IN PRACTICE
MEDICINE AND THE LAW
doi:10.7196/samj.2019.v109i7.14148

 

Safeguarding the future of genomic research in South Africa: Broad consent and the Protection of Personal Information Act No. 4 of 2013

 

 

C Staunton^I; R Adams^II; M Botes^III; E S Dove^IV; L Horn^V; M Labuschaigne^VI; G Loots^VII; S Mahomed^VIII; J Makuba^IX; A Olckers^X; M S Pepper^XI; A Pope^XII; M Ramsay^XIII; N N Loideain^XIV; J de Vries^XV

^IPhD, LLM (Public Law), BCL; School of Law, Middlesex University, UK
^IIBA (UoL), MPhil, PhD; Human Sciences Research Council, Pretoria, South Africa; Information Law and Policy Centre, Institute of Advanced Legal Studies, University of London, UK
^IIIBProc, LLB, LLM (Intellectual Property Law), LLD (Biotechnology Law); Biolawgic (Pty) Ltd, Johannesburg, South Africa
^IVBA, BCL, LLB, LLM, PhD; School of Law, University of Edinburgh, Scotland
^VMB BCh, DTM&H, DCH, Diploma International Research Ethics, MPhil, PhD (Bioethics); Office of Research Integrity, University of Cape Town, South Africa
^VIBA, BA Hons, MA, DLitt, LLB, LLD; Department of Jurisprudence, School of Law, University of South Africa, Pretoria, South Africa
^VIIBA Hons Development Administration; Department of Science and Technology, Pretoria, South Africa
^VIIIBCom, LLB, LLM, PhD; Department of Jurisprudence, School of Law, University of South Africa, Pretoria, South Africa
^IXPhD; African Academy of Sciences, Nairobi, Kenya
^XPhD; DNAbiotec (Pty) Ltd, Pretoria, South Africa
^XIMB ChB, PhD, MD, PD; Institute for Cellular and Molecular Medicine, Department of Immunology, and SAMRC Extramural Unit for Stem Cell Research and Therapy, Faculty of Health Sciences, University of Pretoria, South Africa
^XIIBA (Legal Theory and Psychology), LLB, PG Diploma International Research Ethics; Department of Private Law, Faculty of Law, University of Cape Town, South Africa
^XIIIPhD; Sydney Brenner Institute for Molecular Bioscience, Faculty of Health Sciences, University of the Witwatersrand, Johannesburg, South Africa
^XIVPhD, LLM (Public Law), LLB, BA; Information Law and Policy Centre, Institute of Advanced Legal Studies, University of London, UK
^XVPhD (Oxon), MSc Department of Medicine, Faculty of Health Sciences, University of Cape Town, South Africa

Correspondence

 

 

---

ABSTRACT

Genomic research has been identified in South Africa (SA) as important in developing a strong bio-economy that has the potential to improve human health, drive job creation and offer potential solutions to the disease burden harboured by low- and middle-income countries. Central to the success of genomic research is the wide sharing of biological samples and data, but the true value of data can only be unlocked if there are laws and policies in place that foster the legal and ethical sharing of genomic data. The introduction and entry into force of SA's Protection of Personal Information Act (POPIA) No. 4 of 2013 is to be welcomed, but the wording of POPIA as it pertains to consent for the processing of personal information for research purposes has sparked a debate about the legal status of broad consent. We argue that a purposive interpretation of the legislation would permit broad consent for the processing of personal information for research. Although there are ongoing debates surrounding the ethical use of broad consent in Africa, the objective of this article is not to engage with the ethics of broad consent itself, but rather to focus on the legal status of broad consent for genomic data sharing under POPIA.

