CORRESPONDENCE

 

POPIA does indeed apply to health research: A response to Bronstein and Nyachowe

 

 

To the Editor: Bronstein and Nyachowe^[1] recently published an interesting and provocative article on data protection in health research in South Africa (SA). The main legislation that governs data protection in SA is the Protection of Personal Information Act 4 of 2013 (POPIA).^[2] Contrary to the generally accepted wisdom that POPIA's conditions for processing of personal information apply to health research, the authors boldly propose that this is not the case. The authors' argument is based on section 3(2)(b) of POPIA, which reads: 'If any other legislation provides for conditions for the lawful processing of personal information that are more extensive than those set out in Chapter 3 [of POPIA], the extensive conditions prevail.' The authors suggest that the phrase more extensive in section 3(2)(b) does not mean more extensive protection of the rights of the data subject. Instead, the authors suggest that more extensive means 'more detailed, thorough or comprehensive'. Given that the corpus of extant health research legislation in SA is clearly more comprehensive than POPIA's own conditions in terms of its volume of rules, structures and procedures, the authors conclude that extant health research legislation in SA governs health research to the exclusion of POPIA's conditions for the lawful processing of personal information.

In this letter, I analyse the authors' argument and challenge two of its main aspects. My first challenge relates to the interpretation of the phrase more extensive in section 3(2)(b), and my second challenge to the rule level at which section 3(2)(b) operates.

 

The interpretation of more extensive

The authors highlight that POPIA serves an array of purposes. These do not only include protecting the right to privacy, but also the rights to access information and to the free flow of information. The authors suggest that the phrase more extensive in section 3(2) (b) does not mean more extensive protection of the rights of the data subject - with concomitant stricter obligations on health researchers processing such data subjects' personal information - but should instead be allocated its dictionary meaning of 'more detailed, thorough or comprehensive'. To show that SA health research legislation is more detailed, thorough and comprehensive than POPIA's conditions, the authors present in their supplementary document a comparative analysis of POPIA's conditions compared with corresponding provisions found in SA health research legislation and ethics guidelines. Strikingly, the analysis focuses on the sheer volume of legal and ethical rules, structures and procedures in health research legislation, with relatively little regard to the actual content of these rules. This is problematic from a constitutional rationality perspective, as the volume of rules, structures and procedures is an arbitrary measure that cannot serve to exclude POPIA's application. Accordingly, I suggest that the authors' interpretation of the phrase more extensive as 'more detailed, thorough or comprehensive' is not legally tenable. That said, what is the correct legal interpretation of the phrase more extensive?

Regarding the present state of SA law on interpretation, the Supreme Court of Appeal held that the 'inevitable point of departure is the language of the provision itself'.^[3] Therefore, consider section 3(2)(b) again. It reads: 'If any other legislation provides for conditions for the lawful processing of personal information that are more extensive than those set out in Chapter 3 [of POPIA], the extensive conditions prevail.' The phrase more extensive relates to conditions for the lawful processing of personal information. Now consider the nature of POPIA's conditions for the lawful processing of personal information. These conditions are all - without exception - aimed at protecting the rights of the data subject. For example, accountability of the responsible party to the data subject; processing limitation to protect the privacy of the data subject; and purpose specification to protect the autonomy and dignity of the data subject. Accordingly, in the context in which it is used, the phrase more extensive relates to something - the conditions for the lawful processing of personal information - that by their very nature are aimed at protecting the rights of the data subject. It follows that a more extensive condition for the lawful processing of personal information would be a condition that provides for the more extensive protection of the rights of the data subject.

The consequence of this interpretation is that the volume of rules, structures and procedures is irrelevant. What matters is the substance of such rules - do they provide for more extensive protection of the rights of the data subject?

Before this question can be answered, however, one must determine the level at which section 3(2)(b) operates. Is it at the level of individual rules (i.e. conditions for the processing of personal information) found within other legislation, or is it at the level of the entire corpus of legislation pertaining to a field?

 

The rule level at which section 3(2)(b) operates

The authors state that 'POPIA does not apply in circumstances where more extensive legislation than chapter 3 of POPIA applies to the field' (emphasis added). As such, the authors suggest that 'The relevant question is whether the sectoral legislation is more extensive than chapter 3 of POPIA' (emphasis added). This is rhetorical sleight of hand, replacing conditions with either legislation applying to a field, or with its synonym, sectoral legislation. Section 3(2)(b) provides that where other legislation provides for conditions for the lawful processing of personal information that are more extensive than POPIA's own conditions, those extensive conditions prevail. Accordingly, the unit of comparison, which is also the unit that may prevail, is a condition in other legislation, not the other legislation as a whole. In practical terms, both the assessment of which legal rules are more extensive, and the consequent decision on which legal rules prevail, must be done at the level of individual conditions found in the other legislation.

