Broad consent for biobank research in South Africa - Towards an enabling ethico-legal framework

ABSTRACT

Broad consent is permitted by the South African National Department of Health Ethics Guidelines but appears to be prohibited by section 13(1) of the Protection of Personal Information Act 4 of 2013. Additionally, the Act mandates that all personal data (including biobank sample data) be collected for lawful, explicit, and clearly defined purposes. There is possibility for ambiguity in interpretation because of this discrepancy between the two instruments. Given the association between the transfer of samples and data, the long-term nature of biobanking, which makes it impractical to provide too much or enough information because it is simply not available at the time of sample collection, and the various ways that the Protection of Personal Information Act 4 of 2013 have been interpreted, we aim to demonstrate that South Africa’s current regulatory framework should appropriately permit broad consent use for biobank research where the transfer of samples and their associated data are contemplated. In summary, the proposed amendments include removing regulatory ambiguity regarding broad consent use, ensuring adequate safeguards for research participants by specifying rules for data access and personal information processing, and incorporating consent form information requirements into the national Consent Template.

KEYWORDS:

• Broad consent
• regulatory framework
• biobank research
• Protection of Personal Information Act
• South Africa

Introduction

In the South African context, a human biobank is defined as a type of repository or system for the “collection, storage and distribution system for human biological materials for research purposes including blood, urine, faeces, bone marrow, cell aspirates, diagnostic specimens, pathology specimens and so on. Usually, demographic and medical information about the donors is included in the repository as are codes that link the material to the donors” (South African Department of Health (DoH), 2015, p. 36). Typically, these specimens are stored for future use, including in genetic, epigenetic, or extra-genetic research (Nienaber, 2011). According to Singh and Moodley, “biobanking practice in South Africa ranges from small scale research projects located within academic and research-based institutions to large scale archived diagnostic samples stored within teaching hospitals; established biobanks in public/academic settings; private non-profit registeries and profit-based cord and stem cell tissue banks” (Singh & Moodley, 2021, p. 2). Population-based and disease-specific biobanks have been identified as types of biobanks (Budimir et al., 2011). The purpose of population biobanks is to aid research concerning the effects of environmental factors on genetic susceptibility to the development of specific diseases (Coppola et al., 2019). Thus, genomic or genetic research is only a subset of biobank research and does not encompass all forms of biobank research, despite what appears to be a common assumption in the literature regarding biobank research. Disease-oriented (specific) biobanks, on the other hand, are established to support human disease research in order to identify potential therapeutic strategies (Coppola et al., 2019). Consent for health research should be sought not only to respect participant autonomy but also to meet certain ethical and legal criteria to be considered valid. The ethico- legal requirements for informed consent in South Africa (SA) have been established through drawing from the development of relevant international guidelines, national legislation and national ethical guidelines with quasi-legal standing, specific to health research over the years which set out a minimal threshold for informed consent. However, the coming into effect of new privacy regulations has created divergent views on what type of consent is now applicable and legally valid for health research in SA. Broad consent is permitted by the South African National Department of Health Ethical Guidelines but appears to be prohibited by section 13(1) of the Protection of Personal Information Act 4 of 2013 (POPIA). This in turn, has implications for existing health research practices.

Given the association between the transfer of samples and data, the long-term nature of biobanking, which makes it impractical to provide too much or adequate information because it is simply not available at the time of sample collection, and the various ways that POPIA has been interpreted, we aim to demonstrate that SA’s current regulatory framework should appropriately permit broad consent use for biobank research where the transfer of samples and their associated data are contemplated. This paper seeks to address the suitability of broad consent as an accepted model for biobank research against the recent developments to privacy protections which have resulted in divergent views on the interpretation of consent for health research. In addition, the paper outlines the gaps in SA’s current ethico-legal framework, debates the effects of ambiguity in the regulatory system and proposes recommendations for reform.

As a starting point, we set out different models of informed consent and debate their suitability for biobank research.

Informed consent in research

There are various recognised models of informed consent, including:

1. Blanket consent, which is consent sought and granted for all types of research with no additional permissions required (Thompson & McNamee, 2017).

2. Meta consent, in which a participant chooses whether to grant consent for each and every future study (Ploug & Hols, 2017).

3. Broad consent for future research use (unspecified) of samples, as frequently used by biobanks, with Research Ethics Committee (REC)/Biobank Ethics Committee (BEC) oversight (SA DoH, 2015).

4. Dynamic consent, which is a technology/internet-based, modified consent over time that allows participants to change their consent preferences in response to changing circumstances (Kaye et al., 2015; Steinsbekk et al., 2013).

5. Waived consent, which is when consent is waived subject to REC's approval if there is only a slight chance that participants will suffer harm, their interests will not be harmed, and the research cannot proceed without the waiver (CIOMS, 2016).

6. Tiered consent, which is consent for the primary study with a choice to allow storage and subsequent use of samples and data (SA DoH, 2015).

7. Narrow (also known as specific) consent for a single use of donor material with no permission for storage or sharing, and new consent required for subsequent use (SA DoH, 2015).

Although the above consent models are recognised, the enactment of SA’s POPIA raises questions regarding which type of consent model is supported by the Act as it prima facie appears that specific consent is required where personal information is processed. This would have major implications for health research projects which involve the extensive networking of samples and data, in specific biobank research. We now address the practical unsuitability of study-specific informed consent for biobank research.

How does study-specific informed consent hinder biobank research?