---

 

 

Science, technology and innovation have been identified as key drivers of economic growth for South Africa (SA).^[1] In particular, genetic and genomic research are seen as important for developing a strong bio-economy,^[2] with the potential to improve population health and to drive job creation.^[3] Open science and sharing of access to biological samples and data are key features of genomic research and have been recognised by the Department of Science and Technology (DST) as an important element of the Fourth Industrial Revolution.^[4]

SA researchers share access to SA genomic data within SA, across Africa and with other international collaborators as an essential part of finding solutions to healthcare problems. The benefits of data sharing include the optimal use of resources, increased statistical power, more reproducible science, promotion of new research on existing data sets and fostering of innovation.^[5] Yet, the true value of data can be unlocked if governance frameworks are in place to enable the legal and ethical sharing of and access to genomic data in a manner that does not cause harm to participants and promotes public trust.

There has been an unquestionable shift towards the strengthening of data protection laws worldwide. The European Union, Japan, Argentina, Morocco and India, to name just a few jurisdictions, have either introduced significant personal information protection regulatory instruments or are in the midst of strengthening existing ones. In line with these international legal developments, SA has introduced its first comprehensive legislative framework on data protection: the Protection of Personal Information Act (POPIA) No. 4 of 2013. Two key questions that must be addressed before this legislation comes into force in 2020, however, are the legal status of genomic research and of broad consent under POPIA.

This article considers each of these questions in turn and in particular focuses on broad consent. Broad consent is defined in the National Department of Health (DoH) Ethics in Health Research Guidelines as 'the donor permits use of the specimen for current research, for storage and possible future research purposes, even though the precise nature of future research may be unclear at present'.^[6] While not explicitly addressed in POPIA, we argue that a purposive interpretation of this Act would permit broad consent for the processing of personal information for research purposes. Such an interpretation would align POPIA with other instruments that govern genomic research in SA, as well as government policy and strategy in this arena. We recognise the ongoing ethical debates surrounding the use of broad consent in Africa, but this article does not engage with the ethics of broad consent itself. Rather, the focus is on the legal status of broad consent under POPIA. Equally, this article does not suggest that broad consent must necessarily be adopted in any given research study. As per the DoH Guidelines, we argue that broad consent should be viewed as one consent process, in addition to specific consent or tiered consent, which is legally permissible in SA.

 

Protection of Personal Information Act

POPIA is the first comprehensive statutory framework for SA that explicitly protects personal information.The scope of the law covers all sectors and gives full effect to the right to protection of personal information, a distinct element of the right to privacy protected under section 14 of the Constitution of South Africa. POPIA requires that any processing of personal information must satisfy the following 8 conditions: (i) accountability; (ii) processing limitation; (iii) purpose specification; (iv) further processing limitation; (v) information quality; (vi) openness; (vii) security safeguards; and (viii) data subject participation. Section 1 of POPIA broadly defines the key term of 'processing'. As a result, processing for the purposes of POPIA applies to any treatment of personal information, including information that identifies a (living) natural person, thus covering genomic data. Processing that falls under POPIA thereby covers the collection of genomic data for research purposes and its subsequent analysis, storage, modification, use, transmission and erasure. POPIA also establishes a new public administrative authority, the Information Regulator, to provide guidance and monitor and enforce compliance by public and private bodies with POPIA, including universities.

Overall, the enactment of POPIA is welcomed, as it should serve to provide greater guidance for researchers regarding the privacy and security safeguards to be implemented and complied with. This should serve to advance better transparency, oversight and accountability of genomic data research, thereby strengthening public trust. As noted by the head of the Information Regulator, chairperson Adv. Pansy Tlakula, the appointment of the enforcement arm of POPIA is also 'a significant step in the process of promoting access to information as well as protection of personal information'. ^[7]

