CORRESPONDENCE

 

Building coherence in the regulation of health research: A reply to Thaldar

 

 

Bronstein and Nyachowe respond: Our article 'Streamlining regulatory processes for health researchers: To what extent does POPIA apply?'^[1] examines the impact of section 3(2)(b) of the Protection of Personal Information Act 4 of 2013 (POPIA)^[2] on health research. Prof. Thaldar provides a helpful response to our article in order to develop the debate about the application of POPIA to health research.

Section 3(2)(b) of POPIA reads as follows:

'(b) If any other legislation provides for conditions for the lawful processing of personal information that are more extensive than those set out in Chapter 3 'of POPIA1, the extensive conditions prevail.'

Section 3(2)(b) sets out the circumstances in which other legislation prevails over the conditions found in chapter 3 of POPIA. In our article, we argue that the sectoral legislation that governs health research provides more extensive conditions for the lawful processing of personal information than chapter 3 of POPIA does. The sectoral legislation for health research therefore prevails over chapter 3 of POPIA.

Section 3(2)(b) of POPIA is an enigmatic provision that needs to be interpreted in a way that makes the law as coherent as possible. Prof. Thaldar disagrees with our suggestion that the sectoral legislation for health research prevails over chapter 3 of POPIA in its entirety. The disagreement between us takes a technical turn, so we will start by giving an explanation of the concepts that we use.

Our interpretation is that Prof. Thaldar favours a direct conflict test to manage conflict between POPIA and the sectoral legislation, while we advocate use of an interpretive device similar to field pre-emption. The direct conflict test asks whether two legislative provisions can be obeyed at the same time. If they can, then there is no conflict between them and both pieces of legislation should be obeyed simultaneously. If there is conflict between them, there needs to be a rule about which piece of legislation prevails. Prof. Thaldar proposes that the legislative provision that gives the most comprehensive protection to data subjects should prevail. The consequence of Prof. Thaldar's approach is that the legal interpreter bounces back and forth between POPIA and the sectoral legislation looking for the provisions that provide most protection to data subjects. The question of which legislative provision applies to a particular aspect would need to be decided on a case-by-case basis depending on which is most advantageous to the data subject. An important problem with this method is that a new regulatory scheme is fashioned through a haphazard process of comparison. A product is created that could never have been considered or intended by the legislature. In addition, the interests of data subjects are mechanically prioritised over the social interest in health research.

Our approach is different, because we argue that a device analogous to field pre-emption is encoded in section 3(2)(b) of POPIA. Field pre-emption is a legal concept that was developed by judges in the USA and Australia in the context of federalism jurisprudence. In outline, the doctrine of field pre-emption is as follows:

1. In the USA competent federal (national) law prevails over state (provincial) law.

2. Under the doctrine of field pre-emption, even if the national legislature has not explicitly said that state law is overridden by federal legislation, 'state laws cannot stand if they ... interfere with a comprehensive regulatory system set up by Congress [i.e. the national legislature]'.^[3]

The analogy is that section 3(2)(b) of POPIA tells us that other legislation prevails over chapter 3 of POPIA where that other legislation provides more extensive conditions for the processing of personal information than chapter 3 of POPIA does. To paraphrase: the provisions in chapter 3 of POPIA cannot stand if they interfere with a comprehensive regulatory system set up in sectoral legislation. We therefore argue that the sectoral legislation applies to the exclusion of chapter 3 of POPIA.

In the paragraphs that follow, we deal with Prof. Thaldar's response to our article in detail and elaborate on the conclusions presented in our article.

 

The disagreement

Prof. Thaldar disagrees with our interpretation of section 3(2)(b) of POPIA. He correctly characterises our argument about the applicability of POPIA to health research in the following way:

1. The conditions for the lawful processing of personal information, as provided in chapter 3 of POPIA, do not apply to health research in South Africa (SA). This is based on our interpretation of section 3(2)(b) and particularly our interpretation of the words 'more extensive than used in that subsection.

2. Consequently, the sectoral legislation regulating health research ought to apply to the exclusion of chapter 3 of POPIA. This is based on our analysis that the sectoral legislation is more detailed, thorough and comprehensive and hence 'more extensive than' the conditions set out in chapter 3 of POPIA.

3. Based on this, we argue that chapter 3 of POPIA does not apply to health research.

Prof. Thaldar argues that we use the wrong unit of comparison in our article. In his view, our mistake is that we compare the two legislative schemes (which are chapter 3 of POPIA on the one hand and the sectoral legislation that regulates health research on the other). In his opinion, section 3(2)(b) requires a comparison of individual legislative provisions. In other words, he argues that it is necessary to ask the following questions in order to establish which legislation prevails:

1. Does a specific legal rule found in the sectoral legislation for health research provide more extensive protection of the rights of the data subject(s) than any of POPIA's conditions?