Given the future-oriented nature of biobanking, specific consent would not be ethically justified in biobank research. This is because it would have been impossible to obtain specific consent for an objective that was not considered at the time of sample and data collection (Caplan, 2009). When using materials for a single specific study, specific consent is sought to use the materials (Eisenhauer et al., 2019). One defence of specific consent is that it demonstrates respect for donors or participants (Hansson et al., 2006). According to Hansson et al. (2006), this argument would be valid if the process of seeking specific consent did not put the quantity and calibre of research that can be carried out in jeopardy, particularly in the context of biobank research (Hansson et al., 2006).

Specific consent is challenging to put into practice because of the practicalities of biobank research (future-oriented research with ambiguous goals and methodologies) (Mikkelsen et al., 2019). This includes the magnitude of research studies and the frequency of new investigations. In addition, unlike in clinical research, the structures and procedures used in biobank research are quite distinct (Mikkelsen et al., 2019). Furthermore, different biobanks take different approaches to the withdrawal of consent by participants. Some biobanks have tiers of different aspects from which participants can withdraw consent, whereas others allow participants to withdraw consent for all aspects of research (Melham et al., 2014). Moving away from the “all or nothing” approach to consent withdrawal, ensures that participants can withdraw from specific, limited aspects of biobank research without withdrawing consent from the entire study (Melham et al., 2014). By abandoning the “all or nothing” approach of consent withdrawal, participants can opt out of only a small portion of biobank research without withdrawing their participation from the entire project (Melham et al., 2014). Considering how challenging it is to apply specific consent to biobank research, it is obvious that this model will likely limit the usefulness of this type of research (Mikkelsen et al., 2019). Therefore, other consent models for biobanks are required.

Broad consent and alternative consent models for biobank research

In the United States (US), the requirement to safeguard participant confidentiality led to the emergence of broad consent (Fisher & Layman, 2018). This was specifically in reference to researchers using potentially identifiable personal information in a secondary manner for purposes other than those for which it was originally collected, including those that materially diverged from the original consent (Fisher & Layman, 2018). However, this form of consent is not always considered appropriate. For instance, a few RECs in Germany around ten years ago refused to approve biobank research that employed a broad consent model (Strech et al., 2016). Consent for research should be based on specific information about the research, as required by the Declaration of Helsinki and data protection legislation (Strech et al., 2016). To create broad consent template forms that would be accepted by all 53 German RECs, a task force was established because of the rise in German biobank projects (Strech et al., 2016).

Alternatives to specific consent include broad consent, blanket consent, dynamic consent, tiered consent, and meta consent (Mikkelsen et al., 2019 Steinsbekk et al., 2013;). According to Mikkelsen et al. (2019), the participant protection requirements for biobank research are different from the security precautions that traditional consent models are intended to offer (in relation to the known specific risks associated with a particular study). Therefore, rather than making comparisons with traditional consent models, any reasonable assessment of biobank research consent models must be based on criteria specific to biobank research.

It is relevant to note at this juncture that tiered consent almost always includes an element of broad consent, because it involves the future use of samples, with the distinction of more specific information being provided in the former versus the latter. For the sake of clarity, the next section analyses the specificity of the information provided when using tiered and meta consent.

Analysis of the specificity of information provided during tiered and meta consent

This section explains what it means for tiered and meta consent to be more specific than broad consent in terms of information provided to participants. To reiterate, broad, tiered, and meta consent models suggest potential sample use in the future. However, there are limitations in disclosing specific research information for subsequent studies. As a result, it is still unclear whether tiered and meta consent models are superior over broad consent. Nembaware et al. (2019) suggested a framework for tiered informed consent in the context of African genomic research. Overall, the information on the consent form is focused on granting consent for a specific area of research (e.g. research into sickle-cell disease, where participants are asked whether they consent to having their samples and data used for specific research reasons) (Nembaware et al., 2019). Obtaining consent for: (1) study of the genetics of sickle cell disease; (2) future research into the genetics of sickle cell disease; and (3) research into the genetics of other diseases or biological processes, would normally be part of sample and data usage research (Nembaware et al., 2019). According to Ram (2008), psychological research findings support the notion that tiered consent provides “abundant choice” or “hyper-choice” (Ram, 2008, p. 269). Information overload, avoidance of decision-making, arbitrary selection, and regret are some of the identified pitfalls of such abundant choices. Nonetheless, it is acknowledged that to comply with the criteria of truly informed consent, the research categories should be increased under this consent model (Ram, 2008).

The National Cancer Institute (NCI) of the National Institutes of Health (NIH) provides recommendations on the information categories for tiered consent. They include whether participants consent to having their materials stored and used for secondary research on the prevention and treatment of diseases, secondary research on the prevention and treatment of a specific research area (such as cancer), consenting (or not consenting) to have their samples associated with their medical history or records, and consenting (or not consenting) for future research (NCI, 2016).

Now that the suitability of different consent models have been debated, we consider recent ethico-legal regulatory developments in SA which have a bearing on this debate.

Overview of the South African regulatory landscape relevant to broad consent

The ethical concept of informed consent has been solidified into national legislation in SA with consistent developments being made to regulate its practice over the years. Section 12(2)(c) of the Bill of Rights provides the right to informed consent by prohibiting medical or scientific research to which consent has not been provided. Other legislation which regulates informed consent includes the National Health Act, 61 of 2003 together with its Regulations. However, more recently, the DoH Ethics Guidelines (2015), SA National MTA template and POPIA include provisions on consent which implicates the use of broad consent for biobank research in the country. An analysis of these documents is carried out below.

