ARTICLE

 

The role of Data Transfer Agreements in ethically managing data sharing for research in South Africa

 

 

S Mahomed^I; G Loots^II; C Staunton^III

^IBCom, LLB, LLM, PhD; School of Law, Department of Jurisprudence, UNISA, Pretoria; Steve Biko Centre for Bioethics, University of the Witwatersrand, Johannesburg, South Africa
^IIMHSc; Department of Science and Innovation, Pretoria, South Africa
^IIIBCL, LLM, PhD Institute for Biomedicine, Eurac Research, Bolzano, Italy

Correspondence

 

 

---

ABSTRACT

A multitude of legislation impacts the use of samples and data for research in South Africa (SA). With the coming into effect of the Protection of Personal Information Act No. 4 of 2013 (POPIA) in July 2021, recent attention has been given to safeguarding research participants' personal information. The protection of participants' privacy in research is essential, but it is not the only risk at stake in the use and sharing of personal information. Other rights and interests that must also be considered and safeguarded include the right to non-discrimination, the right to dignity, and the right to enjoy the benefits of scientific progress. This can be achieved by ensuring that the ethical values and universal principles that underpin the research landscape, namely equity, reciprocity, justice and solidarity, are embedded in the regulatory framework for the management and use of personal information. This paper advocates an integrated bioethics approach to the use of personal information for research in SA. A key feature in embedding such an approach is a Data Transfer Agreement (DTA) that appropriately integrates the safeguards and protections set out by our regulatory framework with bioethical rules and procedures when personal information is used and shared for research purposes. This paper thus calls for the development of a national DTA that is guided by key ethical principles when data are shared for research purposes. This paper will be followed by a webinar on 23 June 2022 hosted by the Department of Science and Innovation and the SA Medical Research Council, where the recommendations and suggestions set out herein will be unpacked, discussed and debated by relevant stakeholders.

---

 

 

Data sharing and open science is emerging as an important feature in collaborative research, particularly data-intensive research methods.^[1] It has been credited with producing more reproducible science, maximising the use of an important resource, encouraging innovation,^[2] and holding great potential for the improvement of patient-centred care.^[3]

The COVID-19 pandemic highlighted the importance of the rapid transfer of samples and data in expediting research towards treatment, diagnoses, prevention and understanding the spread of disease.^[4] Unsurprisingly, this has led to calls for sample and data sharing to apply to general research, outside of pandemics.^[5] In this context, South Africa (SA) is making strides towards developing policies which promote open science, with both the Draft National Open Science Policy and the Draft National Data and Cloud Policy promoting open data sharing in line with international best practice. However, it is essential that any such data sharing and open science initiatives are in line with SA's robust legal and ethical framework for research.

Different legislation impacts the use of samples and data for use in research (in particular, health research) in SA.^[6-91 However, the coming into effect in July 2021 of the Protection of Personal Information Act No. 4 of 2013 (POPIA) has brought safeguarding research participants' personal information to the fore. This paper uses personal information and data interchangeably. As POPIA seeks to give effect to the constitutional right to privacy, these initial discussions have primarily focused on participants' privacy, the role of consent and legal status of broad consent,^[10-12] with limited consideration of the wider issues related to the use of personal information for research in SA.^[13] The protection of participants' privacy in research is essential, but it is not the only risk at stake for participants in the use and sharing of personal information. Other rights and interests that must also be considered and safeguarded include the right to non-discrimination, the right to dignity, and the right to enjoy the benefits of scientific progress. These can be achieved by ensuring that the ethical values and universal principles that underpin the research landscape, namely equity, reciprocity, justice and solidarity, are embedded in the regulatory framework on the management and use of personal information.

We therefore advocate an integrated bioethics approach to the use of personal information for research in SA, an approach that has been proposed elsewhere.^[141 Such an approach can help ensure that the use and sharing of these data protects and respects other ethical values and universal principles and not only the right to privacy. A key feature in embedding such an approach is a Data Transfer Agreement (DTA) that appropriately integrates the safeguards and protections set out by our regulatory framework with bioethical rules and procedures when personal information is used and shared for research purposes. Currently, SA has no uniform DTA available for use by researchers which incorporates both legal and ethical safeguards for data transfer within and outside the country.