The Act is not yet in effect, but the research community is currently preparing for its implementation. This task is made difficult, however, because the Act itself does not set out specific rules governing the processing of personal information for research purposes. This is because POPIA is an omnibus and general framework to govern all types of personal information processing by the public and private sectors. In other words, the text of POPIA only regulates data sharing in genomic research at a high level and not at a sectoral level, and therefore tailored guidance on how POPIA applies specifically to the processing of genomic data for research is necessary. The general framework of POPIA, however, does set out some key starting points that will underpin this future guidance. For instance, section 26 of POPIA imposes a general prohibition on processing of 'special personal information', which includes biometric data. However, if the 'data subject' consents to processing,^[8] or if processing is for 'research purposes' that serve a public interest or where it would be impossible or involve a disproportionate effort to ask for consent,^[8] or if the Information Regulator has authorised processing with appropriate safeguards in place,^[8] then the prohibition is lifted. Section 32(5) also states that personal information regarding inherited characteristics may be processed for research. Thus, under POPIA, genomic data can be processed if it is for research purposes.

 

Broad consent

Section 13 of POPIA requires personal information to be collected for a 'specific, explicitly defined and lawful purpose'. Within the context of genetic research, a strict interpretation would suggest that only specific consent is permissible. Adopting this interpretation would raise difficulties for many genetic research studies. For instance, all research participants for current and ongoing research for which broad consent was used would have to be re-contacted and re-consented, otherwise the research would have to be terminated. This could stifle current and future research and innovation, and undermine the objective of a strong bio-economy driving economic growth in SA.

POPIA does envisage situations when the further processing of personal information is necessary. Further processing of personal information is permitted, provided it is compatible with the original purpose for which it was collected (section15(1)). The Act does not describe the scope of 'compatible', but does detail instances in which the processing of personal information for purposes outside of the original consent will be permitted. For research purposes they include: processing necessary to 'prevent or mitigate a serious and imminent threat to' public health (section15(3)(d)(i)) or 'the life or health of the data subject or another individual' (section 15(3)(d)(ii)), or if the information is to be used for research purposes and 'will not be published in an identifiable form' (section15(3)(e)). Secondary use of data for purposes beyond the specific consent is therefore permitted if the data are to be used for research intended to improve health, provided that the information will not be published in an identifiable form. This means that demographic information and data that a reasonably foreseeable method can use to identify the data subject or which can be linked by a reasonably foreseeable method to other information that identifies the data subject, must be removed (section 1). Herein lies the challenge for genomic research: genomic information is inherently identifiable, which seems to suggest that specific consent must always be obtained.

This narrow reading of the Act, however, ignores two fundamental elements that underpin POPIA. First, the constitutional right to privacy is not absolute and the preamble to POPIA states that it may be subject to limitations 'that are aimed at protecting other rights and important interests'. Here, one could make a reasonable argument that genomic research constitutes an important public interest in SA, and thus necessitating a specific consent model for all research studies would undermine the public interest in facilitating genomic research. Secondly, POPIA inherently recognises the non-absolute nature of the right to privacy through the restrictions that it allows for throughout the Act. For instance, section 2 states that the purpose of the legislation is to give effect to the constitutional right to privacy by safeguarding personal information, subject to limitations that seek to protect 'important interests, including the free flow of information within the Republic and across national borders'.

Moreover, the responsible party may be exempt from some of the strict provisions of POPIA, including restriction on retention of records (section 14), duty to notify (section 18), and prohibition on processing of special personal information (section 26), when processing is for research purposes. POPIA itself thus makes special exceptions for research purposes and thereby places importance on research and on the sharing of data, both locally and globally. Further, special authorisation may be available for medical professionals and healthcare institutions to process personal information about a person's health, including inherited characteristics, for research purposes.^[8] These provisions appear to indicate that processing of genomic data can continue for research purposes, which will enable the continued flow of genomic data for research within and beyond SA.^[8]

POPIA also does not exist in isolation, but is one of a number of pre-existing frameworks that govern genomic research. This includes the National Health Act No. 61 of 2003 and the 2012 Regulations, the Promotion of Access to Information Act 2 of 2000, the 2018 Material Transfer Agreement Guidelines and the DoH 2015 Guidelines. It is crucial to note that these are sector-specific legally binding instruments that permit the use of broad consent for genomic research that provide further guidance on the use of broad consent. In particular, the DoH Guidelines distinguish broad consent from blanket consent (which is not permitted) and require that the 'nature of the further usage should be described as fully as possible and should stipulate that further prior ethics review of the new study is necessary'. Thus, the use of broad consent under POPIA must adhere to the DoH Guidelines.

