 

Streamlining regulatory processes for health researchers: To what extent does POPIA apply?

 

 

V Bronstein^I; D T Nyachowe^II

^ILLM, LLB, Advocate of the High Court of South Africa; Associate Professor, School of Law, University of the Witwatersrand, Johannesburg, South Africa
^IILLM, LLB, on behalf of the MADIVA Research Hub; Junior Researcher, Sydney Brenner Institute of Molecular Bioscience, Faculty of Health Sciences, University of the Witwatersrand, Johannesburg, South Africa

Correspondence

 

 

---

ABSTRACT

South Africa has a well-established system for regulating health research on human subjects that works through a network of human research ethics committees (HRECs) established under the National Health Act No. 61 of 2003. The objective of the regulatory framework is to protect data subjects while furthering health research. The Protection of Personal Information Act No. 4 of 2013 (POPIA) has recently come into force and changed data protection laws. This article explores the legal effect of POPIA on health research. It is important to establish which legislation applies when processing personal information for health research. Section 3(2) (b) of POPIA is relevant here. It provides that POPIA does not apply where other legislation creates 'more extensive' conditions for the lawful processing of personal information than chapter 3 of POPIA does. This article explores implications of this curious provision in the context of health research.

---

 

 

This article starts by examining the specific regulatory framework for health research in South Africa (SA). It then dissects s3(2) of the Protection of Personal Information Act No. 4 of 2013 (POPIA),^[1] which is the application provision in the Act. We show that the provisions of the sectoral legislation on health are more extensive than the conditions in chapter 3 of POPIA, meeting the requirements of s3(2)(b) of POPIA. We then explore the implications of this finding, one of which is that the definition of broad consent in the sectoral legislation for health research should be applied to the exclusion of the consent provisions in POPIA.

 

Specific legislation regulating health research in SA

The National Health Act No. 61 of 2003 (NHA)^[2] is the primary legislation for regulating health research in SA. Its provisions are reinforced by the detailed National Department of Health 2015 'Ethics in health research: Principles, processes and structures' (DoH Guidelines).^[3] These guidelines have the force of law at the level of secondary legislation. The Health Professions Act No. 56 of 1974^[4] also regulates health professionals and their conduct. The Health Professions Council of South Africa (HPCSA) has issued guidelines that include general ethical guidelines for health researchers.^[5] There are also guidelines on keeping patients' records that inter alia allow data subjects to access their own records and incorporate aspects of the Promotion of Access to Information Act No. 2 of 2000.^[61 The South African Medical Research Council also has guidelines on the responsible conduct of research.^[7]

In practice, all the above laws, but most importantly the NHA and its Regulations and Guidelines, form a composite whole for the regulation of health research. We refer to the above legislation as the 'sectoral legislation' in this article because it is specific legislation that pertains to health research.

The precepts of the sectoral legislation are well established in the health research community and are implemented through a network of human research ethics committees (HRECs) that operate under the auspices of the National Health Research Ethics Council (NHREC) (s72 NHA). The NHREC sets 'norms and standards for conducting research on humans' and for conducting clinical trials (s72(6)(c) NHA). Every establishment at which health research is conducted must either establish 'or have access to' an HREC (s73(1) NHA). HRECs apply the DoH Guidelines in addition to standards and conditions that are set by the particular ethics committee. They review research proposals and protocols, and only grant approval for research that meets their standards (s73(2)(a) and (b) NHA). Researchers must comply with any decision or condition imposed by their HREC.^[8]

Health research always generates large volumes of personal information. The regulation of health research has recently been made more complex by the coming into force of POPIA. POPIA is general legislation that aims to protect personal information of data subjects. There has been a general assumption in health regulatory circles that POPIA always applies to personal information generated in the process of health research. Our aim is to show that this assumption is flawed, as it fails to engage with the application provision of POPIA.

 

The application of POPIA

Section 3(2) of POPIA reads:

'(a) This Act applies, subject to paragraph (b), to the exclusion of any provision of any other legislation that regulates the processing of personal information and that is materially inconsistent with an object, or a specific provision, of this Act.

(b) If any other legislation provides for conditions for the lawful processing of personal information that are more extensive than those set out in Chapter 3 [of POPIA], the extensive conditions prevail [our italics].'

Section 3(2)(b) has not been explored in the context of health research. Although s3(2)(a) states that POPIA applies 'to the exclusion of ... any other legislation, the provision is immediately undercut by s3(2)(b), which makes it clear that POPIA does not apply in circumstances where more extensive legislation than chapter 3 of POPIA applies to the field.