This paper calls for the development of a national DTA that is guided by key ethical principles when data are shared for research purposes, and should be seen as a first step in the development of a national DTA. Its purpose is to stimulate discussion and reflection on this topic. It begins by providing an outline of the current regulatory framework concerning data sharing in SA. It then sets out a road-map and the principles underpinning a national DTA. It further discusses benefit sharing as a key ethical principle, and ends with a DTA template for further deliberation. This paper will be followed by a webinar on 23 June 2022 hosted by the Department of Science and Innovation and the SA Medical Research Council, where some of these and other recommendations and suggestions set out herein will be widely discussed and debated by relevant stakeholders.

 

Regulatory framework for sharing data for research in SA

The processing of personal information is regulated by POPIA. 'Processing' is widely defined and includes collection, recording, collation, storage, modification, use, dissemination or distribution of personal information. When personal information is processed, eight conditions must be satisfied: (i) accountability; (/7) processing limitation; (iii) purpose specification; (/V) further processing limitation; (v) information quality; (vi) openness; (vii) security safeguards; and (viii) data subject participation. It is the responsibility of the responsible party (in the research context this may be the research institution or researcher) to ensure that personal information is processed lawfully and meets the eight conditions of POPIA, and in a manner that does not infringe on the constitutional rights of individuals to privacy. Thus, personal information that is shared or transferred between national institutions must be in line with POPIA, Research Ethics Committee (REC) approval and the participant's consent or appropriate waivers.

In addition to meeting the conditions set out in POPIA, transferring personal information outside of SA must meet one of the bases set out in Section 72. In principle, it is for the responsible party to ensure that a foreign country receiving personal information has as high a level of data protection as offered under POPIA, when data are shared or transferred.¹¹⁵¹ There are five possible grounds under which an international transfer can take place but only three appear likely for research purposes.

First, according to section 72(1)(a) of POPIA, transfers can take place if the law in the jurisdiction of the recipient country provides an adequate level of protection that upholds principles that are substantially similar for the processing of personal information. This should be in the form of a law, or binding corporate rules, or a binding agreement between the parties. Broadly echoing the requirements of the General Data Protection Regulation (GDPR), for initial and onward transfers of data there must be provisions in place so that the personal information continues to have the same protections and safeguards as provided by POPIA.

Second, section 72(1)(b) of POPIA indicates that data transfers may also take place where the research participant consents to the transfer. However, consent as a ground for transfer will not be possible if the research participant is not provided with details of the third party with whom the data will be shared and the risks associated with that sharing. In the case of international data sharing, this information may not be known at the time the initial consent was obtained. Furthermore, as per section 11(2)(b) of POPIA, the research participant must be able to withdraw their consent at any time. If there are no mechanisms in place to respect this withdrawal after transfer has taken place, then consent is not a ground that can be used.^[16]

Third, section 72(1)(e) provides that data transfers may occur where it is for the benefit of the participant, and consent to the transfer is not reasonably practicable to obtain, recognising that if it were reasonably practicable, then the participant would be likely to provide it. This ground requires that the transfer is for the benefit of each individual research participant, entailing that a decision to this effect would need to be made per participant. This may be impractical and even impossible where large data sets are transferred outside SA.

It therefore appears that international transfers are most likely to occur based on section 72(1)(a). In the absence of binding corporate rules, the transfer of personal information for research is likely to take place only if there is a law or a binding agreement in place that provides for substantially similar protections as POPIA. The Office of the Information Regulator has not provided a list of countries that it has assessed as having a substantially similar level of protection as that of SA, nor the criteria or factors that should be considered in making this assessment. Thus, researchers are left with making this assessment themselves, or opting for a binding contractual agreement, for example a DTA which appears to be the most practical solution when personal information is transferred outside SA for research.

