Introduction
Can personal genomic sequence data be protected by personality rights?
Is personal genomic sequence data protected by POPIA?
What entitlements can a data subject exercise over their personal genomic sequence data?
How do the personality rights of research participants affect ownership of the data?
Can any other people have personality rights in an individual's personal genomic sequence data?
This article is part of a series that provides a comprehensive and integrated analysis of the various legal dimensions applicable to the most basic kind of human genomic data, "personal genomic sequence data" – that is, the genomic sequence data (often referred to as the "raw" genomic data) of a particular person (in contradistinction from aggregated genomic sequence data of multiple persons).(1) In particular, this article focuses on the personality rights dimension of personal genomic sequence data.
Can personal genomic sequence data be protected by personality rights?
The United Nations Educational, Scientific and Cultural Organization International Declaration on Human Genetic Data (2003) contains provisions that relate to personality rights in respect of "human genetic data", which it defines as "[i]nformation about heritable characteristics of individuals obtained by analysis of nucleic acids or by other scientific analysis". This would therefore include personal genomic sequence data.
Although the Declaration is not legally binding, South African courts can consider the Declaration when developing personality rights in respect of human genetic data. In brief, the Declaration provides that individuals must give consent "without inducement by financial or other personal gain" for the collection, storage and processing of their genetic data, and further that individuals must have the option to withdraw consent, unless the relevant data is "irretrievably unlinked" from an identifiable person. The Declaration places a duty on the state to protect individual privacy and safeguard the confidentiality of identifiable data.
Is personal genomic sequence data protected by POPIA?
In South Africa, much of the substance of the common law personality right in respect of personal data has been codified (ie, made into statute law) and expanded on in the Protection of Personal Information Act 2013 (POPIA). The protections offered by POPIA prevent and limit the unlawful processing of personal information by stipulating when, how, for what purpose and by whom a data subject's personal information may be collected, used or shared. In terms of POPIA, for such protection to be exercised, the data must first be "personal" information as defined – that is, information relating to a person, including, but not limited to, the biometric information of the person. Personal genomic sequence data would fall within this definition.
Secondly, it must have been recorded or reduced to a "record", regardless of when it came into existence. A "record" is defined in POPIA as any recorded information, regardless of form or medium, produced, recorded or stored by means of any computer equipment, including hardware, software or other device, and any material subsequently derived from such information. As whole-genome sequencing using high-throughput sequencing technology is not an instantaneous event, but rather a gradual digital accumulation of genetic information over a period of hours, the recording of personal genomic sequence data in digital form is also not an instantaneous event, but rather a process.(2)
Lastly, for POPIA to apply, the data must not have been de-identified. De-identification is the process used to prevent revealing the identity of the person to whom the data relates. Whether genomic data can ever be truly de-identified is the subject of much recent conjecture.(3) It has been suggested(4) that even heavily sampled anonymised datasets are unlikely to satisfy the modern standards for anonymisation, and challenge the notion that technical and legal de-identification is possible. Although personal genomic sequence data is uniquely identifiable of an individual, it cannot be used to identify that individual unless there is a link to personally identifiable data. Importantly, the mere fact that personal genomic sequence data – or any genomic data – has been separated from any identifying information about the person to whom it relates does not mean that such data is legally de-identified. If there is a reasonably foreseeable method to link such data, the personal genomic sequence data would fall foul of the definition of "de-identify" in POPIA.
What entitlements can a data subject exercise over their personal genomic sequence data?
As a personality right is inalienable and cannot be lost or separated from the data subject's personal data, the data subject (in the capacity of a personality right holder) can exercise the independent entitlements connected to the personality right, as well as those provided for in POPIA. Such an entitlement grants data subjects control, access and use of their personal data. In the research context, the ways in which personal data can be used by a third party (in this case, the research institution) can then be curtailed at the data subject's discretion through the right to withdraw consent, to be notified of and to object to the processing of their personal data.
Although the third party may own the data, in effect the owner's entitlements are curtailed in a specific way: they do not have unfettered leeway to collect, use and share the personal genomic data, and any subsequent use and research must be subject to such personality rights of the data subject (and as contained in POPIA). Aligned with this, POPIA provides for the future use and re-purposing of personal data under certain circumstances. In this regard, the further processing of personal information for research purposes is allowed – subject to the condition that the data must not be published in an identifiable form. However, although this "research exception" may permit secondary analysis of data for further research, it does not exonerate researchers from complying with POPIA.
How do the personality rights of research participants affect ownership of the data?
It is worth reiterating that the personality rights of research participants (ie, data subjects) cannot be divorced from their personal data. Thus, ownership in the personal data exists in addition to, and independently from, and in a sense is encumbered by the independent entitlements afforded by the personality rights of the data subject. Any onward transfer of data ownership would, therefore, be burdened by the personality rights of the data subjects – including their POPIA rights – existing at the time of the transfer.
For example, if a research institution were to transfer a dataset containing the personal genomic sequence data of several individuals to another research institution, the second instances of the personal genomic sequence data of those individuals (in the capacity of new legal objects) would be susceptible of ownership by the recipient research institution (if that was what was intended by the parties to the data-sharing agreement). However, the data would remain encumbered by the independent entitlements afforded by the personality rights of the data subjects (including POPIA) and the dataset as a whole would remain protected by copyright of the transferring institution.
Can any other people have personality rights in an individual's personal genomic sequence data?
Given the nature of personal genomic sequence data, which contains information not only about the data subject but also about the data subject's ancestors, descendants, family and ethnic group more broadly, the question can be posed whether such persons (or community or state) should not also have a personality or personality-type right in respect of such data. For present purposes, suffice to say that POPIA only protects the individual data subject. However, this does not bar development of the common law on personality rights. As such, this is rich soil for further research.
For further information on this topic please contact Joanne van Harmelen at ENSafrica by telephone (+27 21 410 2500) or email ([email protected]). The ENSafrica website can be accessed at www.ensafrica.com.
Endnotes
(1) This series on the legal nature of personal genomic sequence data is a summarised version, containing excerpts, of "The multidimensional legal nature of personal genomic sequence data: A South African perspective" by Thaldar et al (2022). For the first article in this series, see "Legal nature of personal genomic sequence data in South Africa: property rights dimension".
(2) Thaldar, D W (2021), "Why POPIA does not apply to DNA" S Afr J Sci. 117 (7/8), 1–2.
- Shabani, M, and Marelli, L (2019), "Re‐identifiability of genomic data and the GDPR: Assessing the re‐identifiability of genomic data in light of the EU general data protection regulation", EMBO Rep 20 (6), 1–5; and
- Townsend, B A, and Thaldar, D W (2019), "Navigating uncharted waters: Biobanks and informational privacy in South Africa", S Afr J Hum Rights, 35 (4), 329–350.
(4) Rocher, L, Hendrick, J M, and de Montjoye, Y A (2019), "Estimating the success of re-identifications in incomplete datasets using generative models", Nat Commun, 10, 3069–9.