 

Implications of s3(2)(b) of POPIA in the context of health research

Are the conditions set out in the complex of sectoral legislation regulating health research more extensive than those set out in chapter 3 of POPIA? What does more extensive than mean in the context of s3(2)(b)?

To our surprise, the term more extensive than is almost never used in SA legislation. A search on Jutastat only finds the exact phrase in this one subsection, and there are no cases referring to it or interpreting its meaning. In a bid to find the meaning of 'extensive', this research has explored ordinary dictionary meanings.

Dictionary definitions of extensive seem to follow a similar pattern. Extensive commonly refers to something 'that covers a large area'^[9] or 'that is wide or great'.^[10] However, that is not the meaning of extensive that seems to be appropriate in this context. Collins Cobuild Intermediate Dictionary states that extensive means 'covering many details, ideas, or items'.^[11] Dictionary.com defines extensive as 'far-reaching; comprehensive; or thorough'.^[12] In our view, the dictionary definitions that focus on extensive as meaning more detailed, thorough or comprehensive are relevant to the meaning of more extensive than in the context of s3(2)(b).

One impulse is to interpret s3(2)(b) to maximise the privacy of data subjects. If that were the case, the interpreter would ask whether chapter 3 of POPIA gives more protection to data subjects than the sectoral legislation. One problem with this view is that s3(3) of POPIA makes it clear that the Act must be interpreted in line with an array of purposes. Although the right to privacy is included in these purposes, the right to access to information and important interests such as free flow of information within SA and across borders also need to be considered when interpreting POPIA (s3(3) NHA).

Hence it would be incorrect to interpret the phrase more extensive than as simply meaning that the legislation that provides more protection for data subjects prevails. In any event, if the intention of s3(2)(b) was to maximise protection of the data subjects in all circumstances, it would have been a simple matter for the legislature to have made its intention clear.

Willem le Roux and Peter Colyn^[13] conclude that more extensive than in the context of s3(2) of POPIA cannot simply be a synonym for stricter legislation. The use of the word prevail indicates that the more extensive conditions override the provisions of POPIA. In our view, the intention of s3(2)(b) is that the more intricate and detailed regulation that covers the field prevails.

 

Comparison to establish which regulatory pathway is more extensive

The next step is to compare the sectoral legislation regulating health research on human subjects with the conditions set out in chapter 3 of POPIA in order to establish which regulates the field more comprehensively or extensively. The relevant question is whether the sectoral legislation is more extensive than chapter 3 of POPIA. We have set out a detailed comparison of the sectoral legislation and chapter 3 of POPIA, which is available online as a supplementary table (https://www.samedical.org/file/2048).

Chapter 3 of POPIA sets out eight conditions for processing personal information along with provisions for processing special personal information and data on children. The detailed analysis in the table shows that the sectoral legislation is much more comprehensive than chapter 3 of POPIA. In general, the table shows that the specific structures for the regulation of health research are more rigorous than the requirements in POPIA. For example, HRECs that enforce the sectoral legislation require elaborate documentation, in contrast with POPIA, which has weak documentation requirements.^[14] Data collection and secondary use of data needs to be justified to and approved by HRECs.^[8]

The sectoral legislation also provides more detailed provisions for dealing with consent in the context of health, sex life data and children's data than POPIA does. Sectoral legislation also contains provisions that allow data subjects to access their own records.^[6] There are also mechanisms for data subjects to seek recourse against researchers with the aid of HRECs, the health ombudsman and ultimately the Minister of Health (s18, s81(a) and (b) NHA).

The supplementary table that accompanies this article illustrates that the NHA, DoH Guidelines and associated legislation provide more extensive conditions for lawful processing of personal information for health research than those set out in chapter 3 of POPIA. Section 3(2)(b) of POPIA indicates that 'the extensive conditions prevail'.

Implications of the sectoral legislation being more extensive than POPIA

The unusual structure of s3(2)(b) of POPIA requires legal interpreters to determine which legislation applies to protection of personal information in a particular field. The concept of preemption, which is widely used in the international federalism literature, is useful here. Pre-emption is a legal doctrine that deals with determining which of two legislative regimes apply in specific circumstances. ^[15] We are justified in using the analogy of pre-emption in this context as the doctrine is simply a particular manifestation of conventional statutory interpretation, which fundamentally aims to interpret and determine the intention of the legislature. The operative question in pre-emption is whether the national legislature intended to comprehensively cover the field or relevant subject matter when it passed the legislation.

