The Protection of Personal Information Act 4 of 2013 in the context of health research: enabler of privacy rights or roadblock?

Abstract

Data is an exceptionally valuable asset – it is a fundamental part of the information age and is widely regarded as the world's most valuable resource. A key issue that has caused some debate in South Africa in recent times relates to the Protection of Personal Information Act 4 of 2013 (POPIA), and whether the Act requires broad or specific consent in the context of health research. The primary purpose of this article will be to answer the following question: does POPIA require broad or specific consent from persons who take part in health research? In a health research context, POPIA must be considered together with, inter alia, the National Health Act 61 of 2003 (NHA), and the Health Professions Act 56 of 1974 (HPA). As a point of departure, in terms of the NHA, health research requires the informed consent of participants. Informed consent has been a part of South African law for almost one hundred years, and gives effect to an individual's dignity and autonomy. The NHA does not directly distinguish between types of consent, but the Department of Health's second edition of Ethics in Health Research: Principles, Processes and Structures (the DoH Ethical Guidelines) does. The practice of broad consent is not only endorsed by the DoH Ethical Guidelines but encouraged. However, unlike the medical-legal framework, POPIA – which should be referred to as the privacy framework, or "privacy layer" in relation to data compliance in health research – requires consent to be specific as well as informed. If one considers the applicable sections of POPIA, and South Africa's interpretive tools and jurisprudence, it is apparent that consent in health research should as a matter of best practice be specific.