COMMENTARY

 

Repurposing research data for commercial use: POPIA, a foil or a facilitator?

 

 

Beverley Townsend^{I, II}; Amy Gooden^II; Marietjie Botes^{II, III, *}; Donrich Thaldar^{II, IV}

^IYork Law School, University of York, York, UK
^IISchool of Law, University of KwaZulu-Natal, Durban, South Africa
^IIISnT Interdisciplinary Centre for Security, Reliability, and Trust, University of Luxembourg, Luxembourg, Luxembourg
^IVPetrie-Flom Center for Health Policy, Biotechnology, and Bioethics, Harvard Law School, Cambridge, Massachusetts, USA

Correspondence

 

 

---

ABSTRACT

SIGNIFICANCE: For considerations of public policy, research in South Africa is not (merely) a purpose in itself, but a fundamental contributor to the South African economy. Because research data - which may consist of personal information - often has commercial value, it is important that we consider legal pathways for repurposing research data for commercial use. The POPIA draft Code of Conduct for Research should provide guidance in this regard

Keywords: research, commercialisation, repurposing, POPIA, Draft Code of Conduct for Research

---

 

 

Introduction

It is common practice for institutions around the world to conduct research using donated biological samples and related data. But what if a research institution wants to use the data generated from these samples for commercial applications, or license the use of the data, or sell the data to a commercial entity? Allegations of the commercialisation of data initially collected for research are not new, with companies, universities, and state departments purportedly selling and commercialising biological samples and/or the data originally collected for research purposes.^1-7 It is not only a matter of the repurposing of data initially collected for research for commercial use, but crucially that these activities may have been done without the knowledge or consent of the participants to whom the data relate. Individuals, it would seem, are less likely to donate altruistically if, unbeknown to them and without their consent, an organisation is to benefit financially from their contribution.⁷

Sound data protection practices form the backbone of lawfully and successfully securing public confidence in data use.⁸ This is particularly true in light of the dramatic increase in the volume of digitally available research information coupled with the ability to share such data widely. To this end, the South African Protection of Personal Information Act 4 of 2013 (POPIA) sets out measures to safeguard personal information. While much of the literature has focused on data collected for a commercial purpose - such as data stored in a commercial biobank -being further processed (or 'repurposed') for research use^9-18, we consider here the implications when the position is reversed: that is, when data collected for research are repurposed for commercial use. This would typically be the case if research yields data that are commercially valuable. Examples would be data sets containing the genomic sequences and health information of large groups of people.

Our intention in this Commentary is threefold. First, we suggest that the commercialisation of research data is a significant issue for the South African research community, as it is not only a public policy imperative, but, in certain crucial circumstances, a statutory duty.

Second, and in light of this, we analyse how POPIA might act both as a foil and a facilitator of secondary data use for purposes of commercialisation. This is to say that we consider, first and foremost, the legal position regarding the repurposing and commercialisation of research data, as stipulated in POPIA, rather than taking any ethical position one way or the other. We acknowledge that compelling ethical reasons underlie the requirement for, and availability of, high-quality, curated, unbiased, and representative data, and that there is enormous value and utility in granting wider access to discrete, aggregated data sets. Equally, however, and precipitated on important value judgements involving autonomy and self-determination, personal data may be used beyond the context for which consent was initially granted or 'repurposed' for other uses where the downstream commercial applications cannot always be anticipated, often contrary to user expectations. For example, the unsupervised and unregulated mass collection of biometric data was recently reported in 23 African countries by various third-party actors, the use of which is for unknown purposes.¹⁹ These are, unfortunately, not isolated anomalies, but are symptomatic of troubling precedent-setting trends in countries with inadequate privacy legislation and enforcement, and where privacy protection is not taken seriously. Guided by values, virtues, and considerations of human well-being, we need to rethink not just how data sets are used and re-used and for what purpose, and how innovative applications are built, but for whom and at what cost. Here, we thus demonstrate only, and narrowly, how POPIA helps to set guardrails for the repurposing of data for commercial use through the deployment of lawful data practices.

Finally, we make recommendations on how the proposed POPIA draft Code of Conduct for Research (for ease, we refer to it simply as the 'draft CCR'), recently published by the Academy of Science of South Africa (ASSAf)²⁰, can support the legislative framework by guiding the South African research community in this regard.