Department of Health, National Ethics Guidelines: Ethics in Health Research - Principles, Structures and Processes, 2015 (DoH Ethics Guidelines)

The National Health Research Ethics Council (NHREC) developed Ethics Guidelines (DoH, 2015) in order to guide researchers in ethical and responsible research practices. Informed consent is one of the key norms and standards for guiding ethical research, according to the NDoH Ethics Guidelines. Section 3.3 specifically addresses the use of samples and data for research purposes. The DoH Ethics Guidelines include recommendations and restrictions for human sample collection in relation to the type of informed consent sought and granted by healthcare professionals and research participants or patients, respectively. In section 3.3.4, the DoH Ethics Guidelines define three purposes for biomaterial collection: (1) specific research purposes, (2) therapeutic or diagnostic purposes, and (3) a combination of purposes including future research use. These Guidelines do not advocate the use of blanket consent based on the idea that it would make it difficult to uphold the principle of respect for persons.

Section 3.3.6 of the Guidelines permits broad consent use provided that (1) the type of additional usage is “described as fully as possible” and (2) prior HREC review for the new research is obtained. The rationale for informing participants of third-party use of their materials is based on a history of mishandling of human samples and associated data that does not align with consent granted, resulting in material commercialisation in some cases (Eriksson & Helgesson, 2005; Moodley & Kleinsmidt, 2020; Petersen, 2005; Steinsbekk et al., 2013). Overall, the DoH Ethics Guidelines provide guidance on what is meant by consent information for future use of samples in that researchers should: (1) inform participants that their samples will be used in future research; (2) give them the option of sample anonymization (with an explanation of risks and benefits); (3) inform them of their right to dissent or withdraw participation; and (4) inform them of measures that they (researchers) will take to maintain confidentiality (Section 3.5.2.3).

Although the DoH Ethics Guidelines state that research proposals should specify whether incidental findings (IFs) will be communicated to research participants, this aspect is not addressed in the guidelines’ Consent Template for storage and future use of unused samples. IFs are unexpected discoveries that arise during research but are not intended to be part of that research (SA DoH, 2015). An IF of chromosomal or genetic variants with potential clinical significance, an IF of misattributed paternity, unexpected detection of mass (aneurism) during magnetic resonance imaging (MRI) of the brain, and an unexpected mass in the lung detected during computed tomography (CT) are examples of IFs with potential health and reproductive significance (Wolf et al., 2008). It is suggested that the possibility of IFs be mentioned in consent documents as part of the information provided to participants (Wolf et al., 2008). Several laws and policies governing the return of research findings are gradually being influenced by professional societies that advocate for the reporting of findings and stipulate that researchers should, must, or may return results (Thorogood et al., 2019). The return of IFs should be a mandatory requirement for researchers, based on the notion that research involving humans represents a common good and thus should be for the benefit of individuals and the population at large (World Medical Association (WMA), 2016). Furthermore, the WMA Declaration of Taipei on Ethical Considerations Regarding Health Databases and Biobanks recommends that participants be informed of research findings, including IFs, in order to ensure the validity of biobank consent (WMA, 2016). Although an analysis of the return of IFs is outside the scope of this paper, it is important to consider as a factor that should be built into the information that participants should be made aware of, under a broad consent model, subject to REC oversight, and the sensitivity of the information relayed to participants must be properly evaluated. The next section addresses the NHA's Material Transfer Agreement Template for Biological Materials (SA MTA, 2018).

South African Material Transfer Agreement, 2018 (SA MTA)

Prior to 2018, there was considerable concern in SA regarding the lack of a national MTA (Moodley & Singh, 2016). The SA MTA, which was published in 2018, is the first national model to establish a framework for the Parties (Providing Institute, Recipient Institute, and HREC) to engage in the usage, transfer, and other processing of materials (SA MTA, 2018). Although a different version of the template was used by some researchers prior to it being gazetted, the SA MTA template came into legal effect in 2018 for all researchers. The SA MTA mandates that the supplier of human materials submit completed participant consent forms to the HREC for approval and informed consent for secondary material use, if necessary, along with the research methodology. The SA MTA defines material as samples or human biological material (including personal data) and any associated data.

The SA MTA template has been criticised specifically in terms of consent, with some commentators claiming that the MTA introduces dynamic consent (Thaldar & Townsend, 2021). The critic propose that the SA MTA introduces this consent model by stating that consent for new material uses must be sought on an ongoing basis. Furthermore, they claim that the SA MTA's description of consent deviates from the DoH Ethics Guidelines, which recommends broad consent for future research use of samples (Thaldar & Townsend, 2021). They also point out that the SA MTA's “dynamic consent provisions” supersede those of the DoH Ethics Guidelines because it is a more recent piece of secondary legislation, particularly when research involves the movement of samples across institutions. However, these assertions could be contested.

The SA MTA is in alignment with the principles of the DoH Ethics Guidelines that informed consent should be obtained for secondary use of material if such use is necessary but does not support any specific model of consent (i.e. for future uses of material). In this sense, it is evident that the present DoH Ethics Guidelines have influenced the regulation of the secondary use of materials in the SA MTA when the SA MTA is read in conjunction with the DoH Ethics Guidelines. A discussion of the Protection of Personal Information Act 4 of 2013 (POPIA) which defines standards for the processing and protection of personal information in SA now follows. One of the requirements under the Act for processing of personal information is consent. The following section presents the POPIA consent provisions as they pertain to broad consent.

Protection of Personal Information Act 4 of 2013 (POPIA)

Although the DoH Ethics Guidelines address and allow broad consent for sample collection, there is disagreement between the DOH Ethics Guidelines and POPIA, which requires data collection for a specific purpose according to section 13(1). This, by implication, precludes future research on the use of sample-associated data, which is typical of broad consent. However, research-specific exceptions under the POPIA imply that the future use of personal information is permissible under certain conditions (POPIA, 2013), implying that broad consent is permissible. The DoH Ethics Guidelines are silent on the protection of personal information derived from samples collected for future use. However, it does include a general reference to POPIA.