Currently, the South African Material Transfer Agreement (SAMTA) template gazetted in July 2018, provides guidance for researchers for the transfer of samples and data outside the country. The template includes benefit sharing arrangements to be negotiated prior to transfer, the regulation of secondary uses, permits the use of broad consent with Human Research Ethics Committee (HREC) oversight and indicates that custodianship remains with the providing institute.^[7] However, the template is limited when the transfers of data for research are contemplated, which may be because it was published prior to POPIA coming into effect. The template has received criticism^[17] and the fact that it is a guidance document only may cause sections of it to be regarded as unimportant and excluded by researchers when completing it.^[18] We therefore advocate that a national DTA, that is POPIA compliant, complement the current SAMTA with a view to having one consolidated document for the transfer of samples and data in the long term, and propose the following roadmap to achieve this.

Road-map and principles underpinning a national DTA

As a first step, we must consider whether the DTA should be distinct from the SAMTA. Unlike data, samples are a finite resource and there are scientific and ethical justifications for restricting access to the samples that may not apply to data. Furthermore, in the South African context, there are cultural considerations in the access to and use of samples^[19,20] that may not arise in the use of data, or at least, which have not yet been appropriately unpacked."^[13] One possible solution which requires further discussion is to integrate the development of a new DTA with the current SAMTA, thus streamlining the process.

A second step is to consider what data should be included as requiring a DTA. It is clear that the transfer of personal data on the basis of section 72(1)(a) requires a DTA, but what of aggregate data, or unpublished research results? Although controversial, the Draft National Data and Cloud Policy promotes open data sharing and aims to transform SA into a digital economy that is both data intensive and data driven. Published in April 2021, it applies to everyone and all institutions, both public and private, and states that any data generated in the country will be owned by SA regardless of where the technology used to generate it is situated or where the technology company is domiciled.^[21] The policy also indicates that any data transfer (not only personal data) outside SA must comply with POPIA and international best practice, thus extending the application of POPIA to data and international data transfers that are currently not under its remit.^[13] The purpose of a DTA is not just the protection of personal data in line with participants' preferences, but also the conditions of the transfers, the purpose for which the data can be used and further shared, to guard against misuse of the data, and also to specify conditions of intellectual property ownership. The DTA can therefore protect data as a resource and guard against the misuse and exploitation of data generated in SA. These considerations equally apply not only to personal data, but also to other forms of data, requiring consideration of whether a DTA should also be required.

Related to this is a third step and consideration of which data-sharing relationships require a DTA. Undoubtedly the sharing of any personal data for research will require a DTA, but what of data that are deposited in a database? Do these require a DTA? Answering these questions requires unpacking the different types of data that can be shared, the context in which they are to be shared, and whether a DTA can protect as well as enable the use of the data in the context in which it is shared.

Having considered whether this process includes data and samples, and having mapped out the types of data that can be shared for research as well as the differing contexts in which they are shared, a fourth step is the identification of the principles that should underpin a national DTA which must be informed by the SA ethico-legal regulatory framework. The principles of POPIA that include accountability, openness and safeguarding security are essential and legislatively required. However, POPIA is not a research regulatory framework per se. As the proposed DTA concerns transfers for research, it is critical that the ethical principles that underpin health research in SA and as set out in the quasi-legal NDoH Ethics Guidelines 2015, are incorporated within the DTA. We must consider other rights including the right to non-discrimination, the right to dignity, and the right to enjoy the benefits of scientific progress. Added to this, we must also consider how these rights and ethical principles are to be balanced against the principles of open science in SA.

The draft national open science policy^[22] is set within a broader government policy context of socio-economic development that takes cognisance of global issues as expressed within the Sustainable Development Goals.^[23] It follows the principle of 'as open as possible, as closed as necessary' to ensure that 'maximum benefit is derived from all publicly funded research.'^[24] Although the draft policy applies to research generated from public funds, section 4.1 does indicate that it shall be applied on a best-effort basis when research is funded by the private sector or by philanthropic funders and is made subject to contractual conditions requiring open science. The policy is guided by the principles of equity, fairness and collective benefit with all stakeholders having equitable opportunity to access, contribute to and benefit from open science. In addition, diversity and inclusiveness are emphasised through collaboration, participation and inclusion across participants in SA.^[22] The Draft Policy for Open Science also follows international best practice and includes CARE (Collective benefit, Authority to control, Responsibility and Ethics) as a guiding principle for open science in SA. This principle upholds the ethical and non-exploitative framing of research where data ecosystems are designed to ensure that benefit can be derived by indigenous peoples.