 

The importance of commercialising research data

Research and research data are invaluable to innovation and contribute significantly to the advancement of society. Research, while primarily and traditionally the domain of university research groups and university hospitals, is now increasingly being conducted by various actors and is frequently used in commercial applications.²¹ Universities remain one of the primary institutions driven to commercialise research. Investment in emerging research areas leads to better funding, new jobs, industry development, and enhanced collaboration between universities and industry, which is often required in translating research into valuable products and therapies for the public.^22,23 Examples of such applications are in producing vaccines^24,25, in clinical trials^26,27, and in the development of medications, treatments, and products by pharmaceutical companies, and others^22,26-29. Innovation and commercialisation promote economic growth and, in turn, advance human well-being and benefit society.²³

South African science and innovation policy supports the commercialisation of research results.^{30 33} This public policy position of support for commercialisation has even been enacted as a statutory duty in certain circumstances. The Intellectual Property Rights from Publicly Financed Research and Development Act 51 of 2008 (IPR Act) provides that where publicly financed research results in intellectual property (IP), such IP must be protected and commercialised in a way that benefits South Africa (section 2 of the IPR Act). In other words, from a South African public policy viewpoint, research is not (merely) a purpose in itself, but has the instrumental goal of building the South African economy. This public policy perspective of research underpins our analysis in this article.

 

Analysis

Preliminary observations

Concerning commercialisation, there are two scenarios at play: first, consideration of the repurposing of data, initially collected for a commercial purpose, for a subsequent research purpose; and second, consideration of the inverse position, that is, where data initially collected for research are commercialised. The tangential question of whether research participants are entitled to the benefits of such commercialisation is beyond the scope of this article. We provide two points of clarification before the position regarding purpose specification and further processing is described.

First, POPIA does not apply to the processing of de-identified personal information that is incapable of being re-identified (section 6(1)(b)), hence research data that have been de-identified and then used for commercial purposes fall beyond the remit of POPIA. True de-identification of data (and because of their nature, genomic data) is questionable.^9,34-37 Such data fall within POPIA, unless de-identified or otherwise excluded in terms of section 6.

Second, the Regulations Relating to Research with Human Participants (Human Research Participant Regulations)³⁸, published in terms of the National Health Act 61 of 2003 (NHA), provide that research participants must be informed of, inter alia, 'the expected benefits of the research' (regulation 5(e)) and 'the availability of beneficial products or interventions post-research (regulation 5(n)) - the implications of which are that any possible commercialisation must be communicated to research participants.

Purpose specification and further processing limitation

At the outset, section 13(1) of POPIA requires that personal information 'be collected for a specific, explicitly defined and lawful purpose' that is 'related to a function or activity of the responsible party' and that (except for cases that fall within section 18(4) of POPlA) the data subject (the individual 'to whom personal information relates' (section 1 of POPIA) which, in this case, is the research participant) must be made aware of the purpose of the collection of the personal information (section 13(2)). Therefore, where data that are initially collected for the specific and explicitly defined purpose of research are subsequently re-used for a different purpose, such as selling the data, and reasonably practicable steps are not taken to make the data subject aware of this, this contravenes section 13(2) of POPIA.

However, following this, and taking into account the specific purpose for which the data were collected (referred to in section 13 of POPIA), any further processing of personal information must be in accordance with (or compatible with) this specific purpose (section 15(1) of POPIA). So, in the event that the data were collected for a research purpose, any subsequent research would be allowable as it is in accordance with its initial purpose, that is, of research. However, on a reading of sections 13 and 15 of POPIA, prima facie, this means that where the activities of the responsible party do not include commercial purposes, and the data were not collected for a commercial purpose (that is, the purpose was solely for research), then the responsible party is not permitted to further process this information for a commercial purpose as it falls outside the scope of their activities and is not compatible with that initial purpose -namely research.

