EU data transfer rules and African legal realities : is data exchange for biobank research realistic?

Key Points To effectively collaborate in biobanking and build capacity in low and middle-income countries, data transfer from European Union (EU) Member States to states in Africa is crucial. Although under the General Data Protection Regulation (GDPR) avenues for data transfer exist, the ones feasible for transcontinental data exchange for biobank research rely on EU enforcement which in essence means limited oversight possibilities and, consequently, considerable risks to the EU data subject’s privacy. To ensure effective data protection for data subjects in biobanking, raising the data protection bar in data recipient countries is crucial. Although Kenya, Nigeria, South Africa, and Uganda have taken considerable steps towards developing data protection frameworks, only that of South Africa and Nigeria’s Protection of Personal Information Bill seem to be such to meet the protection level set out by the GDPR. The legislative initiatives in Kenya and Uganda require revisions to ensure that protection of privacy is not undermined when data are being sent to these countries. Currently, considerable responsibility is placed in the hands of the legislatures in the countries of concern—and notably in Kenya, and Uganda—to set foundations for ending research and research integrity-harming practices. In Nigeria, these foundations are defined in the Protection of Personal Information Bill, but not adopted yet. South Africa, however, has taken a big step towards building routes for genuine biobank capacity-building in the country and collaboration in that regard.B3Afric