香京julia种子在线播放

At a fundamental level, the question must be posed: Do the Minister of Health and the NHREC have the mandate to regulate data in the health research context, or are they overstepping their respective mandates? These entities receive their regulatory mandates from the National Health Act 61 of 2003 (NHA). Chapter 8 of the NHA, in particular, together with relevant regulations, governs the use of human biological material and research with human participants. However, there is also a later statute that is relevant in the health research space, namely POPIA, which deals with personal information. Data in the health research space often includes personal data—or to use POPIA terminology, “personal information.” Moreover, data in the health research space are often sensitive personal data—or to use POPIA terminology, “special personal information.” Accordingly, there is an overlap between the scopes of application of the NHA and POPIA. The question then is: In the case of a conflict, which statute prevails? We consider two relevant legal principles.

In the context of health research, the NHA is general legislation, while POPIA is special legislation, meaning that POPIA governs only a specific part of health research, namely the way in which the personal information of research subjects is dealt with (National Health Act, 2003). Accordingly, the maxim generalia specialibus non derogant (general words and rules do not derogate from special ones) applies. This means that the scope of application of the general statute must be constrained by the presence of the specific legislation (Minister of Justice and Constitutional Development v Southern African Litigation Centre, 2016). Applied to health research, this principle means that the governance of personal information is now governed by POPIA first and the NHA second. It follows that the Minister of Health and the NHREC—who get their respective mandates from the NHA—no longer have a mandate to regulate personal information in the health research milieu. This is now done by POPIA and its implementation mechanism, the Information Regulator. In turn, the Information Regulator can, among others, issue guidance notes, and approve codes of conduct and compliance frameworks. For example, ASSAf developed a draft Code of Conduct for Research (Academy of Science of South Africa, 2023), which is likely to be converted into a compliance framework based on the Information Regulator’s feedback.

Furthermore, POPIA itself contains a supremacy clause in section 2(a). In the context of the processing of personal information, POPIA (2013) supersedes any other legislation that is inconsistent with it. There is however an exception to POPIA’s supremacy clause in section 2(b). If any other legislation provides for conditions for the lawful processing of personal information that are “more extensive” than those set out in POPIA, the more extensive conditions in the other legislation prevail. Although some have argued that the NHA is more extensive (in the sense that it is certainly more voluminous), this is mistaken (Bronstein and Nyachowe, 2023). In context, “more extensive” clearly refers to better protection of data subjects, not to being more voluminous (Thaldar, 2023). This exception may apply in specific instances where other legislation provides better protection of data subjects. However, as we discuss below, this is evidently not the case with the draft MTA. Accordingly, there is no realistic possibility of relying on the exception to POPIA’s supremacy clause.

As a result, to the extent that the NHREC’s draft MTA contains provisions regarding personal information, it is beyond the Minister of Health’s and the NHREC’s statutory mandate. The Minister of Health and the NHREC are overstepping into the terrain of the Information Regulator. To the extent that they overstep, their conduct is invalid and can be challenged in a court of law (Sasol Oil Pty Ltd v Metcalfe, 2004). The solution to this problem is obvious: The NHREC should remove all references to “associated data” in its draft MTA.

Next, we analyse the way in which the draft MTA deals with “associated data.”

Although trite, it bears repetition: POPIA sets out eight conditions for the lawful processing of personal information (De Stadler et al., 2021; Burns and Burger-Smidt, 2023). These conditions are aimed at protecting the rights of data subjects, but POPIA also recognises that a balance must be struck between the right to privacy and the right of access to information and freedom of speech. POPIA therefore establishes conditions that regulate how personal information may be processed. For the avoidance of doubt, POPIA applies to the processing (including transfer) of all personal information, including personal information derived directly and indirectly from health research, such as genetic data generated from human biological material.

In terms of current best practice—in South Africa and internationally—an agreement that facilitates the transfer of data containing personal information should contain detailed provisions articulating compliance with applicable data protection legislation. Parties to an MTA must be aware that by transferring data that contains personal information, several legal obligations arise—and these obligations require careful consideration. The parties must determine, inter alia, the nature of the personal information being transferred, the identity of the responsible party, and the data privacy obligations on each party. Critically, sections 107 and 109 of POPIA (2013) provides that failure to comply with POPIA can result in a fine of up to R10 million or imprisonment for a period not exceeding 10 years, or to both a fine and such imprisonment—as well as significant reputational harm.