POPIA: 'Compatible'purpose

POPIA sets out what is meant by 'compatible' and what are deemed 'not incompatible' purposes in section 15. Others in the literature have posed antithetical meanings of 'compatibility' as situated within research: whether an initial collection of personal information for medical research may be more broadly interpreted to mean that any other medically related research is compatible, or whether compatibility should be attributed a far narrower meaning - that is to say, data collected for medical research on a specific medical condition such as, diabetes, for example, would exclude medical research on other conditions, say asthma.³⁹ We do not argue the particularities of these positions here, save to say that we examine the position regarding the 'compatibility' of data collected for research being repurposed for 'commercial use' - a use that we interpret in an extended sense as any commercial use and any further commercial use.

As a point of departure, section 15(2)(a)-(e) of POPIA implores us to assess the following criteria when determining compatibility: the relationship between the purpose of the further processing and collection (section 15(2)(a)), the nature of the information (section 15(2)(b)), the effect that the further processing may have on the data subject (section 15(2)(c)), the manner in which the information was collected (section 15(2)(d)), and any contractual duties that exist between the parties (section 15(2)(e)). Thus, to determine whether further processing is permitted in a given situation will depend upon the circumstances of the case, the conditions and contracts in place, as well as the information's nature and effect, and its intended use.

Where data were collected for a non-commercial purpose, such as for research, the presupposition is that the data cannot be commercialised, as it would fall outside of the scope of the original purpose of collection, thereby precluding further processing for commercial purposes (in terms of section 15(2)(a) of POPIA). But all is not lost. Notwithstanding the section 15(2) compatibility criteria, POPIA lists instances where an otherwise incompatible purpose may be deemed compatible.

POPIA: 'Not incompatible'purpose

POPIA clarifies specific instances, in section 15(3), that are deemed not incompatible (that is, they are compatible) with the purpose of collection. These instances are when: consent has been granted for the further processing (section 15(3)(a)), the information is contained in a public record or the data subject has deliberately made it public (section 15(3)(b)), the information is needed for legal purposes or national security interests (section 15(3)(c)), further processing is required in order to prevent a threat to health or safety (section 15(3)(d)), the information is used for 'historical, statistical or research purposes' and is further processed only for those purposes and will not be published in an identifiable manner (section 15(3)(e)), or an exemption has been granted in terms of section 37 (section 15(3)(f)).

In light of the above, consider a situation in which data that were initially collected for a commercial purpose are then used for a research purpose. In this instance, further processing is allowed in terms of section 15(3) (e) of POPIA as the 'historical, statistical and research purpose' provision can be relied upon, provided that the 'responsible party ensures that the further processing is carried out solely for such purposes and will not be published in an identifiable form' (section 15(3)(e)). However, the inverse is not true: data collected initially for a research purpose, save for relying on one of the provisions described in section 15(3) of POPIA in the paragraph above, cannot simply be re-used for commercial purposes. So, unless the commercial purpose falls within one of the section 15(3)(a)-(f) provisions, it will be of an incompatible purpose. Save for these particular instances, POPIA restricts the repurposing of research data for commercial purposes.

Accordingly, in situations where the information is in the public domain or is deliberately made public by the data subject, in terms of section 15(3) (b) of POPIA, the information may be used for the further commercialised purpose. Moreover, and importantly, in terms of section 15(3)(a) of POPIA, where the consent of the data subject has been obtained, a researcher may use their information for a commercial purpose because POPIA deems it to then be compatible with the purpose of collection (in this case, for research). But this purpose (that is, commercialisation) would still need to be specific and explicitly defined - in line with section 13(1) of POPIA. Although Staunton et al.⁴⁰ contended that POPIA can somehow be 'purposively interpreted' to allow for broad consent, we suggest that such an interpretation is incorrect.⁴¹ The language used in POPIA is unambiguous. Unless an exemption has been granted in terms of POPIA, the consent requirement in POPIA is specific consent - both for the initial collection (section 13(1)) and for the further processing (section 15(1) and (3)(b)).^42,43

What then of commercial applications which have a wide (and undetermined) scope at the time of collection and repurposing? In this regard, a contract between the responsible party and the data subject may shed some light on whether, and under what conditions, further processing is allowable. If a research participant were to agree to donate their biological material and/or data for the purpose of research, and the contract was silent or prevented the research institution from subsequently using these data for commercial purposes, then the further processing of research data for commercial reasons would not be allowable (in terms of section 15(2)(e) of POPIA). Much will, however, depend on the initial and subsequent purpose (for research or for commercial use), what has been specifically consented to, and the nature and extent of such consent. As a solution of last resort, data subjects may need to re-consent if the stipulated consents are not in place.