2. 'If the answer is in the affirmative, the legal rule found in health research sectoral legislation would prevail - but only that specific legal rule, and not the health research legislation generally.

We therefore suggest that Prof. Thaldar explicitly adopts a direct conflict test to establish which legislation prevails.^[4]

Prof. Thaldar is correct in pointing out that when we analyse the meaning of section 3(2)(b), our unit of comparison is the corpus of legislation. We compare the sectoral legislation for health research with the conditions in chapter 3 of POPIA in order to determine which is more extensive. Prof. Thaldar's analysis requires a comparison of particular provisions of POPIA with individual legislative provisions in the sectoral legislation. His argument faces an extra hurdle, as he has to establish a basis for comparing the provisions. In order to solve this problem, he argues that the legislative provision that best protects the data subject prevails over the one that does not.

 

Primacy of the rights of data subjects

Prof. Thaldar argues that the privacy interests of data subjects are paramount in POPIA. Section 3(2)(b) of POPIA therefore needs to be interpreted in order to maximise the protection of data subjects.

In our view, Prof. Thaldar's argument does not cohere with the multiple legislative purposes that are set out explicitly in section 2 of POPIA (also see section 3(3) of POPIA). We agree that POPIA has the important purpose of protecting the rights of data subjects - but at the same time, the Act regularly limits those rights in a way that is justifiable under the limitation clause of the Constitution. POPIA also engages with other constitutional rights, most notably the rights to freedom of expression and access to information. For example, section 7 of POPIA creates a journalistic exception that is necessary in a democratic society. It seems to us that the argument that section 3(2)(b) always needs to be interpreted in a way that gives maximum protection to data subjects cannot be sustained.

 

A preliminary point: Recourse to federalism literature and the doctrine of pre-emption

We argue that the doctrine of field pre-emption is a useful tool for interpreting section 3(2)(b) of POPIA. Prof. Thaldar criticises our recourse to the doctrine on the basis that it has never been part of SA law. Rather, it is part of US and Australian federalism jurisprudence. Prof. Thaldar points out that all the legislation mentioned in our article operates in the national as opposed to the provincial sphere. He also quotes one of us who had previously shown that the doctrine of pre-emption cannot simply be applied to federalism jurisprudence in SA.^[4] So far, all Prof. Thaldar's observations are manifestly true.

So, what is our justification for raising foreign federalism jurisprudence in this context? Although section 3(2)(b) of POPIA is a very unusual provision, it is uncontroversial that it sets out circumstances in which the conditions in chapter 3 of POPIA will not prevail.

The federalism literature is useful because it demonstrates the complexity of resolving conflict between two corpuses of competent, valid legislation operating in the same field or appearing to regulate the same subject matter. The limitations of the direct conflict test for dealing with conflict between national and provincial legislation are well documented.^[5] In response to these difficulties, judges in the USA and Australia have fashioned indirect conflict tests and developed the doctrine of field pre-emption. (If one wishes to avoid resorting to the doctrine of field pre-emption, it is possible to get the same results using what is known as an 'indirect conflict test' for legislative conflict.^[6]) In any event, the doctrine of field preemption originates from case law that applies tenets of statutory interpretation that are shared by all common law jurisdictions. In our view, the doctrine of pre-emption has much to add to the current debate. We will show later that the pattern of reasoning in the pre-emption cases resonates with the type of legislative conflict invoked by section 3(2)(b) of POPIA.

Prof. Thaldar emphasises that all the legislation mentioned in our article is national legislation. In our view, this simplifies matters. Our circumstances are automatically less politicised than they would be if we were dealing with a federalism dispute. (For example, see the highly politicised US dispute about whether FDA regulation of abortion medications pre-empts state laws that ban abortion.^[7]) In our case, we are not dealing with contestation about which political authority has power over the subject matter. Parliament has the power to amend POPIA or any of the sectoral legislation for health research in order to give full effect to its intention.

 

The unit of comparison: The specific provision or the corpus of legislation

We argue that the appropriate unit of comparison for the purposes of section 3(2)(b) of POPIA is the corpus of sectoral legislation regulating health research. We compare this body of legislation with the conditions in chapter 3 of POPIA as a whole. We argue that when the two legislative fields are compared, the 'more extensive' one prevails.

Prof. Thaldar's direct conflict test for dealing with legislative conflict conceptualises both POPIA and the sectoral legislation regulating health research as if they were compilations of discrete rules. This mischaracterises the legislative schemes, which are both infused with legal principles.

