Data management instruments to protect the personal information of children and adolescents in sub-Saharan Africa

Abstract

Recent data protection regulatory frameworks, such as the Protection of Personal Information Act (POPI Act) in South Africa and the General Data Protection Regulation (GDPR) in the European Union, impose governance requirements for research involving high-risk and vulnerable groups such as children and adolescents. Our paper's objective is to unpack what constitutes adequate safeguards to protect the personal information of vulnerable populations such as children and adolescents. We suggest strategies to adhere meaningfully to the principal aims of data protection regulations. Navigating this within established research projects raises questions about how to interpret regulatory frameworks to build on existing mechanisms already used by researchers. Therefore, we will explore a series of best practices in safeguarding the personal information of children, adolescents and young people (0-24 years old), who represent more than half of sub-Saharan Africa's population. We discuss the actions taken by the research group to ensure regulations such as GDPR and POPIA effectively build on existing data protection mechanisms for research projects at all stages, focusing on promoting regulatory alignment throughout the data lifecycle. Our goal is to stimulate a broader conversation on improving the protection of sensitive personal information of children, adolescents and young people in sub-Saharan Africa. We join this discussion as a research group generating evidence influencing social and health policy and programming for young people in sub-Saharan Africa. Our contribution draws on our work adhering to multiple transnational governance frameworks imposed by national legislation, such as data protection regulations, funders, and academic institutions.

Information Security Awareness in Sub-Saharan African Schools: The Role of Educational Leadership in Turbulent Times

“…In addition, the lack of preparedness in the information system management sector, especially regarding security issues, can cause many losses to organizations in the sub-Saharan region. Indeed, attempts to preserve data are made sporadically in Africa, whereas Europe, North America, and Asia are at a very high level [28,31].…”

Data privacy and DNA data

“…The manuscript titled "Data management instruments to protect the personal information of children and adolescents in sub-Saharan Africa," focuses on the challenges, complexities and strategies associated with protecting the personal information of vulnerable populations, specifically children and adolescents, within the context of recent data protection regulatory frameworks in sub-Saharan Africa (Hertzog, Chen-Charles, Wittesaele, de Graaf, Titus, Kelly, Langwenya, Baerecke, Banougnin, Saal & Southall, 2023). Hertzog et al (2023) highlight the recent data protection regulations, such as the Protection of Personal Information (POPI) Act (No. 4 of 2013) 3 in South Africa, in increasing the need for improved governance and protections in data management and in research and testing involving high-risk and vulnerable groups, such as children and adolescents.…”

“…4 of 2013) 3 in South Africa, in increasing the need for improved governance and protections in data management and in research and testing involving high-risk and vulnerable groups, such as children and adolescents. It is apparent that the primary objective of Hertzog et al (2023) was to dissect and comprehend what constitutes adequate measures for safeguarding the personal information (any information that may identify a person) of these vulnerable populations and to propose strategies that align effectively with the objectives of data protection regulations.…”

“…Importantly, these regulations do not replace the Health Professions Council of South Africa (HSPCA) patient confidentiality and other legal policies (Smith, 2023). Moreover, Hertzog et al (2023) correctly emphasise the significance of adhering to transnational governance frameworks established by data protection regulations, funders, and institutions. Recognising the necessity, we concur that regulatory alignment is required throughout the entire life cycle process, from data acquisition and storage to analysis and dissemination of the results in research and testing frameworks.…”

“…We welcome the fact that Hertzog et al (2023) shared their experiences and strategies thus seeking to ignite a broader dialogue about enhancing the protection of sensitive personal information for children, and adolescents, in sub-Saharan Africa. It has the potential to serve as a guide for scientists, community policymakers, and stakeholders engaged in research and testing initiatives with vulnerable populations.…”