Enabling repurposed research data commercialisation

POPIA offers a further possible enabling solution - one that is an alternative to obtaining consent - in section 15(3)(b). This section deems information contained in a 'public record' or that which the data subject has 'deliberately made public' not incompatible with the purpose of collection. In addition to the research-related provisions already available to researchers, section 15(3)(b) of POPIA may prove helpful in supporting and growing science and technology innovations as envisaged in the South African National Development Plan.⁴⁴ Such considerations inform economic growth and improve health systems, education, and infrastructure, by creating a public record of personal data and collaborating with participants to voluntarily make their information public.

By way of illustration, the Finnish biobank, Auria, demonstrates how biobank and personal research data can be used for commercial purposes to benefit participants.⁴⁵ In this context, Finish citizens place trust in researchers and public institutions by willingly donating, and agreeing to make public, personal research data for commercial use.⁴⁶ A model based on commercialisation - with reciprocal benefit and data made publicly available by the participant - that strengthens collaboration and participation with data subjects is advantageous in that it not only fosters long-term relationships between the parties (be they researchers or otherwise), but remains in compliance with data protection laws.⁴⁷ Accordingly, and following POPIA, data collected for research purposes may be repurposed for commercial use if such data are contained in a public record or deliberately made public by the data subject. A model, not dissimilar to that of the one adopted in Finland, could be extended to South African research repositories that want to commercialise data.

 

Conclusion and recommendations regarding the draft CCR

The draft CCR was developed, inter alia, to create legal certainty regarding the interpretation of POPIA's provisions, to ensure that personal information used in research is protected, and to assist research institutions and independent researchers in complying with POPIA.²⁰ POPIA does not mention the commercialisation of personal information, and therefore it is left up to the draft CCR to address this issue and guide researchers and research institutions, while protecting participants. But how does the draft CCR recognise, and manage, situations in which researchers want to use personal information, including special personal information, either (1) from a previous research project; or (2) for a different purpose (which could include commercial purposes)?²⁰ Where researchers seek to use personal information collected from a previous research project for further research, or where researchers intend to use personal information for a new research-related purpose, the draft CCR requires researchers to provide certain information in a new research protocol, including: (1) the conditions under which the personal information was originally collected (including disclosures to research participants and information about consent); (2) how researchers will ensure that the personal information is used only for research and will not be published in an identifiable form; (3) how the notification requirement in section 18 of POPIA will be complied with; and (4) whether permission has been granted by the responsible party who initially processed the personal information.²⁰ The draft CCR acknowledges the possibility of a changing purpose - which, although not explicitly stated in the draft CCR, may imply repurposing research data for commercial use. If this is indeed the case, this must be done in accordance with section 15(1) of POPIA.

However, the draft CCR concerns itself only with situations where personal information collected for another purpose is re-used for research.²⁰ If the purpose changes to another type of research, it may be possible for this to fall within the scope of section 15(1) of POPIA as it remains within the boundaries of research and may be what the draft CCR envisioned when drafting this section. The draft CCR approaches research as a one-directional, inward flow of personal information collected for other purposes into research, but fails to provide for an outward flow of personal information initially collected for purposes of research into commercialisation. As we highlighted above, the commercialisation of research results is central to South African science and innovation policy - and a statutory duty to commercialise exists where public funds are used and commercially viable IP is involved.

Accordingly, given the importance of the commercialisation of research results to the South African research community, we suggest that the draft CCR address this important issue and lay out a clear roadmap for the South African research community on how to commercialise personal information initially collected for research. It would also be helpful for the draft CCR to include practical examples of consent statements for consent to the repurposing of personal data (initially collected for research) for commercialisation.