The doctrine of field pre-emption is designed to be respectful of the regulatory architecture of conflicting legislative schemes. It incorporates a 'spatial metaphor' for conceptualising legislative conflict.^'61 In the federalism context, judges use the doctrine of preemption in circumstances where the national legislation 'establishes a complete and exhaustive regulatory scheme' that conflicts with state or provincial legislation.^[6] The pervasiveness of competing legislation is an 'important benchmark' that encourages judges to take the view that a particular corpus of national legislation prevails over competing legislation.^[8] Pre-emption operates in circumstances where the legislative field appears to be 'fully occupied' or where the prevailing legislation does not leave space for conflicting legislation.^[9] In the federalism context, if the Court finds that the legislative field is fully occupied by national legislation, then the national legislative scheme prevails in toto. As a consequence, the individual provisions in the competing (provincial) legislation are submerged and do not apply.

We suggest that the doctrine of pre-emption is effectively baked into the wording of section 3(2)(b) of POPIA. As with pre-emption, the comprehensiveness of the competing legislative scheme or its extensiveness determines which legislation prevails. The doctrine of pre-emption provides an elegant solution to the interpretive difficulties posed by section 3(2)(b) of POPIA in the health research field.

More compellingly, our argument about the correct interpretation of section 3(2)(b) treads carefully on the SA corpus of sectoral legislation for health research. That is appropriate, because in our view, the provisions in the sectoral legislation reflect 'neither a maximum nor a minimum standard but one representing a unique balance of considerations'.^[9] The sectoral legislation balances the interests of data subjects with the social interest in ethical medical research that is as safe as possible. In our view, section 3(2)(b) of POPIA has the impact of preserving and prioritising the corpus of sectoral legislation as a coherent whole to the exclusion of chapter 3 of POPIA. We therefore reject Prof. Thaldar's criticism that our analysis focuses on the 'sheer volume of legal and ethical rules, structures and procedures, with relatively little regard to the actual content of these rules'. Far from being an 'arbitrary measure', each of the 'rules, structures and procedures' reflects particular legislative choices made in the context of health research, and they should be implemented.

Our view is fortified by the presumption in the interpretation of statutes that 'when the legislature has given attention to a separate subject and made provision for it, the presumption is that a subsequent general enactment is not intended to interfere with the special provision, unless it manifests that intention very clearly'.^[10]

 

The specific examples raised by Prof. Thaldar

Minimality. Prof. Thaldar suggests that the sectoral legislation for health research offers no corresponding condition to the principle of minimality found in POPIA. He does, however, partly accept our statement that the minimality principle finds expression in the ethics approval process - in the sense that researchers are required to justify collection and use of data before their research protocols can be approved. Prof. Thaldar correctly points out that the latter requirement is procedural and not substantive, although scrutiny by a health research ethics committee (HREC) is a rigorous requirement. There are also instances where the substantive aspect of minimality is specifically encoded in the National Department of Health 'Ethics in health research: Principles, processes and structures' (DoH Guidelines).^[11] For example, paragraphs 3.2.2.1 - 3.2.2.4 only allow children to participate in health research 'when their participation is scientifically indispensable', and then they can only be exposed to 'minimal risk'.^[11]

Minimality is a core concept in the General Data Protection Regulation and POPIA because it protects the freedom and autonomy of data subjects. On the other hand, Wouters et al.^[12] point out that '... the principle of data minimization seems to conflict with the usage of big data analytics in health and research'.

We agree with Prof. Thaldar's observation that minimality is not a high priority in the sectoral legislation regulating health research. In our view, this points to a strength and not a weakness in the sectoral legislation. HRECs need to approve data collection and use for health research. They are expert bodies that are best positioned to protect the interests of data subjects without stymieing the benefits of health research.

Secondary research. We agree with Prof. Thaldar that the sectoral legislation for health research prevails over POPIA.

Data subject participation. Prof. Thaldar refers to the fact that POPIA gives data subjects the right to have their personal information corrected. Although he acknowledges that patients have a right to have their health records corrected (and clinical data are often used in health research), he takes the view that the sectoral legislation does not extend the right of correction to all health research participants. He argues that POPIA 'fills a void in health research legislation' by providing a right of correction to all participants in health research.

We do not agree that there is any gap or void in the sectoral legislation for health research. The DoH Guidelines prioritise the need for accurate data. If any inaccuracy is pointed out by the data subject or anyone else, researchers have a duty to promptly correct the record. (Transparency and openness are fundamental principles in the DoH Guidelines - see paragraphs 6.3.11 of the Health Professions Council of South Africa Guidelines, Booklet 13,^[13] and 3.5.2.3 of the DoH Guidelines.^[11]) This fortifies our argument that the sectoral legislation occupies the entire health research field.

