Data protection, data management, and data sharing: Stakeholder perspectives on the protection of personal health information in South Africa

Abstract

The Protection of Personal Information Act (POPIA) 2013 came into force in South Africa on 1 July 2020. It seeks to strengthen the processing of personal information, including health information. While POPIA is to be welcomed, there are concerns about the impact it will have on the processing of health information. To ensure that the National Health Laboratory Service [NHLS] is compliant with these new strict processing requirements and that compliance does not negatively impact upon its current screening, treatment, surveillance and research mandate, it was decided to consider the development of a NHLS POPIA Code of Conduct for Personal Health. As part of the process of developing such a Code and better understand the challenges faced in the processing of personal health information in South Africa, 19 semi-structured interviews with stakeholders were conducted between June and September 2020. Overall, respondents welcomed the introduction of POPIA. However, they felt that there are tensions between the strengthening of data protection and the use of personal information for individual patient care, treatment programmes, and research. Respondents reported a need to rethink the management of personal health information in South Africa and identified 5 issues needing to be addressed at a national and an institutional level: an understanding of the importance of personal information; an understanding of POPIA and data protection; improve data quality; improve transparency in data use; and improve accountability in data use. The application of POPIA to the processing of personal health information is challenging, complex, and likely costly. However, personal health information must be appropriately managed to ensure the privacy of the data subject is protected, but equally that it is used as a resource in the individual’s and wider public interest.

The role of Data Transfer Agreements in ethically managing data sharing for research in South Africa

“…Furthermore, in the South African context, there are cultural considerations in the access to and use of samples [19,20] that may not arise in the use of data, or at least, which have not yet been appropriately unpacked. [13] One possible solution which requires further discussion is to integrate the development of a new DTA with the current SAMTA, thus streamlining the process. to transform SA into a digital economy that is both data intensive and data driven.…”

“…[21] The policy also indicates that any data transfer (not only personal data) outside SA must comply with POPIA and international best practice, thus extending the application of POPIA to data and international data transfers that are currently not under its remit. [13] The purpose of a DTA is not just the protection of personal data in line with participants' preferences, but also the conditions of the transfers, the purpose for which the data can be used and further shared, to guard against misuse of the data, and also to specify conditions of intellectual property ownership. The DTA can therefore protect data as a resource and guard against the misuse and exploitation of data generated in SA.…”

“…As POPIA seeks to give effect to the constitutional right to privacy, these initial discussions have primarily focused on participants' privacy, the role of consent and legal status of broad consent, [10][11][12] with limited consideration of the wider issues related to the use of personal information for research in SA. [13] The protection of participants' privacy in research is essential, but it is not the only risk at stake for participants in the use and sharing of personal information. Other rights and interests that must also be considered and safeguarded include the right to non-discrimination, the right to dignity, and the right to enjoy the benefits of scientific progress.…”

Ethical Considerations for Health Research Data Governance

“…Public forum comprising of respondents from professions in legal, ethics, medicine, medical, and social scientists, government professional, security, digital health, and bioinformatics in a study by Staunton et al in 2019 in SA had a general awareness of the need for protection of personal health information [45].…”

Data sharing governance in sub-Saharan Africa during public health emergencies: Gaps and guidance

“…While such gaps negatively impact local and national efforts to fight the pandemic, they also underscore the global inequity regarding the resources and ability to manage health pandemics. 9,10…”