Against this recommendation, it can be argued that the topic of the commercialisation of research results is not research, and should therefore be excluded from the draft CCR. The draft CCR is, after all, intended to deal only with research. Although this argument would have technical merit, such a position is, in our estimation, myopic. Considerations about the commercialisation of personal data initially collected for research are often - and should be - a part of the design of research projects, and are a reality facing researchers and research institutions - whether initially planned or not. In other words, practically, decision-making regarding the commercialisation of research results is intrinsically integrated with research decision-making. Accordingly, the South African research community would benefit from a code of conduct for research that acknowledges this and considers how the commercialisation of research data might be realised.

 

Acknowledgements

We acknowledge support from the US National Institute of Mental Health of the US National Institutes of Health (award number U01MH127690). The content of this article is solely our responsibility and does not necessarily represent the official views of the US National Institute of Mental Health or the US National Institutes of Health.

 

Competing interests

We have no competing interests to declare.

 

References

1. Stokstad E. Major U.K. genetics lab accused of misusing African DNA. Science News. 2019 Oct 30. https://doi.org/10.1126/science.aba0343        [ Links ]

2. Njilo N. Stellenbosch University demands return of DNA samples - But UK lab hits back. Times Live. 2019 Oct 16. Available from: https://www.timeslive.co.za/news/south-africa/2019-10-16-stellenbosch-university-demands-return-of-dna-samples-but-uk-lab-hits-back/        [ Links ]

3. Blanchard S, Randall I. South African scientists demand the return of hundreds of tribal DNA samples after a British institute was accused of trying to use them to make money. Daily Mail. 2019 Oct 14. Available from: https://www.dailymail.co.uk/sciencetech/article-7570501/UK-lab-told-return-DNA-African-tribes-accused-trying-commercialise-them.html        [ Links ]

4. The Associated Press. Texas sued over sale of baby blood samples. CBS News. 2010 Dec 09. Available from: https://www.cbsnews.com/news/texas-sued-over-sale-of-baby-blood-samples/        [ Links ]

5. Aaronson B. Baby blood battle continues. The Texas Tribune. 2010 Dec 08. Available from: https://www.texastribune.org/2010/12/08/lawsuit-alleges-dshs-sold-baby-dna-samples/        [ Links ]

6. Moore v Regents of the University of California 793 P2d 479 (Cal. 1990).         [ Links ]

7. Pike ER. Securing sequences: Ensuring adequate protections for genetic samples in the age of big data. Cardozo L Rev. 2015;37:1977-2033. https://ssrn.com/abstract=2658306        [ Links ]

8. Organisation for Economic Co-operation and Development (OECD). The role of data in building trust. The path to becoming a data-driven public sector. Paris: OECD Publishing; 2019. https://doi.org/10.1787/059814a7-en        [ Links ]

9. Varga EA. You want to do what? My mother's choice to have direct-to-consumer genetic testing. J Genet Counsel. 2012;21(3):382-385. https://doi.org/10.1007/s10897-012-9482-1        [ Links ]

10. Gutmann Koch V. PGTandMe: Social networking-based genetic testing and the evolving research model. Health Matrix. 2012;22(1):33-74.         [ Links ]

11. Stoeklé HC, Mamzer-Bruneel MF, Vogt, G, Hervé C. 23andMe: A new two-sided data-banking market model. BMC Med Ethics. 2016;17(19):1-11. https://doi.org/10.1186/s12910-016-0101-9        [ Links ]

12. Bathe OF, McGuire AL. The ethical use of existing samples for genome research. Genet Med. 2009;11:712-715. https://doi.org/10.1097/GIM.0b013e3181b2e168        [ Links ]

13. Caenazzo L, Tozzo P. The future of biobanking: What is next? BioTech. 2020;9(23):1-6. https://doi.org/10.3390/biotech9040023        [ Links ]

14. Anderlik MR. Commercial biobanks and genetic research. Am J PharmacoGenomics. 2003;3(3):203-215. https://doi.org/10.2165/00129785-200303030-00006        [ Links ]

15. O'Doherty KC, Christofides E, Yen J, Bentzen HB, Burke W, Hallowell N, et al. If you build it, they will come: Unintended future uses of organised health data collections. BMC Med Ethics. 2016;17:1-16. https://doi.org/10.1186/s12910-016-0137-x        [ Links ]

16. Swede H, Stone CL, Norwood AR. National population-based biobanks for genetic research. Genet Med. 2007;9:141-149. https://doi.org/10.1097/GIM.0b013e3180330039        [ Links ]