POPIA governs the protection of personal information in accordance with section 14 of the Constitutional right to privacy. The Act establishes duties and rights for the protection of personal information and applies to the activity of personal information processing. According to the Act, processing is a broad concept. POPIA defines “processing” in section 1 as any activity that includes “collection, receipt, storage, updating, retrieval, dissemination, or degradation.” While human samples and their associated data are covered by the NHA, its Regulations, and the DoH Ethics Guidelines, they are not covered by the POPIA. Data associated with a biological sample, on the other hand, would be considered “personal information” and thus subject to the POPIA (Mahomed & Staunton, 2021). POPIA establishes minimum standards for personal information processing, including genetic and health information. According to the POPIA, there are eight requirements that must be fulfilled when processing personal information: (1) accountability, (2) processing limitation, (3) purpose specification, (4) further processing limitation, (5) information quality, (6) openness, (7) security safeguards, and (8) data subject participation. The accountable party (the research institution or researcher in the context of research) is accountable for ensuring that personal data are processed lawfully, in compliance with the eight POPIA requirements, and in a way that does not infringe on people's constitutional rights to privacy (Adams et al., 2021). The Act impacts all research activities involving the collection, processing, and storage of personal data, including biobank research activities.

According to section 11 of POPIA, consent is one of the requirements for the authorised processing of personal information. In addition, section 13 (1) of the Act mandates that the reason for collecting personal information be “specific, explicitly defined” purpose in relation to the activity to be undertaken. On the surface, it appears that specific consent is required by POPIA. According to Thaldar and Townsend (2021), the consent model required by POPIA is specific consent, and such specific consent should be sought for any processing of research participants’ health information, including the sharing and storage of health research information. Using broad consent, which is typically unspecified consent, may thus be a violation of the Act. Limitations of this type hamper the importance of biobank research given the long-term nature of biobanking (Master et al., 2012). This makes it impossible to obtain specific consent for each future study. The implications of legal limitations on biobank research are discussed later in this paper.

While POPIA is not industry-specific, it provides for the development of Codes of Conduct (COC), which direct how the Act should be interpreted in relation to a certain class of information or industry. The Academy of Science of South Africa (ASSAF) is currently in charge of the procedure for developing a COC for research under POPIA (Adams et al., 2021). The field of health research is covered by the COC for research. Despite the requirement in section 13 of POPIA that personal information be collected for a “specific, explicitly defined” purpose, section 15(1) provides for the further processing or secondary uses if it is compatible with the original purpose for which it was collected. POPIA also states that further processing for research purposes is permitted if: (1) processing is necessary to “prevent or mitigate a serious and imminent threat to” public health (section 15(3)(d)(i); (2) processing is necessary to prevent or mitigate a serious threat to “the life or health of the data subject or another individual”;(section 15(3)(d)(ii) or (3) if the personal information is to be used for research purposes and “will not be published in an identifiable form”(referred to as the general research justification, section 15(3)(e)). The second ground appears to apply to an individual’s data and would not be suited to health research that requires large amounts of data. Therefore, under the general research justification or on the grounds of public health, there is an implication that further processing or broad consent is permitted under POPIA, however, its permissibility is not explicit under the Act and clarity regarding the legal status of broad consent is essential.

According to section 11 of POPIA, consent is one of the conditions for processing of personal information. Section 27(1)(d), which deals with general authorisation concerning special personal information, states that the prohibition on processing of special personal information does not apply if (i) the processing is done for research purposes to the extent that the purpose serves the public interest and the processing is required for the purpose in question and (ii) it appears to be impossible or would require a disproportionate amount of effort to seek consent, provided that there are enough protections in place to guarantee that the processing will not adversely impact the data subject's personal privacy. Dove and Chen (2020) refer to “consent misconception” which is a misconception that the consent of participants to participate in a research project de facto equates to a consent to (also) process their personal data will be exacerbated if the distinction between research ethics consent and data processing consent is not made explicit. In the absence of broad consent, the DoH Ethics Guidelines makes the following recommendations for secondary use of samples or data:

1. To assess whether secondary usage was intended and whether it is covered by the current research protocol, the type of the previously obtained consent should be considered. If so, additional consent is not necessary.

2. If the current protocol’s scope changes, new consent may be necessary.

3. If samples are anonymous and the research's findings will not place any individuals, families, or communities in danger for social, psychological, legal, or financial harm, additional consent is not necessary.

Sections 27(1) and 35(1) of POPIA also provide for the processing of children's information and special personal information for research serving a public interest, provided that processing does not adversely impact the privacy of the data subject or research participant in the case of health research (Adams et al., 2021). Table 1 (Adams et al., 2021) below lists the exceptions to POPIA that particularly relate to research.

Table 1. POPIA research exceptions.

Research specific exception	POPIA section related to the exception
1. Records containing personal information may be retained longer than necessary for research purposes if sufficient protections are in place.	Purpose specification: condition 3, s.14.
2. Personal information should not be processed further unless it is going to be utilised for research and will not be published in an identifiable manner.	Further processing limitation: condition 4, s. 15(3).
3. If the information is collected for research purposes, it is not necessary for openness to prevail when informing participants about the collection of their personal information as required by s. 18(1).	Openness: condition 6, s. 18(4).
4. The restriction on processing special personal information, which includes information about a person's race, ethnicity, religion, biometrics, health, and sexual life, does not apply when the processing is done for research and the goal is in the public interest, when obtaining consent seems impossible or would require an unreasonable amount of work, or when there are sufficient safeguards in place to ensure that the processing will not negatively impact a person's privacy.	Special personal information processing: s. 27(1).
5. Personal information about inherited characteristics may not be processed unless it is required for a research activity.	“Authorisation concerning the data subject’s sex or health life” (Part B, s. 32(5)).
6. Prohibition on processing personal information of children is not applicable if it is for research purposes, serves a public interest or obtaining consent seems to be difficult or would require an undue amount of work, and enough safeguards are in place to make sure that the processing will not adversely impact the child's personal privacy in an undue manner.	Processing of children's personal information is generally prohibited: Part C, s. 35 (1).