The approach followed by the authors of positing an entire corpus of sectoral legislation as a unit of comparison with POPIA's chapter 3, and their conclusion that sectoral legislation in the field of health research excludes POPIA's chapter 3 in its entirety from applying to health research, is based on an incorrect interpretation of section 3(2) (b)'s level of operation - confusing conditions with legislation.

 

Importing the doctrine of pre-emption does not assist

The authors suggest that the doctrine of pre-emption can be useful. I do not agree. The doctrine of pre-emption is not part of SA law. In a previous article,^[4] Bronstein herself stated: 'From what I have said it must already be clear that the doctrine of pre-emption cannot simply be adopted in South Africa.' In the same article, the author also stated that advocates of pre-emption would face 'profound conceptual difficulty' in the light of SA's Constitution. I agree with these past assessments by the author. Although SA law is, in principle, remarkably open to learning and borrowing from comparative legal systems in appropriate cases, in the author's own past assessments the doctrine of pre-emption will face an uphill battle in this regard. Furthermore, it is simply the wrong battlefield. The doctrine of preemption applies to conflict between different levels of government (i.e. national v. provincial), and not to conflict between different statutes that operate at national level, such as POPIA and the National Health Act.

Furthermore, even if - for the sake of argument - the doctrine of pre-emption could be relied upon in the present context of POPIA's section 3(2)(b), it still does not take the author's argument any further, as pre-emption turns on legislative intention. Based on their mistaken interpretation of the phrase 'more extensive' and of the rule level at which section 3(2)(b) operates, the authors suggest that Parliament did not intend that POPIA should govern health research. However, when the mistaken premises fall away, so does the conclusion. Accordingly, the authors' reliance on the foreign doctrine of pre-emption obfuscates the issue, rather than clarifying it.

 

My thesis

The existing health research sectoral legislation in SA, considered as a whole, is indeed robust.^[5] But while this robustness may be a relevant consideration in some POPIA contexts, such as applying to the Information Regulator for an exemption for health research projects from having to comply with certain of POPIA's conditions,^[5] it is not a justification for the wholesale exclusion of POPIA's conditions from health research. When it comes to section 3(2)(b), the general robustness of health law sectoral legislation is not relevant. Instead, the focus must be on specific conditions for the lawful processing of personal information in such legislation. The correct question to ask is: Does a specific legal rule found in health research sectoral legislation provide more extensive protection of the rights of the data subject(s) than any of POPIA's conditions? If the answer is in the affirmative, such a legal rule found in health research sectoral legislation would prevail - but only that specific legal rule, and not health research sectoral legislation generally.

In the following paragraphs, I illustrate this principle by applying it to three examples.

Example 1: Minimality. Consider POPIA's minimality condition (section 10), which reads: 'Personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant and not excessive.' In their supplementary document, the authors note regarding the health research legislation equivalent of the minimality condition: 'Researchers are required to justify collection of data for a particular research project and the research protocol must be approved by the HREC [health research ethics committee].' No references to sections of legislation are provided, but I accept that it is correct. However, it refers to a procedural rule, and not to any substantive rule regarding minimality. One particular HREC may have its own guidelines on minimality, and another may not. According to the authors' own analysis with regard to the minimality condition, health research legislation evidently offers no corresponding substantive condition. Therefore, POPIA's minimality condition prevails in health research.

Example 2: Secondary research. POPIA (in section 15) does not require data subject consent for secondary research. However, the National Department of Health's 'Ethics in health research: Principles, processes and structures' (DoH Guidelines) require that if such secondary research is not within the scope of original broad consent, the research subjects should be re-consented.^[6] In the case of secondary research, a condition for the lawful processing of personal information found in health research sectoral legislation is therefore more extensive than POPIA's conditions, and hence prevails.

Example 3: Data subject participation. POPIA's data subject participation condition entails that a data subject has the right (in section 24) to, inter alia, have his or her personal information that is held by a responsible party corrected. In their supplementary document, the authors state that there are detailed provisions for the correction of clinical records in the Health Professions Council of South Africa (HPCSA) Guidelines, Booklet 9.^[7] The authors are correct, but the problem is that the HPCSA Guidelines, Booklet 9, only apply to patient records. In other words, they do not generally apply to all health research participants. Accordingly, POPIA's data subject participation condition fills a void in health research legislation.