17. Martin-Sanchez FJ, Aguiar-Pulido V, Lopez-Campos GH, Peek N, Sacchi L. Secondary use and analysis of big data collected for patient care. Yearb Med Inform. 2017:28-37. https://doi.org/10.15265/IY-2017-008        [ Links ]

18. Andreotta AJ, Kirkham N, Rizzi M. AI, big data, and the future of consent. AI Soc. 2021:1-14. https://doi.org/10.1007/s00146-021-01262-5        [ Links ]

19. Unsafe national biometric data collection in 23 African countries [webpage on the Internet]. c2022 [cited 2023 Feb 09]. Available from: https://www.ictworks.org/national-biometric-data-collection/#.Y-Tihi2l1R4        [ Links ]

20. Academy of Science of South Africa (ASSAf). POPIA Code of Conduct for Research. Pretoria: ASSAf; 2023. https://www.assaf.org.za/wp-content/uploads/2023/04/ASSAf-POPIA-Code-of-Conduct-for-Research.pdf        [ Links ]

21. Quinn P. Research under the GDPR - A level playing field for public and private sector research? Life Sci Soc Policy. 2021;17(4):1-33. https://doi.org/10.1186/s40504-021-00111-z        [ Links ]

22. Caulfield T, Ogbogu U. The commercialization of university-based research: Balancing risks and benefits. BMC Med Ethics. 2015;16:1-7. https://doi.org/10.1186/s12910-015-0064-2        [ Links ]

23. Levy HV. The transformation of basic research into commercial value: Economics aspects and practical issues. JEMI. 2011;7:1-15.         [ Links ]

24. Moore JP, Wilson IA. Decades of basic research paved the way for today's 'warp speed' Covid-19 vaccines. STAT. 2021 Jan 05. Available from: https://www.statnews.com/2021/01/05/basic-research-paved-way-for-warp-speed-covid-19-vaccines/        [ Links ]

25. Wardle JL, Baum FE, Fisher M. The research commercialisation agenda: A concerning development for public health research. Aust N Z J Public Health. 2019;43(5):407-409. https://doi.org/10.1111/1753-6405.12930        [ Links ]

26. Institute of Medicine (US) Committee on Health Research and the Privacy of Health Information. The value, importance, and oversight of health research. In: Nass SJ, Levit LA, Gostin LO, editors. Beyond the HIPAA Privacy Rule: Enhancing privacy, improving health through research. Washington DC: National Academies Press; 2009. p. 111-152.         [ Links ]

27. Sinclair J. Medical research needs more commercialisation support. Research Professional News. 2021 Mar 24. Available from: https://www.researchprofessionalnews.com/rr-news-australia-industry-2021-3-medical-research-needs-more-commercialisation-support/        [ Links ]

28. Burningham S, Ollenberger A, Caulfield T. Commercialization and stem cell research: A review of emerging issues. Stem Cells Dev. 2013;22(1):80-84. https://doi.org/10.1089/scd.2013.0317        [ Links ]

29. Samuel G, Hardcastle F, Broekstra R, Lucassen A. Exploring how biobanks communicate the possibility of commercial access and its associated benefits and risks in participant documents. BMC Med Ethics. 2022;23:1-14. https://doi.org/10.1186/s12910-022-00829-1        [ Links ]

30. South African Department of Science and Technology (DST). The bio-economy strategy. Pretoria: DST; 2013. Available from: https://www.gov.za/sites/default/files/gcis_document/201409/bioeconomy-strategya.pdf        [ Links ]

31. South African Department of Science and Innovation (DSI). South Africa foresight exercise for science, technology and innovation. Pretoria: DSI; 2019. Available from: https://www.naci.org.za/wp-content/uploads/2020/07/South-African-Foresight-Exercise-For-Science-Technology-and-Innovation-2019.pdf        [ Links ]

32. South African Department of Science and Innovation (DSI). Strategic plan 2020-2025. Pretoria: DSI; 2020. Available from: https://www.dst.gov.za/images/2020/DST_2020_2025_STRAT_PLAN_FINAL_JULY.pdf        [ Links ]