In our context, we pose the opposite question. Did our legislature intend not to regulate specific fields or to leave them outside the ambit of POPIA? In our view, s3(2)(b) of POPIA evinces exactly that intention in the context of fields where data are more extensively regulated than they are under chapter 3 of POPIA. We have demonstrated that health research is one such field.

If the sectoral legislation for health provides more extensive conditions for processing personal information than chapter 3 of POPIA, then that creates two possibilities. The one is that when the sectoral legislation conflicts with POPIA, the sectoral legislation prevails. The second possibility, and the one we prefer, is that the sectoral legislation regulates health research to the exclusion of chapter 3 of POPIA. That interpretation safeguards the spaces deliberately left open in the sectoral legislation and protects the coherence of the legal structures that protect health research. The latter interpretation fits with the doctrine of pre-emption.

It also fits with our understanding of the purpose of POPIA, which was to introduce general legislation incorporating good data protection practices in fields where data protection was thinly regulated or non-existent. Hence, our interpretation of s3(2)(b) of POPIA coheres with the view that the legislature did not intend to disturb good practices in well-regulated fields such as the health research sphere. There is a research exception in POPIA that is specifically directed at secondary use of data in research (s27(1)(d)). In our view, s27(1)(d) is a residual provision that applies generally across the whole gamut of researchers in society and operates outside the specific health research context.

Although there is often a great deal of congruency between the sectoral legislation for health research and the conditions set out in chapter 3 of POPIA, there are circumstances in which the question of which legislation applies has practical implications for the research community. For example, the DoH Guidelines allow research subjects to give narrow, tiered or broad consent to use of their personal data.^[16] POPIA requires consent to be specific.^[16] The impact of this has been debated in this journal by Staunton et al.^[17] and Thaldar and Townsend.^[18] In Staunton et alls view, 'a purposive interpretation of POPIA permits the use of broad consent for research purposes'. On the other hand, Thaldar and Townsend argue that the use of broad consent in health research is currently impermissible. We agree with Staunton et al., but for different reasons. In our view, the sectoral legislation applies to health research to the exclusion of POPIA. This interpretation flows from the application of s3(2)(b) of POPIA.

The sectoral legislation prevails over chapter 3 of POPIA, which includes the consent provisions. But POPIA also contains other chapters that potentially impact on health research and include inter alia provisions about data transfer, automated processing and codes of conduct. The status of the provisions outside of chapter 3 of POPIA are not clearly resolved by the application provisions of POPIA.

 

Conclusion

We have concluded that HRECs must continue to apply the sectoral legislation for health research to the exclusion of chapter 3 of POPIA. However, there are many difficult interpretative questions that remain unresolved. We agree with Thaldar and Townsend^[16] that in principle there should be a sector-wide exemption that ensures that health research is regulated by sectoral legislation and HRECs to the exclusion of POPIA and the Information Regulator. This would prevent forum shopping and allow HRECs, which are expert bodies with broad expertise in different aspects of health research, to continue to provide the service that they traditionally have provided.

It would be best if the legislature would make it clear that health research is excluded from the ambit of POPIA. Sectoral legislation can always be refined and improved. However, a clear legislative amendment would ensure that the regulatory system for health research is able to retain its coherence and its independence while providing clarity for health researchers.

Declaration. None.

Acknowledgements. The authors thank Scott Hazelhurst for his generous assistance.

Author contributions. The authors contributed equally.

Funding. Research reported in this article was supported by Fogarty International Center of the National Institutes of Health under award no. U54TW012077. The content is solely the responsibility of the authors and does not necessarily represent the official views of the National Institutes of Health.

Conflicts of interest. None.

 

References

1. South Africa. Protection of Personal Information Act No. 4 of 2013. https://www.justice.gov.za/inforeg/docs/InfoRegSA-POPIA-act2013-004.pdf (accessed 6 April 2022).         [ Links ]

2. South Africa. National Health Act No. 61 of 2003. https://www.gov.za/sites/default/files/gcisdocument/201409/a61-03.pdf (accessed 13 June 2022).         [ Links ]

3. National Department of Health, South Africa. Ethics in health research: Principles, processes and structures. 2nd ed. Pretoria: NDoH, 2015. https://www.ru.ac.za/media/rhodesuniversity/content/ethics/documents/national_guidelines/DOH_(2015)_Ethics_in_health_research_Principles,_processes_and_structures.pdf (accessed 9 June 2022).         [ Links ]

4. South Africa. Health Professions Act No. 56 of 1974. https://www.hpcsa.co.za/Uploads/legal_and_regulatory_affairs/legislation/health_professions_ct_56_1974.pdf (accessed 29 June 2023).         [ Links ]