 

Conclusion

The contributions made in this debate evidence the importance of clarifying the application of POPIA to health research. We are grateful for the constructive engagement with Prof Thaldar. We do, however, stand by our position about health research generally as well as our position on consent in particular. Section 3(2)(b) of POPIA puts health researchers and institutions that conduct health research in a position where they have to decide whether to apply POPIA's conditions or other legislation. This debate has shown that this exercise ought to be carefully considered.

Acknowledgements. The authors thank Scott Hazelhurst for his generous assistance.

Funding. Research reported in this publication was supported by the Fogarty International Center and National Institute of Biomedical Imaging and Bioengineering and OD/Office of Strategic Coordination of the National Institutes of Health under Award Number U54 TW 012077. The content is solely the responsibility of the authors and does not necessarily represent the official views of the National Institutes of Health.

V Bronstein

Advocate of the High Court of South Africa Associate Professor, School of Law, University of the Witwatersrand, Johannesburg, South Africa victoria.bronstein@wits.ac.za

D T Nyachowe

on behalf of the MADIVA Research Hub Junior Researcher, Sydney Brenner Institute of Molecular Bioscience, Faculty of Health Sciences, University of the Witwatersrand, Johannesburg, South Africa

 

References

1. Bronstein V, Nyachowe DT. Streamlining regulatory processes for health researchers: To what extent does POPIA apply? S Afr Med J 2023;113(8):1319-1321. https://doi.org/10.7196/SAMJ.2023.v113i8.781        [ Links ]

2. Protection of Personal Information Act 4 of 2013. https://www.gov.za/documents/protection-personal-information-act (accessed 6 April 2022).         [ Links ]

3. Burris SC, Berman ML, Penn MS, Holiday TR. The New Public Health Law: A Transdisciplinary Approach to Practice and Advocacy. 2nd ed. New York: Oxford University Press, 2022:122.         [ Links ]

4. Bronstein V. Reconciling regulation or confronting inconsistency? Conflict between national and provincial legislation. S Afr J Hum Rights 2006;22(2):283-300. https://doi.org/10.1080/19962126.2006.11864891        [ Links ]

5. Tribe LH. American Constitutional Law, vol. 1. 3rd ed. New York: Foundation Press, 2000.         [ Links ]

6. Sagar A. Federal supremacy and the occupied field: A comparative critique. Publius 2013;43(2):251-274. https://doi.org/10.1093/publius/pjs034        [ Links ]

7. Grossi P, O'Connor D. FDA preemption of conflicting state drug regulation and the looming battle over abortion medications. J Law Biosci 2023;10(1):lsad005. https://doi.org/10.1093/jlb/lsad005        [ Links ]

8. Luif P. The division of powers/competences between the EU and the member states: What can we learn from preemption in the United States? In: Rossi LS, Casolari F, eds. The EU after Lisbon: Amending or Coping with the Existing Treaties? Cham, Switzerland: Springer, 2014:37-55. https://doi.org/10.1007/978-3-319-04591-7_3        [ Links ]

9. Davis MJ. The 'new' presumption against preemption. Hastings Law J 2009;61(5):1217. https://repository.uclawsf.edu/hastings_law_journal/vol61/iss5/3 (accessed 12 September 2023).         [ Links ]

10. R v Gwantshu 1931 EDL 29 at 31. The presumption is generalia specialibus non derogant.         [ Links ]

11. National Department of Health, South Africa. Ethics in health research: Principles, processes and structures. 2nd ed. Pretoria: NDoH, 2015. https://www.ru.ac.za/media/rhodesuniversity/content/ethics/documents/nationalguidelines/DOH_(2015)_Ethics_in_health_research_Principles,_processes_and_structures.pdf (accessed 12 September 2023).         [ Links ]

12. Wouters B, Shaw D, Sun C, et al. Putting the GDPR into practice: Difficulties and uncertainties experienced in the conduct of big data health research. Eur Data Prot Law Rev 2021;7(2):206-216. https://doi.org/10.21552/edpl/2021/2/9        [ Links ]

13. Health Professions Council of South Africa. Guidelines for good practice in the health care professions: General ethical guidelines for health researchers. Booklet 13. Pretoria: HPCSA, 2016. https://www.hpcsa.co.za/Uploads/professional_practice/ethics/Booklet_13_Gen_Ethical_Guidelines_for_Health_Researchers.pdf (accessed 16 May 2022).         [ Links ]