33. Higher Education, Science, Technology and Innovation Institutional Landscape (HESTIIL) Ministerial Committee. A new pathway 2030: Catalysing South Africa's NSI for urgent scaled social and economic impact. HESTIIL; 2020. https://www.dst.gov.za/images/2021/Higher%20Education,%20Science,%20Technology%20and%20Innovation%20Institutional%20Landscape%20Review%20Report.pdf        [ Links ]

34. Academy of Science of South Africa (ASSAf), Department of Science and Technology (DST). Human genetics and genomics in South Africa: Ethical, legal and social implications. Pretoria: ASSAf/DST; 2018. http://dx.doi.org/10.17159/assaf.2018/0033        [ Links ]

35. Cacchio J. What you don't know can hurt you: The legal risk of peering into the gene pool with direct-to-consumer genetic testing. UMKC L Rev. 2018;87:219-244.         [ Links ]

36. Gymrek M, McGuire AL, Golan D, Halperin E, Erlich Y. Identifying personal genomes by surname inference. Science. 2013;339(6117):321-324. https://doi.org/10.1126/science.1229566        [ Links ]

37. Erlich YWilliams JB, Glazer D, Yocum K, Farahany N, Olson M, et al. Redefining genomic privacy: Trust and empowerment. PLoS Biol. 2014;12(11):1-5. https://doi.org/10.1371/journal.pbio.1001983        [ Links ]

38. Regulations relating to research with human participants GN R719 GG 38000 of 19 September 2014, South Africa.         [ Links ]

39. Moodley K, Kleinsmidt A. Allegations of misuse of African DNA in the UK: Will data protection legislation in South Africa be sufficient to prevent a recurrence? Developing World Bioeth. 2020:1-6. https://doi.org/10.1111/dewb.12277        [ Links ]

40. Staunton C, Adams R, Botes M, Dove ES, Horn L, Labuschaigne M, et al. Safeguarding the future of genomic research in South Africa: Broad consent and the Protection of Personal Information Act No. 4 of 2013. S Afr Med J. 2019;109(7):468-l70. https://doi.org/10.7196/SAMJ.2019.v109i7.14148        [ Links ]

41. Thaldar DW, Townsend B. Genomic research and privacy: A response to Staunton et al. S Afr Med J. 2020;110(3):172-174. https://doi.org/10.7196/SAMJ.2020.v110i3.14431        [ Links ]

42. Thaldar DW, Townsend BA. Exempting health research from the consent provisions of POPIA. Potchefstroom Electron Law J. 2021;24:1-31. https://doi.org/10.17159/1727-3781/2021/v24i0a10420        [ Links ]

43. Townsend BA, Thaldar DW. Navigating uncharted waters: Biobanks and informational privacy in South Africa. South Afr J Hum Rights. 2019;35(4):329-350. https://doi.org/10.1080/02587203.2020.1717366        [ Links ]

44. Republic of South Africa National Planning Commission. National Development Plan 2030: Our future - Make it work. Pretoria: NPC; 2012.         [ Links ]

45. Lehtimäki H, Helén I, Snell K, Eriksson P Montonen T. Sustainable value creation in the commercialisation of innovation: The case of Auria Biobank. Int J Entrep Innov Manag. 2019;23(5):451-465. https://doi.org/10.1504/IJEIM.2019.102035        [ Links ]

46. Gaskell G, Gotweis H, Starkbaum J, Gerber MM, Broerse J, Gottweis U, et al. Publics and biobanks: Pan-European diversity and the challenge of responsible innovation. Eur J Hum Genet. 2013;21(1):14-20. https://doi.org/10.1038/ejhg.2012.104        [ Links ]

47. Kujala J, Lehtimäki H, Myllykangas P. Value co-creation in stakeholder relationships: A case study. In: Freeman R, Kujala EJ, Sachs S, editors. Stakeholder engagement: Clinical research cases. Dordrecht: Springer; 2017. p. 15-30.         [ Links ]

 

 

Correspondence:
Amy Gooden
Email: 215031300@stu.ukzn.ac.za

Published: 8 August 2023

 

 

* Current: Department of Medicine, Faculty of Medicine and Health Sciences, Stellenbosch University, Cape Town, South Africa
Funding: US National Institutes of Health (U01MH127690)