However, the draft MTA fails to live up to best practice. The draft MTA’s “Guidance” section notes that the draft MTA is a template that contains “minimum standards.” However, as it stands, there are simply no minimum standards in the draft MTA dealing with data protection. The draft MTA refers to data in a superficial, throw-away fashion.

The “Guidance” section further provides that where “data alone” is transferred a data transfer agreement (DTA) is “appropriate.” We suggest that in all circumstances where data containing personal information are transferred, in order to ensure full compliance with POPIA, and to abide by international best practice, a DTA is not only appropriate, but necessary. Although it is true that some of the content in a DTA will be similar to a MTA, the similarity relates only to standard legal clauses, and not to the actual substance of the agreement. The primary purpose of the agreements will be entirely different, and both will seek to comply with distinct pieces of legislation. For this reason, the decision to conflate data with human biological material—something inherited from the original SA MTA via SA MTA 1.1—is a mistake.

To illustrate the issues caused by this conflation, consider the following three definitions:

• “Material” is defined as including both human biological material and associated data.

However, in relation to personal information (which is part of ‘Material’ as defined above), the National Department of Health plays no role in its regulation.

Some of the changes that the NHREC’s draft MTA introduced to SA MTA 1.1 seem not to have been sufficiently considered. For example, consider the second sentence added to clause 3.5. The clause now reads as follows: “The Provider must inform the HREC [health research ethics committee] and wherever possible the Participant/s if the Provider is informed that the Material has Become Identifiable for any reason whatsoever. This must be clarified as Material remain [sic] coded and hence potentially identifiable.” The second sentence is not comprehensible.

Another example is the definition of “Becomes Identifiable.” In the draft MTA the word “directly” was added before “personally identified.” This is ill-advised, as it makes the draft MTA narrower than POPIA, which can lead to inconsistency and confusion.

The NHREC’s draft MTA is inadequate in relation to the transfer of data. We suggest that the conflation between data and biological material be avoided. These concepts should be dealt with distinctly, as they are governed by different disciplines in the law. Preferably, the envisioned MTA should avoid regulating the transfer of data altogether—rather, it should only regulate the transfer of human biological materials to avoid misalignment with POPIA. In conjunction with such a pure MTA, parties must consider the use of a professionally drafted DTA that takes account of applicable legislation and is designed to lawfully manage the processing of data. Here there is a ready solution, namely the DTA template that was developed for South Africa’s research community. It is fully aligned with POPIA and freely available (Swales et al., 2023b).

Next, we move the focus from the incorporeal to the corporeal—from data to biological material.

It is interesting that the NHREC’s draft MTA—similar to its predecessors—focuses only on human biological material, to the exclusion of other biological material that is important in health research, such as human pathogens. However, ‘Human Biological Material’ is defined sufficiently broadly in the draft MTA as to include pathogens. The definition reads as follows:

Consider the following scenario: When, during a pandemic, blood samples are drawn from infected persons and sent from one research institution to another, the blood sample would qualify as “Human Biological Material.” However, such “Human Biological Material” would also contain a human pathogen, such as a bacteria or a virus. This is a matter of concern, as the draft MTA does not sufficiently cater for such a possibility. For a researcher there is a vast difference between a human biological material sample that contains a pathogen and a sample that does not, and the procedure for dealing with each is quite different.