Now that the regulatory developments which directly impact broad consent for biobank research have been canvassed, we turn to discuss broad consent under POPIA as the enforcement of this Act has created most of the debates around the permissibility of this consent model in SA.

POPIA and broad consent for biobank research

There are theories on the permissibility of broad consent under the Act. Staunton et al. (2019) maintain that POPIA permits broad consent for the use of personal information, however, other critics of the Act contend that this is not the case (Thaldar & Townsend, 2021). Clarification is necessary because of conflicting interpretations of section 13(1) of POPIA's definition of “specific, explicitly defined, lawful purpose” as it relates to the collection of personal information. This would guarantee that limitations on the use of broad consent, particularly in the context of biobank research, do not impede the urgently needed human health research agenda, while still providing the necessary protection for research participants.

Since POPIA is not a research framework in itself, it is not surprising that there is a difference between POPIA and the DoH Ethics Guidelines on consent. Nonetheless, these differences draw attention to the need for a more simplified regulatory framework, especially in the context of obtaining broad consent for the future use of biobank research data. As already mentioned, the POPIA COC for Research is being developed by ASSAF to help research institutions and researchers comply with POPIA, while also ensuring that proper measures are in place to preserve research data and to hold those who violate POPIA accountable. At the time of drafting this paper, on 19 April 2023, the Code was submitted to the Information Regulator for review. The Code distinguishes between (1) POPIA consent, which is the consent required by POPIA for the use of personal information, and (2) research consent, which is the consent required for research under section 12(c) of the Constitution, the NHA, and the DoH ethics guidelines, and thus, consent for medical and scientific experiments. According to Table 4 of POPIA’s COC for research, POPIA consent must stipulate the specific purpose for processing of personal information as a general legal justification. According to Section 4.3.4 of the Code, it is acceptable to reuse personal data without the research participant's POPIA consent provided it is exclusively used for research and will not be disseminated in an identifiable form. Nonetheless, participants may be notified of further processing in accordance with Condition 6 (Openness and Notification requirement). As a result, the Code acknowledges that participants’ consent will frequently depend on information sharing (whether to POPIA Consent or research Consent). In other words, researchers must make sure that participants have adequate information to make an informed decision while using POPIA Consent (s 4.3.4).

When using broad consent, the condition of “adequate information” can provide a challenge. Furthermore, the Code does not specify whether broad consent is acceptable for processing personal information in the field of health research, although it does not prohibit it. The current paper has highlighted the various ways in which POPIA has been interpreted in relation to the legitimacy of broad consent. The ramifications of such diverse interpretations permit the processing of personal information that does not align with the consent provided, which may lead to regulatory non-compliance. On this premise, we argue that despite the fact that POPIA has exceptions, it is still uncertain whether broad consent is acceptable for research. Clarification is necessary to ensure a consistent interpretation in biobank research.

The implications of an ambiguous regulatory framework for broad consent

As mentioned in the preceding section, divergent interpretations of the permissibility of broad consent for the use of personal information for research purposes under the POPIA cast doubt on already established health research practices. This requires further clarification. There are several types of ambiguities in law, including (1) lexical ambiguity, which refers to a phrase or word with multiple valid meanings; (2) syntactic ambiguity, which refers to a sentence with more than one valid grammatical interpretation, regardless of context; and (3) referential ambiguity, which is a grammatically sound sentence with a reference that the reader might misunderstand given the context (Massey et al., 2009). The ambiguity in section 13(1) of POPIA could be argued to be referential ambiguity because, while the words “specific, explicit, lawfully defined purpose” are clear, confusion arises because of the context provided. Ambiguities make it difficult to read, comprehend, and analyse legal texts (Massey et al., 2009). This could mean the difference between compliance and non-compliance of regulatory requirements (Massey et al., 2009). According to Massey et al. (2009), original legal text may be written ambiguously in order to allow courts to determine what is appropriate or reasonable. In cases where legislation is ambiguous or absent, principles decided by judges in case law may take precedence (Martin, 2008). However, there is currently no case law in SA regarding this effect on personal information.

In terms of its application to genomic research in SA, the fundamental problem with POPIA, which is the requirement for consent for a specific explicitly defined purpose, appears to be a cause of concern (Staunton et al., 2020). However, Thaldar and Townsend (2021) point out that section 13(1) of POPIA is problematic for health research in general because it limits the purpose of personal information collection. Staunton et al. (2020) go on to say that specific consent is not the only type of consent for responsible research. Furthermore, as evidenced by Table 1 which illustrates research exceptions, POPIA allows for broad consent for the further processing of health data for research purposes. In addition, legal interpretation cannot be ethical in a narrow sense that context is critical (Horowitz, 2000). When applied to the context of broad consent for biobank research, this means that specific (narrow) consent would result in little or no biobank research being conducted in SA, because broad consent is the preferred consent model for biobank research (Mahomed, 2020; Moodley & Singh, 2016; Mwaka & Horn, 2019; Tindana et al., 2020). This, combined with the fact that samples and their associated data (which may contain personal information) are linked, necessitates the clarification of a perceived conflict in research between the DoH Ethics Guidelines and POPIA. Consequently, an enabling framework that considers various research contexts and uses of personal information is necessary.