These guidelines, policies and legislative frameworks all seek to manage data. Identification of the principles to underpin a national DTA is necessary to ensure that there is an integrated bioethics approach to data transfers. At a minimum, the principles of accountability, transparency, non-exploitation, non-discrimination, equity and justice should guide the national DTA, but further consideration and reflection are needed.

The fifth step is to consider how the principles discussed above could inform the provisions of the DTA. In light of the country's historical exploitation and ancillary benefits and tokenism being veiled under the cloak of benefit sharing, it is critical that the issue of true benefit sharing is firmly grounded within the DTA. We now use this example to consider how this principle may inform the procedural operation of a DTA.

 

From principle to DTA provisions: Benefit sharing

To uphold equitable and just practices for health research, it is important to question not just the risks, but also the benefits of the research and to whom benefits will accrue. Exploitation occurs where justice-in-exchange does not exist. A broader understanding of Article 15 of the Universal Declaration of Bioethics and Human Rights (UDBHR) shows that there is an obligation to share abundance in the health environment with the needy outside the context of direct research.^[25] The historical exploitation of vulnerable communities, ethics dumping and predatory research^[26] illustrates the need to move away from a tokenism approach towards true benefit sharing, with benefit-sharing arrangements being embraced and contributed towards by both the provider and recipient of samples and data. While researchers in the global north are becoming more aware of global inequities, engagement with benefit sharing is still a largely abstract concept with limited translation into clear strategies which encourage more equitable practices.^[28] In addition, the lack of regulatory support and infrastructure for benefit sharing, including the absence of details in national and international ethics guideline documents, do little to guide the implementation of benefit-sharing agreements. As a result, institutions end up interpreting and implementing benefit sharing as they deem necessary.^[28] As a legal contract between parties, what role, if any, can a DTA have in implementing benefit sharing in SA?

Let us first consider benefit sharing and its purpose. It has been proposed that it is for the people participating in research to share in the benefits in some way,^[25] and H3Africa has stated that the main purpose should be improvement of health and welfare among African populations.^[29] The SAMTA template includes 'among other points, the sharing of information; use of research results; royalties; acknowledgement of the provider as the source of the materials; publication rights; transfer of technology or materials; and capacity building'as examples oftypes of benefits that may be considered in the health research context. More recently, Bedecker et al.^[27] proposed an example matrix identifying different types of benefit sharing that may take place during genomics research. In addition to financial benefit sharing, other intangible types of benefits in categories of health and well-being, infrastructure, equipment, skills capacity, knowledge, services capacity, career development, attribution and recognition are also established. The framework is divided into categories of benefits and stakeholders, including microlevel stakeholders at the individual and community level, mesolevel stakeholders such as institutions and organisations, and macrolevel stakeholders such as governments and regional or international organisations.^[27]

The SAMTA template indicates that the sharing of benefits should be discussed and negotiated between the providing and recipient institutes before transfer of materials takes place. These negotiations do not have to involve research participants or members of the community. Thus, benefits could be very much focused on the possible benefit to the providing institution only. Capacity building, use of research results, and overall strengthening of the providing institution should in the long term bring benefit to the country's population, but there is a lack of any direct benefit to the population from which the samples and data are obtained. This is unsurprising as the benefit-sharing contract is between the two institutions and can be binding on those two parties only. Whatever the benefit-sharing agreements are between institutions, the impact must be one that has the community at its focus. An REC provides oversight based on clear ethical principles. It is for the REC to ensure that these principles, including benefit sharing, are applied when data or samples are transferred. Thus, if incorporated within a DTA, parties can ensure that there is a direct benefit for the institution providing the data, and a direct or indirect benefit in the long term for the population.

Secondly, it is important to establish whether benefit sharing should apply in all instances. Benefit sharing should not be mandatory when data are shared between national institutions. However, where data leave the country and the recipient institute benefits from the use of the data, then benefit sharing must be implemented. However, where data are shared for purely altruistic purposes (for example, a philanthropic organisation that conducts research for the benefit and welfare of the national population only without any gain for itself) benefit sharing may not be necessary and a determination in this regard should be made by an REC.