 

Conclusions

A clear, comprehensive legislative framework to govern use and sharing of access to genomic data collected in SA is necessary to ensure adequate and effective oversight and governance procedures that foster fairness, accountability and trust. Such a framework, however, also must align with national research priorities and existing legal and ethical frameworks that govern and oversee the use of genomic data in SA, as well as with international best practice, so that SA continues to contribute to and benefit from research in the global arena. To ensure legal certainty and public trust, it is necessary that the legal issues surrounding consent are clarified prior to POPIA coming into force.

Under section 60 of POPIA, the Information Regulator can authorise a code of conduct to govern specific sectors. We suggest such a code follow the guidance provided in the DoH 2015 Ethics in Health Research Guidelines and the 2018 National Material Transfer Agreement Guidelines, including that secondary use of data provided through broad consent is subject to ongoing governance controls, especially review and monitoring by a registered research ethics committee and potentially also a data access committee. Participant and community engagement and involvement are also crucial components of governance controls to ensure that ongoing and proposed research uses are acceptable and fall within the reasonable privacy expectations of the relevant community.

Currently, the Universities South Africa (USAf) is drafting a code of conduct for use by universities. It is concerning, however, that the draft code seems to focus primarily on handling personal information for human resource and student administration purposes and does not address research data. To fulfil the vision of developing a strong bio-economy that is in part driven by genomic research, SA needs a code of conduct that provides clear standardised guidance about the requirements and safeguards necessary for research data collection and sharing.

Declaration. None.

Acknowledgements. The authors would like to thank the attendees of a workshop on 'The Governance of Data Sharing for Genomic and other Health Related Data in Africa' held on 4 - 5 February 2019 in Cape Town, SA.

Author contributions. CS developed the initial draft of the manuscript after discussions with all authors at the Cape Town workshop. All authors commented on the manuscript.

Funding. The workshop was funded by a Wellcome Trust small research grant, 'The governance of data sharing for genomic and other health related data in Africa' (213687/Z/18/Z; PI: Ciara Staunton).

Conflicts of interest. None.

 

References

1. South Africa. Department of the Presidency. National Development Plan 2030: Our Future - Make it Work. 2012. https://www.gov.za/sites/default/files/Executive%20Summary-NDP%202030%20-%20Our%20future%20-%20make%20it%20work.pdf (accessed 27 May 2019).         [ Links ]

2. Department of Science and Technology. The Bio-economy Strategy. Pretoria: DST, 2013.         [ Links ]

3. Academy of Science of South Africa. Human genetics and genomics in South Africa: Ethical, legal and social implications consensus study. 2018. http://research.assaf.org.za/handle/20.500.11911/106 (accessed 11 June 2019).         [ Links ]

4. South Africa. Department of Science and Technology White Paper: Science, Technology and Innovation. 2019.         [ Links ]

5. Walport M, Brest P. Sharing research data to improve public health. Lancet 2011;377:538-539. https://doi.org/10.1016/S0140-6736(10)62234-9        [ Links ]

6. Department of Health. Ethics in Health Research: Principles, Processes and Structures. 2nd ed. Pretoria: DoH, 2015.         [ Links ]

7. South Africa. The Information Regulator. Information Regulator holds its inaugural meeting, 2 December 2016. www.justice.gov.za/inforeg/docs/ms-20161202-inforeg.pdf (accessed 22 May 2019).         [ Links ]

8. South Africa. Protection of Personal Information Act No. 4 of 2013.         [ Links ]

 

 

Correspondence:
C Staunton
c.staunton@mdx.ac.uk

Accepted 13 May 2019