Ultimately, the person that the revised SA MTA will govern will be the person who will need to organise the transfer of human biological material—which may include pathogens—and so they need to be aware of the legal and physical dangers relating to this. It may not be apparent that human biological material could be a weapon of mass destruction and yet that is exactly what it could be if the human biological material contains certain pathogens, such as the Ebola virus. This is acknowledged in the Non-Proliferation of Weapons of Mass Destruction Act (1993) and yet the draft MTA does not mention this important consideration. International standards, such as the WHO Manual on Laboratory Biosafety (World Health Organisation, 2020), the National Institutes of Health Shipping Policies and Procedures (National Institutes of Health, 2022), the International Air Transport Association’s Infectious Substances Shipping Regulations (International Air Transport Association, 2023), and the Centers for Disease Control and Prevention’s Guideline for Disinfection and Sterilization in Healthcare Facilities (Centers for Disease Control and Prevention, 2008) are examples of useful links. However, these are also omitted from the draft MTA leaving it up to scientists to source the relevant material on their own. In this respect, the draft MTA misses a vital opportunity to help and educate scientists by alerting them to the requirements that they need to comply with in order to transfer certain kinds of human biological material.

Apart from missing this opportunity to create awareness among scientists, the issue of pathogens being present in human biological material also opens up the issue of legal liability. At present, the draft MTA includes a provision that obliges the recipient to indemnify the provider of material from any liability, except insofar as the provider is required to be liable in law. The recipient is also required to maintain “adequate” insurance cover against liability to third parties. However, the draft MTA provides no assistance as to when the provider will be liable in terms of the law, nor does it require checks and balances to avert the harm that may or may not be covered by the “adequate” insurance. It is important to consider that the agreement may deal with the transfer of a biological weapon of mass destruction and so liability could be huge, possibly even worldwide. It is unlikely that this type of harm could be cured by any insurance cover and therefore greater effort should be invested in the eventual revised SA MTA to ensure that the harm does not occur.

The provider of the biological material should consider the infectious nature, volume and frequency of the transfer (among other factors) when considering the risk posed by the transfer of the human biological material. The identified risks would also influence the safeguards the provider would need to adopt. In this regard, the process to identify and deal with risks as set out in section 19(2) of POPIA could be considered to be a template for this purpose. The provider can, for example, create an appropriate risk matrix to be added as an annexure to the agreement. In addition, a right to audit compliance by either party should be included. The exercise of this right should be based on the risk profile of the other party.

We now proceed to the last research question, which pertains both to human biological material and associated data: the issue of ownership.

The draft MTA is not a mature document and it will take some time for it to reach a level of maturity where it is appropriate for it to be considered to be mandatory. The scientific and legal community should be encouraged to work together to progressively improve on the content of the draft MTA and to stress-test it against the actual lived experience of scientists who transfer human biological material. In addition, a mandatory document is inherently less flexible—and thus less able to be updated regularly—than a voluntary document.

The transfer of human biological material and the transfer of data are different disciplines, and different legal rules apply. Moreover, the current definition of “Associated Data” in the draft MTA merges the concept of personal and non-personal information in an unfortunate and unhelpful manner which contributes to confusion. If there are any associated data transferred alongside human biological material, it would be more appropriate to indicate that the DTA template developed for the South African research community (Swales et al., 2023b) as amended by the parties would govern such data.

Given that the draft MTA involves handling human biological materials—which can contain pathogens—the potential for harm is significant. The MTA should require providers of human biological material to assess the transfer risk by considering factors such as the infectious nature, volume, and frequency of the transfer. Recognising these risks will determine the necessary safeguards that can also be built into the eventual revised SA MTA, such as contractual warranties by the provider. Moreover, the eventual revised SA MTA should include a provision allowing either party to audit compliance, with the decision and scope of the audit informed by the other party’s risk profile.

In the context of South Africa, it is crucial to ensure that health research does not perpetuate colonial legacies. Adopting a decolonial approach entails having a clear vision of a thriving bio-economy in South Africa—built not merely on being a raw material provider, but on adding value to such material—and strategically aiming for policy decisions that achieve this vision. Clarity on ownership of human biological material and associated data (primary and inferential) is crucial in order to have confidence and certainty in transactions entailing the transfer of these (corporeal and incorporeal) objects. This in turn is vital for building a thriving bio-economy in South Africa. Accordingly, policy instruments such as the eventual revised SA MTA should strive to empower local research institutions by clearly recognising their legal ownership of the material that they share.

Note that the draft MTA was not made public by the NHREC. Instead, the NHREC disseminated it to the health research ethics committees, who were given the opportunity to submit comments.