Thirdly, it is necessary to establish how the costs towards benefit sharing should be managed. It is the responsibility of the providing institution to develop a benefit sharing arrangement with its community through sustained community engagement, but this will likely have financial implications. The DTA can assist in this by including cost recovery as part of its provisions. The collection, storage, analysis and all work associated with the curation of a dataset is costly and time consuming, and there is an ethical responsibility to ensure the sustainability of this resource. A cost-recovery plan will not charge for the samples and data themselves, but can recover some of the costs associated with sustaining the resource. Different tiers of cost will need to be applied according to the location of the receiver, the relationship between the provider and receiver (i.e. sharing in the context of a collaborative project, or sharing for the receiver to develop their own project), whether the receiver is for-profit or not-for-profit, for what purpose they may wish to recover costs (e.g. costs associated with just making the data available, or costs associated in collecting, storing, maintaining and now sharing this data), as well as the perspectives of the community. Cost recovery can provide direct financial support to sustain the resource, but also finances to support a benefit-sharing plan.

Cost-recovery plans are challenging, with different factors to be considered, but can be of huge benefit to the sustainability of dataintensive research methods in SA and overcome the financial hurdle in the development of benefit-sharing plans. We therefore urge that cost recovery become a part of the conversation on a DTA with a template to be followed in developing a cost-recovery plan. With the above principles in mind, we now provide recommendations on provisions to be included within the DTA.

 

Recommendations and conclusion

The development of a national DTA requires input and consideration from all relevant stakeholders, including scientists, research councils, government departments and research institutes. To further this conversation, we propose in the appendix (https://www.samedical.org/file/1843) certain provisions that should, at a minimum, be included in the DTA and a 'think box' of further issues that require unpacking at the webinar on 23 June.

 

Declaration. None.

Acknowledgements. None.

Author contributions. Equal contributions.

Funding. None.

Conflicts of interest. None.

 

References

1. Staunton C, Barragán CA, Canali S, et al. Open science, data sharing and solidarity: who benefits? HPLS 2021;43:115. https://doi.org/10.1007/s40656-021-00468-6        [ Links ]

2. Mulder N, Adebamowo CA, Adebamowo SN, et al. Genomic research data generation, analysis and sharing - challenges in the African setting. Data Sci J 2017;16:49. https://doi.org/10.5334/dsj-2017-049        [ Links ]

3. Kalkman S, van Delden J, Banerjee A, et al. Patients' and public views and attitudes towards the sharing of health data for research: A narrative review of the empirical evidence. J Med Ethics 2022;48(1):3-13. https://doi.org/10.1136/medethics-2019-105651        [ Links ]

4. Genomic sequencing in pandemics. Editorial. Lancet 2021;397(10273):445.https://doi.org/10.1016/S0140-6736(21)00257-9        [ Links ]

5. Singh S, Cadigan RJ, Moodley K. Challenges to biobanking in LMICs during COVID-19: Time to reconceptualise research ethics guidance for pandemics and public health emergencies? J Med Ethics 2021. https://doi.org/10.1136/medethics-2020-106858

6. South Africa. National Health Act No. 61 of 2003.

7. South Africa. Material Transfer Agreement for Human Biological Materials. Government Notice 719, Government Gazette 41781 of 20 July 2018.

8. South Africa. Protection of Personal Information Act No. 4 of 2013.

9. South Africa. National Department of Health. Ethics in Health Research, Principles, Processes and Structures, 2015.

10. Staunton C, R Adams, M Botes, et al. Safeguarding the future of genomic research in South Africa: Broad consent and the Protection of Personal Information Act 2013. S Afr Med J 2019;109(7):468. https://doi.org/10.7196/SAMJ.2019.v109i7.14148        [ Links ]

11. Thaldar DW, Townsend B. Genomic research and privacy: A response to Staunton et al. S Afr Med J 2020;110(3):172-174. https://doi.org/10.7196/SAMJ.2020.v110i3.14431        [ Links ]

