POPIA Code of Conduct for Research (with corrigendum)

Abstract

The Act will have implications for all research activities that involve the collection, processing, and storage of personal information. POPIA provides for the development of Codes of Conduct to guide the interpretation of the Act with respect to a particular sector or class of information. 1 Codes of Conduct are particularly important for providing for prior authorisations in terms of Section 57 of POPIA for the sector to which it applies. Prior authorisations are required for using unique identifiers of personal information in data processing activities, and for sharing special personal information or the personal information of children with countries outside of South Africa that do not have adequate data protection laws. In order to understand and functionally interpret the provisions of POPIA for the research community in the Republic of South Africa (South Africa), the Academy of Science of South Africa (ASSAf) is leading a process to develop a Code of Conduct (Code) for research under the Act. A Code can be developed by the Information Regulator or by a public or private body deemed 'sufficiently representative' of the bodies in respect of the particular class of information or sector to which the Code will apply. During 2020, ASSAf was approached by scientists in South Africa to consider the development of a Code for research, and public events were held during Open Access Week in October 2020, and Science Forum South Africa in December 2020, to further discuss the role of ASSAf in this regard. A Commentary published in this issue sets out the full rationale for the development of the Code by ASSAf and details the consultation process to date. 2 Within the research setting, POPIA regulates the processing of personal information for research purposes, and the flow of data across South Africa's borders to ensure that any limitations on the right to privacy are justified and aimed at protecting other important rights and interests. The new regulatory system that POPIA establishes will function alongside other legislation and regulatory structures governing research in South Africa, as outlined below. The law which takes precedent will be that which provides the most comprehensive protections to the rights of individuals in South Africa.This paper sets out the key discussion points in relation to the development of the Code. It is intended as a paper that can support further stakeholder consultation and public engagement in the process of developing a Code which meets the needs, and is representative of, the South African research community.

Drafting a Code of Conduct for Research under the Protection of Personal Information Act No. 4 of 2013 (with corrigendum)

“…This submission will follow wide consultation with researchers, research institutions and other relevant stakeholders. The Discussion Document by Adams et al 2…”

“…The full scope of the Code of Conduct is set out in the Discussion Document by Adams et al 2 The proposed Code will pertain to all research conducted in South Africa or by a responsible party domiciled in South Africa, and which uses (collects, processes or stores) personal information as defined under POPIA as pa t of the research process.…”

Why POPIA does not apply to DNA

“…I must express my reservations about the formulation used by Adams et al 2 , referring to 'the exact point at which biological samples become personal information' (emphasis added). First, the physical DNA does not become a genetic sequence like a caterpillar that becomes a butterfly.…”

“…Thaldar and Townsend 1 analysed this question and answer it in the negative: POPIA does not apply to human biological material. Adams et al 2 also answer the question in the negative, but express their uncertainty about 'the exact point at which biological samples become personal information'. Where does this leave DNA?…”

Seven essential instruments for POPIA compliance in research involving children and adolescents in South Africa

“…Study leads of each study completed risk assessments in their data management plans for the research governance team to identify the type and format of personal information collected within each study, including high-risk information. 3 Finally, the research governance team proceeded to identify training needs of data operators and data collectors. The team implemented several data security enhancement processes such as direct uploading of data onto protected servers using end-to-end encryption instead of password-protected laptops.…”