Protection of Personal Information Act No. 4 of 2013: Implications for biobanks

Abstract

The Protection of Personal Information Act (POPIA) No. 4 of 2013 is the first comprehensive data-protection regulation to be passed in South Africa (SA). Its objectives include giving effect to the constitutional right to privacy by regulating the way in which personal information must be processed, balancing the right to privacy against other rights, and establishing an Information Regulator to ensure that the rights protected by POPIA are respected. POPIA will have an impact on health research, including biobanks. As sharing of samples and data is a central feature of biobanks, POPIA could change the way in which data are obtained, shared and exported. In particular, the provisions regarding data minimisation, requirements pertaining to the transfer of data abroad, consent provisions and identification of the ‘responsible person’ will impact the operation of biobanks in SA. With POPIA soon to come into force, it is now time to consider its implications for biobanks in SA.