5. Health Professions Council of South Africa. Guidelines for good practice in the health care professions: General ethical guidelines for health researchers. Booklet 13. Pretoria: HPCSA, 2016. https://www.hpcsa.co.za/Uploads/professional_practice/ethics/Booklet_13_Gen_Ethical_Guidelines_for_Health_Researchers.pdf (accessed 16 May 2022).         [ Links ]

6. Health Professions Council of South Africa. Guidelines for good practice in the health care professions: Guidelines on the keeping of patient records. Booklet 9. Pretoria: HPCSA, 2016. https://www.hpcsa.co.za/Uploads/professional_practice/ethics/Booklet_9_Keeping_of_Patient_Records_Review%20Draft_vSept_2022.pdf (accessed 16 May 2022).         [ Links ]

7. South African Medical Research Council. South African Medical Research Council guidelines on the responsible conduct of research. 2018. https://www.samrc.ac.za/sites/default/files/attachments/2022-12/ResponsibleConductResearchGuidelines.pdf (accessed 29 June 2023).         [ Links ]

8. South Africa. National Health Act 61 of 2003. Material Transfer Agreement of Human Biological Materials. Government Gazette No. 41781:719. 20 July 2018. Section 6. https://www.gov.za/sites/default/files/41781_gon719.pdf (accessed 12 May 2022).         [ Links ]

9. Cambridge Advanced Learner's Dictionary. https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=web&cd=&ved=0CAQQw7AJahcKEwiAv_rO2PH8AhUAAAAAHQAAAAAQAg&url=https%3A%2F%2Fdictionary.cambridge.org%2Fdictionary%2Fenglish%2Fextensive&psig=AOvVaw04Da2_uuxopCWuvMgSM4FB&ust=1675250500019420 (accessed 11 October 2022).         [ Links ]

10. Sinclair JM. Collins English Dictionary. 12th ed. London: HarperCollins Publishers, 2011. https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=web&cd=&ved=0CAQQw7AJahcKEwiAv_rO 2PH8AhUAAAAAHQAAAAAQBg&url=https%3A%2F%2Fwww.collinsdictionary.com%2Fdictionary%2Fenglish%2Fextensive&psig=AOvVaw04Da2_uuxopCWuvMgSM4FB&ust=1675250500019420 (accessed 11 October 2022).         [ Links ]

11. Sinclair JM. Collins English Dictionary. 4th ed. London: HarperCollins Publishers, 2018. https://www.collinsdictionary.com/dictionary/english/extensive (accessed 11 October 2022).         [ Links ]

12. Dictionary.com. https://www.dictionary.com/browse/extensive (accessed 11 October 2022).         [ Links ]

13. Le Roux W, Colyn P. The disclosure of private personal information of a person is restricted in terms of section 36 of the OHASA. In: Le Roux W, Colyn P, eds. Occupational Health and Safety Law. Johannesburg: LexisNexis, 2022. https://www.mylexisnexis.co.za/Index.aspx?permalink=T0hTTCAxMy4yLjUkNzYzMDk5NyQ3JExpYnJhcnkkSkQkTGlicmFyeQ (accessed 11 October 2022).         [ Links ]

14. Bronstein V. Prioritizing command-and-control over collaborative governance: The role of the information regulator under the Protection of Personal Information Act. Potchefstroom Electronic Law J 2022;25:1-41. https://doi.org/10.17159/1727-3781/2022/v25i0a11661        [ Links ]

15. Bronstein V. Reconciling regulation or confronting inconsistency? Conflict between national and provincial legislation. S Afr J Hum Rights 2006;22(2):283-300. (On comparative law of pre-emption generally also see references cited therein.) https://doi.org/10.1080/19962126.2006.11864891        [ Links ]

16. Thaldar DW, Townsend BA. Exempting health research from the consent provisions of POPIA. Potchefstroom Electronic Law J 2021;24:1-32. https://doi.org/10.17159/1727-3781/2021/v24i0a10420        [ Links ]

17. Staunton C, Adams R, Botes M, et al. Safeguarding the future of genomic research in South Africa: Broad consent and the Protection of Personal Information Act No. 4 of 2013. S Afr Med J 2019;109(7):468-470. https://doi.org/10.7196/SAMJ.2019.v109i7.14148        [ Links ]

18. Thaldar DW, Townsend B. Genomic research and privacy: A response to Staunton et al. S Afr Med J 2020;110(3):172-174. https://doi.org/10.7196/SAMJ.2020.v110i3.14431        [ Links ]

 

 

Correspondence:
V Bronstein
victoria.bronstein@wits.ac.za

Accepted 25 April 2023