In this paper, a number of issues have been raised, including the following: (1) on the surface, POPIA recognises only specific consent; (2) this can result in limitations when interpreting POPIA for health research, particularly in the context of biobank research; and (3) research-specific exceptions allow for further personal information processing, but whether this extends to applying broad consent in its traditional format is unknown. (4) Divergent interpretations of the POPIA cause confusion in the research sector given that the restrictive nature of POPIA must be balanced with the less restrictive practices of open science.

The position we advance in this paper is that the South African regulatory framework should clearly permit the use of broad consent for personal information, given the future-oriented nature of biobanking and the current DoH Ethics Guidelines, which allow the use of broad consent as long as it protects participants’ rights, including the right to decide whether or not they wish participate in research (autonomy). As a result, a framework geared towards biobank research is necessary. Regulations for biobanks should not be unduly strict; instead, they should guard against exploitation in research to advance science and ultimately improve the health of populations concerned (Staunton & de Vries, 2020).

Consequences of the law limiting biobank research

According to Laurie (2016), some of the challenges in health research include regulatory silos, in which different aspects of research, such as those dealing with participant data, tissues, and embryos, are subject to different legislation, resulting in a lack of reflection on reality in research practice. This has the potential to impair the effectiveness of regulatory oversight, which is critical for health research. Furthermore, fragmented regulatory frameworks and silos do not improve compliance. The terms “oversight” and “accountability” are frequently used interchangeably to refer to biobank regulation (Rothstein, 2005). In the context of this paper, “oversight” refers to the broader regulation of health research, in addition to the former definition.

Hallinan (2020) discusses a purported limitation of the General Data Protection Regulation (GDPR) on broad consent but also points out that the Article 29 Working Party issued additional guidance regarding the specificity of the consent required in regard to scientific research in 2017 after the adoption of the GDPR. Under the predecessor of the GDPR, Directive 95/46, the Article 29 Working Party was the entity charged with interpreting data protection law at the EU level. Representatives of the national Data Protection Authorities (DPAs), the organisations tasked with interpreting and upholding data protection legislation in EU Member States, formed the committee. Conversely, the Working Party's “Guidelines on consent under Regulation 2016/679” contain significantly fewer sympathetic declarations on Recital 33 and broad consent. It is possible to interpret the two components of the Working Party's advice as particularly troublesome for broad consent. Second, the guidance seems to try to narrow the extent of applicability of Recital 33, and hence, of broad consent. This implies that in theory, projects involving scientific research can only use personal data with authorisation if they have a clearly defined goal. As an exception, Article 33 permits the purpose of data processing to be expressed at a more general level, in instances where the purposes for data processing within a scientific research project cannot be specified at the outset. Second, the guidelines appear to support the necessity for periodic rolling granular consent rather than a single, ex ante, broad consent in circumstances where Article 33 would still apply. The term “ex-ante” refers to an estimate of a variable when there is ambiguity regarding its value before a process has begun (Lexis Nexis, 2023). Ex ante, which means “before” is a Latin term. Ex post refers to the term for an unclear variable that is known after the process has concluded (after the fact) (Lexis Nexis, 2023). As a result, the scope of consent may be a practical basis for processing in the context of banking personal data, and associated samples have been severely reduced as a result of Article 33 guidelines in terms of interpreting and restricting the use of broad consent for research (Peloquin et al., 2020).

Through their gatekeeping roles in research protocol review and approval, RECs and Biobanks Ethics Committees (BECs) in SA contribute to the regulatory oversight mechanisms for health research. According to Laurie (2011), REC gatekeeping and many of the legal frameworks that govern scientific research are problematic. Laurie (2011) maintains that this is because they create oligarchies of science regulation driven by bureaucratic inspections that favour a tick-box mentality over genuine engagement with genuine ethical quandaries. In the South African context, where the exploitation of African samples and data is not a thing of the past, and where the nature of research is constantly changing (due to scientific and legal developments), the role of RECs must also change (Mahomed & Labuschaigne, 2019).

Borgman (2018) explains how two methods can be used to balance the benefits and risks of massive datasets in order to prevent data misuse. One strategy is to follow the guidelines of limited collection, high-quality data, use specification, and purpose specification. Controlling how the data are used after they have been obtained is the second method. Specifying who has access to what data, when, and under what conditions should be part of governance as well as defining what uses are acceptable and unacceptable.

Within the South African regulatory framework, the only document that regulates broad consent and future sample use in research, with a focus on consent information that should be given to participants, is the NDoH Ethics Guidelines. The Guidelines also recommend that participants should be informed of their potential for harm or discomfort. Participants should also be informed about risk-mitigation measures. In particular, when identifiers are retained, they should be informed of the type and extent of specific risks of harm linked to the use and storage of materials. Participants should be made aware that, when there is a low risk of harm, an REC may accept a consent waiver for secondary material use. This is relevant when doing research would be impossible without the waiver, and participants’ interests and rights are unlikely to be harmed. Participants should also be informed about the implications of genomic research, genetic or genomic testing such as paternity testing, and the risks associated with confidentiality. However, some aspects of consent information are not addressed in the DoH Ethics Guidelines, such as the provision of rules of access to the biobank (to safeguard the confidentiality and privacy of participants), commercial use of materials, benefit sharing, and material sharing with other countries. As a result, the following section examines the WMA Declaration of Taipei (2016) in order to improve SA's current framework for biobank research consent. International perspectives must be taken into account while interpreting the Bill of Rights, according to Section 39(1)(b) and (c) of the Constitution, which also states that foreign law may be considered.

WMA Declaration of Taipei, 2016

The WMA Declaration of Taipei offers ethical guidelines for health databases and biobanks. This guidance includes provisions for valid consent in terms of the information that participants should be given regarding materials that are to be stored maintained in a biobank. The Declaration and the DoH Ethics Guidelines, which are also largely included in the SA MTA, are somewhat aligned with this information. Table 2 outlines some of the important information relevant to consent for the storage and potential use of personal data and human samples. Table 2 compares these instruments in an effort to enhance the current DoH Ethics Guidelines Consent Form Template.

