Streamlining regulatory processes for health researchers: To what extent does POPIA apply?

Abstract

Personal information in health research commands utmost protection while also preserving the growth of health research. This paper aims to establish which legislation applies when processing personal information for health research. South Africa regulates health research on human subjects through a network of Human Research Ethics Committees. The Protection of Personal Information Act No. 4 of 2013 (POPIA)  has recently come into force. Section 2(3)(b) of POPIA provides that POPIA does not apply where other legislation creates 'more extensive' conditions for the lawful processing of personal information than Chapter 3 of POPIA does. We show that the provisions of the sectoral legislation on health are more extensive than the conditions in Chapter 3 of POPIA and hence the sectoral legislation prevails. This simplifies the regulation of health research. One of the implications of this finding is that the definition of broad consent in the sectoral legislation for health research should be applied to the exclusion of the consent provisions in POPIA.