12. Thaldar DW, Townsend BA. Exempting health research from the consent provisions of POPIA. PER J 2021;24. https://doi.org/10.17159/1727-3781/2021/v24i0a10420

13. Staunton C, Tschigg K, Sherman G. Data protection, data management, and data sharing: Stakeholder perspectives on the protection of personal health information in South Africa. PLoS One 2021;16(12): e0260341. https://doi.org/10.1371/journal.pone.0260341        [ Links ]

14. Staunton C, Slokenberga S, Parziale A, Mascalzoni D. Appropriate safeguards and Article 89 of the GDPR: Considerations for biobank, databank and genetic research. Front Genet 2022;13:719317. https://doi.org/10.3389/fgene.2022.719317        [ Links ]

15. Adams R, Adeleke F, Anderson D, et al. POPIA code of conduct for research. S Afr J Sci 2021;117(5-6):1-12. https://doi.org/10.17159/sajs.2021/10933        [ Links ]

16. Mahomed S, Staunton C. Ethico-legal analysis of international sample and data sharing for genomic research during COVID-19: A South African perspective. Biolaw J 2021;(1):261-276. https://doi.org/10.15168/2284-4503-785        [ Links ]

17. Thaldar DW, Botes M, Nienaber AG. South Africa's new standard material transfer agreement: Proposals for improvement and pointers for implementation. BMC Med Ethics 2020;21(85). https://doi.org/10.1186/s12910-020-00526-x        [ Links ]

18. Steytler M, Thaldar DW. Public health emergency preparedness and response in South Africa: A review of recommendations for legal reform relating to data and biological sample sharing. S Afr J Bioethics Law 2021;14(3):101-106.         [ Links ]

19. Moodley K, Sibanda N, February K, et al. 'It's my blood': Ethical complexities in the use, storage and export of biological samples: Perspectives from South African research participants. BMC Med Ethics 2014;15(4). https://doi.org/10.1186/1472-6939-15-4        [ Links ]

20. Moodley K, Singh S. It's all about trust: Reflections of researchers on the complexity and controversy surrounding biobanking in South Africa. BMC Med Ethics 2016;17(57). https://doi.org/10.1186/s12910-016-0140-2        [ Links ]

21. BusinessTech. Controversy over proposed internet and data changes for South Africa. https://businesstech.co.za/news/cloud-hosting/504715/controversy-over-proposed-internet-and-data-changes-for-south-africa/ (accessed 28 February 2022).

22. South African Department of Science and Innovation. Draft National Open Science Policy v19 24.01.2022.

23. United Nations Organization. Department of Economic and Social Affairs. The 17 Goals. https://sdgs.un.org/goals (accessed 1 March 2022).

24. Department of Science and Innovation, South Africa. Section 11 of the Draft National Open Science Policy v19.

25. Rheeder AL. Benefit-sharing as a global bioethical principle: A participating dialogue grounded on a Protestant perspective on fellowship. Skriflig 2019;53(1):a2502. https://doi.org/10.4102/ids.v53i1.2502        [ Links ]

26. Schroeder D, Cook J, Hirsch F. Ethics Dumping: Case Studies From North-South Research Collaborations. New York: Springer International, 2017.         [ Links ]

27. Bedeker A, Nichols M, Allie T, et al. A framework for the promotion of ethical benefit sharing in health research. BMJ Global Health 2022;7: e008096. https://doi.org/10.1136/ bmjgh-2021-008096        [ Links ]

28. Sudoi A, De Vries J, Kamuya D. A scoping review of considerations and practices for benefit sharing in biobanking. BMC Med Ethics 2021;22(1):102. https://doi.org/10.1186/s12910-021-00671-x        [ Links ]

29. H3Africa. Ethics and governance framework for best practice in genomic research and biobanking in Africa. https://h3africa.org/wp-content/uploads/2018/05/Final-Framework-for-African-genomics-and-biobanking_SC-.pdf (accessed 4 March 2022).

 

 

Correspondence:
S Mahomed
mahoms1@unisa.ac.za

Accepted 17 March 2022

 

 

Supplementary Data

The supplementary data is available in pdf: [Supplementary data]