Table 2. Comparison of the DoH Ethics Guidelines, SA MTA, and the WMA Declaration of Taipei in relation to consent for storage and future use of human samples and personal data.

Key information aspects for participants	NDoH Ethics Guidelines	SA MTA	WMA Declaration of Taipei
Purpose of sample collection or biobank	✓	✓	✓
Nature of material to be collected	✓	✓	✓
Risks associated with material collection, use, and storage	✓	X	✓
Investigate the possibilities and, where applicable, explain genetic research and its implications	✓	X	X
A choice between samples remaining identifiable or for de-identification of samples, explaining risks and benefits for each option	✓	X	✓
That samples will not be sold for profit	✓	X	X
Research conducted must have been approved by a REC	✓	✓	✓
The right to refuse and withdraw from research participation	✓	X	✓
If materials are no longer identifiable, the participant may not know what their material is used for and will not be able to withdraw consent	✓	X	✓
How privacy (WMA) and confidentiality (NDoH) will be maintained	✓	✓	✓
Procedure for return of results which includes IFs	X	X	✓
Rules of biobank access	X	X	✓
When applicable, commercial use, benefit sharing, IP, material sharing with other countries	X	✓	✓
Regulating transfers of personal data/personal information	✓(limited)	✓	✓

When the DoH Ethics Guidelines, the SA MTA, and the WMA Declaration of Taipei are compared for their important informational elements, it becomes clear that the SA regulatory framework generally provides sufficient guidance on the consent information that should be provided to biobank research participants. The Ethics Guidelines and the SA MTA are complementary to each other. The fact that neither instrument mentions access rules to the biobank may be compensated by the fact that the DoH Ethics Guidelines require the biobank to state how confidentiality will be maintained. The DOH Ethics Guidelines should be expanded to include guidance for commercial use, benefit sharing, intellectual property rights, and material sharing with other countries. Personal information (data), privacy, and confidentiality are required for all three documents examined. The DoH Ethics Guidelines do not provide specific guidance for consent for data use. However, the SA MTA and the WMA Declaration of Taipei require consent for data use. To ensure ethical processing of research data, the DoH Ethics Guidelines must address not only consent for sample use but also consent for data associated with the samples. Although consent for the use of personal information and consent for the donation of samples for research are two distinct things, in the context of biobank research, sample transfers may also involve the sharing of personal information. Thus, data-protection mechanisms should be included in the consent framework.

Proposed amendments to the current regulatory framework relating to broad consent

Considering the identified legal gaps in SA's regulatory framework for biobank research broad consent, we propose regulatory changes to: POPIA, the DoH Ethics Guidelines. Notably, we propose that POPIA-related amendments be incorporated into ASSAF's COC for Research or within a Data Transfer Agreement (DTA).

POPIA

The ambiguity identified in (section 13(1)) of the POPIA and discrepancy with the current regulatory framework for biobank research should be addressed in the COC for Research and/or in a DTA by making the following changes:

1. To address the discrepancy between section 13(1) of POPIA and the DoH Ethics Guidelines, which allow for broad consent for future research use of human samples, and to address the ambiguity of the former, we propose that the words “specific, explicitly defined purpose” in that section be clarified within the COC for Research as applied within the health research sector. Currently, the latest draft version (dated 26 April 2023) of the COC for Research does not mention broad consent for the processing of personal information in the health research sector. Although broad consent is not prohibited by the Code, the specificity required by section 13(1) of POPIA must be interpreted in light of the Act's research exceptions. To avoid confusion when conducting health research and biobank research, the Code should include more detail to guide RECs and researchers. The type of consent used should also be specified in a DTA where personal information is transferred. To protect participant autonomy when seeking broad consent, participants should be given information about a field of research (e.g. genomic) or research on a specific disease, rather than specific details about the prospective research, as this would be impractical for future research;

2. Inclusion of specific rules for biobank research access and processing of personal information (personal data and sample associated data). To protect participants’ rights to privacy and confidentiality, the custodian should make the following changes to data protection requirements:

   1. Data should be stored in a biobank information management system (BIMS) with an encrypted password system to prevent unauthorised access to sample-associated data;

   2. In line with the DoH Ethics Guidelines, data should always be anonymized, for example, through coding, so that no donors can be identified;

   3. Data access, including network server access, should be restricted to authorised users who have login credentials (user identification (ID) and password);

3. Taking the rules in (2) into account, the terms for data transfer to third parties, including cross-border transfer, should also include the following:

   1. Appropriate safeguards for transferred data (explained in detail in point f. below) as per article 46 of the GDPR and section 72 of POPIA, which states that a legally binding agreement between the parties is one basis for international transfers;

   2. Given the limitations for specifying the purpose in cases of future research use, the purpose of data transfer should be as explicitly defined as possible. The broad scope of future data research that will be conducted should be stated;

   3. The purpose of data transfer should be consistent with the consent granted;

   4. The provider institution's responsibilities include obtaining REC approval for data access and use;

   5. The recipient institution's responsibilities include safeguarding the privacy and confidentiality of the data as specified in 2. above;

   6. According to section 72(1)(a) of POPIA, the recipient institution's country should have data protection laws in place that provide an adequate level of personal information protection; according to article 45 of the GDPR, an adequate level of data protection should include respect for the rule of law and human rights, relevant legislation pertaining to security, including implementation of such legislation, professional codes, data protection rules, and security measures. Although SA has not yet received a favourable adequacy assessment from the European Commission, it is important to note their requirements when concluding contracts and Codes that regulate transfers of personal information;

   7. It should be explicitly stated in a contractual agreement (e.g. DTA) that monetary profiting from transferred data is prohibited. DTAs are a useful tool for regulating data access (Shabani et al., 2021). In section 12, the SA MTA addresses IP, a type of commercialisation, by referring the parties to relevant laws pertaining to the applicable protocol. The Intellectual Property Laws Amendment Act 28 of 2013 and Section 60 of the NHA, which forbids the commercialisation of human samples, are the appropriate legislation in this situation.;

   8. It should be explicitly agreed that in cases of confidentiality breaches, where South African data is being transferred or processed for research purposes, a civil action will be instituted in a South African court against the responsible party via the Regulator (Information Regulator) in accordance with section 99 of POPIA.