 

Excursus: The issue of specific consent in health research

Bronstein and Nyachowe observe that I was involved in a debate on specific consent some years ago.^[8-10] In this debate, Townsend and I^[9] noted that it would be a misapplication of the legal doctrine of purposive interpretation to change the clear meaning of the word specific, as used in POPIA, to broad. What concerns me is that the authors mischaracterise our position in this debate. They suggest that we 'argue that the use of broad consent in health research is currently impermissible'. That is, however, not our position on broad consent. Our position is that broad consent on its own is insufficient for the purposes of compliance with POPIA. In our previous work, we provided examples of how health research projects can be planned using a combination of specific and broad consent in tandem, in order to comply with both POPIA and the DoH Guidelines at various stages of health research - including secondary research.^[5,9,11] Accordingly, the notion that we argued that broad consent is somehow 'impermissible' is inaccurate.

 

Conclusion

The exploration of POPIA's section 3(2)(b) in the context of health research by Bronstein and Nyachowe is a courageous venture into legal terra nova. Although I suggest that the authors' argument is flawed, their article has initiated debate that will hopefully lead to more clarity on this important topic. I invite the authors to reconsider their position in the light of my arguments.

Acknowledgements. I am grateful to Lee Swales for his valuable comments on earlier drafts of this manuscript. All remaining errors are mine alone.

Funding. I acknowledge support from the US National Institute of Mental Health and the US National Institutes of Health (award number U01MH127690). The content of this article is solely my responsibility and does not necessarily represent the official views of the US National Institute of Mental Health or the US National Institutes of Health.

D W Thaldar

School of Law, University of KwaZulu-Natal, Durban, South Africa thaldard@ukzn.ac.za

 

References

1. Bronstein V, Nyachowe DT. Streamlining regulatory processes for health researchers: To what extent does POPIA apply? S Afr Med J 2023;113(8):1319-1321. https://doi.org/10.7196/SAMJ.2023.v113i8.781        [ Links ]

2. Protection of Personal Information Act 4 of 2013. https://www.gov.za/documents/protection-personal-information-act (accessed 10 August 2023).         [ Links ]

3. Natal Joint Municipal Pension Fund v Endumeni Municipality 2012 (4) SA 593 (SCA).         [ Links ]

4. Bronstein V. Reconciling regulation or confronting inconsistency? Conflict between national and provincial legislation. S Afr J Hum Rights 2006;22(2):283-300. https://doi.org/10.1080/19962126.2006.11864891        [ Links ]

5. Thaldar DW, Townsend BA. Exempting health research from the consent provisions of POPIA. Potchefstroom Electronic Law J 2021;24:1-32. https://doi.org/10.17159/1727-3781/2021/v24i0a10420        [ Links ]

6. National Department of Health, South Africa. Ethics in health research: Principles, processes and structures. National Health Research Ethics Council, 2015. http://nhrec.health.gov.za/index.php/grids-preview (accessed 10 August 2023).         [ Links ]

7. Health Professions Council of South Africa. Guidelines for good practice in the healthcare professions: Guidelines on the keeping of patient records. Booklet 9. Pretoria: HPCSA, 2016. https://www.hpcsa-blogs.co.za/wp-content/uploads/2022/08/Booklet-9-Guidelines-on-Patient-Records.pdf (accessed 10 August 2023).         [ Links ]

8. Staunton C, Adams R, Botes M, et al. Safeguarding the future of genomic research in South Africa: Broad consent and the Protection of Personal Information Act No. 4 of 2013. S Afr Med J 2019;109(7):468-470. https://doi.org/10.7196/SAMJ.2019.v109i7.14148        [ Links ]

9. Thaldar DW, Townsend BA. Genomic research and privacy: A response to Staunton et al. S Afr Med J 2020;110(3):172-174. https://doi.org/10.7196/SAMJ.2020.v110i3.14431        [ Links ]

10. Staunton C, Adams R, Botes M, et al. Privacy rights of human research participants in South Africa must be taken seriously. S Afr Med J 2020;110(3):175-176. https://doi.org/10.7196/SAMJ.2020.v110i3.14450        [ Links ]

11. Townsend BA, Thaldar DW. Navigating uncharted waters: Biobanks and informational privacy in South Africa. S Afr J Hum Rights 2020;35(4):329-350. https://doi.org/10.1080/02587203.2020.1717366        [ Links ]