DoH Ethics Guidelines

Given the gaps identified in the DoH Ethics Guidelines, including the Consent Form Template for future research use of samples which is Appendix 3(4) of the same Guidelines, the following changes to the Consent Form Template of the Guidelines are proposed:

1. Participants should be informed that sample consent and data consent are inextricably linked in most health research cases and that they will not be able to withdraw their consent in certain situations where materials have been rendered unidentifiable. Omitting this aspect during the consent process has the potential to reduce participant autonomy by not providing the participant with adequate information. To avoid confusion, guidance on when consent expires should be provided.

2. Adequate information should be provided to participants to strengthen their autonomy. As a result, the following changes are proposed to the Consent Form Template in Appendix 3(4) of the Guidelines:

   1. The heading of the Consent Form should include sample associated data;

   2. Point 1. above (i.e. that withdrawal is not always possible) should also be mentioned on the Consent Form Template so that participants are aware of the limitations of their right to withdraw consent;

   3. The Consent Form Template should stipulate whether or not IFs will be communicated to research participants because this aspect is provided for in the Guidelines;

   4. The rules of access to the biobank should be explained to participants;

   5. When applicable, commercial use of materials and benefit sharing, including IP benefit(s); material sharing with other countries and/or parties should be disclosed to participants;

   6. The Consent Template allows for tiered consent by providing participants with more specific information in terms of stored sample permissions for: (1) future research but only on the same subject as the current research; (2) future research of any kind that has been approved; and (3) future research except for research on a specific topic. This section of the template should state that it provides for tiered consent, with an additional section inserted to provide an alternative for broad consent when permission for a broad area of research is sought.

3. To avoid confusion among researchers about whether broad consent is permitted in research involving children, guidance on whether or not broad consent is permitted in this population group should be provided.

Conclusion

The goal of informed consent is to provide participants with information on the benefits and risks of participating in research, while simultaneously allowing them to exercise their autonomy. Giving participants sufficient information knowledge (i.e. based on what a reasonable person would want to know; the “reasonable person standard”) demonstrates their autonomy, which is one of the qualities of ethically valid consent. In addition to providing adequate information to research participants, there are other elements required for valid informed consent identified from ethical guidance documents and other literature sources, which have been set as different benchmarks. These include participants’ voluntariness (willingness) to participate, their right to withdraw, consent that is free of coercion and capacity to consent. The identified legal gaps in SA's regulatory framework relating to broad consent for biobank research have the potential to (1) allow for the processing of personal information that does not align with consent granted, (2) provide insufficient information, undermine participant autonomy, and (3) confuse researchers due to unclear guidance, potentially resulting in non-compliance. The proposal for amendments to SA's regulatory framework pertaining to biobank research broad consent is aimed primarily at amending the instruments governing biobank research (DoH Ethics Guidelines 2015) and protecting personal information (POPIA, 2013). The proposed changes to the national regulatory framework may have the following advantages: (1) clarify POPIA ambiguity and the resulting divergent interpretation regarding the collection of personal information for health research in terms of the words used, “specific, explicitly defined, lawful purpose;” (2) ensure adequate safeguards for research participants by specifying rules for data access and processing of personal information; and (3) including the Consent Form information requirements specified in the DoH Ethics Guidelines section 3.5.2.3 in the template, ensuring adherence to this aspect of the Guidelines. According to the analysis in this paper, specific consent appears to be a requirement under section 13(1) of POPIA, and using broad consent, which is typically unspecified, could be a violation of the Act. There are conflicting interpretations of POPIA section 13(1). Thus, it is argued that POPIA casts doubt on whether broad consent is permitted, even though there are exceptions to the processing of personal information for research purposes. It is also important to clarify the perceived incompatibility between the POPIA and the DOH Ethics Guidelines, which expressly permit broad consent in the context of biobank research. The consequences of legal limitations on biobank research identified in this paper are regulatory silos or fragmentation that impede regulatory oversight and compliance. Given the preceding discussion of differing interpretations of POPIA pertaining to broad consent use, as well as the regulatory gaps identified in the DoH Ethics Guidelines, the regulatory framework pertaining to broad consent for biobank research should be amended. Developing an enabling ethico-legal framework towards broad consent for biobank research in SA, ensures that the much-needed human health research agenda is preserved.

Acknowledgements

This work forms part of M.M.’s PhD (currently under examination) titled “An ethico-legal analysis of broad consent for biobank research in South Africa: Towards an enabling framework.” M.M would like to acknowledge her PhD supervisors, Prof. S. Mahomed and Dr J. Gardner (Steve Biko Centre for Bioethics, University of the Witwatersrand, SA).

Disclosure statement

No potential conflict of interest was reported by the author(s).

Correction Statement

This article has been corrected with minor changes. These changes do not impact the academic content of the article.

Additional information

Funding

M.M’s PhD was funded by the National Health Laboratory Service (NHLS). Publication of this article was funded by the University of the Witwatersrand.