'Potato potahto'? Disentangling de-identification, anonymisation, and pseudonymisation for health research in Africa.

Abstract

Effective scientific research relies heavily on data sharing, particularly in collaborative projects spanning multiple African countries. Researchers must be cognisant of data protection laws, especially regarding secondary data use and cross-border data sharing. In this article, we examine how the terms 'anonymisation', 'de-identification', and 'pseudonymisation' are employed in data protection legislation across 12 African nations and compare them with two prominent regulatory frameworks-the Health Insurance Portability and Accountability Act of the United States of America and the General Data Protection Regulation of the European Union. While 10 of the selected African countries have enacted data protection laws, only six explicitly incorporate these terms, often without clear definitions. Despite this, our analysis reveals that the terms 'de-identification' and 'anonymisation' are distinct legal concepts in the selected jurisdictions, underscoring that researchers must employ these terms carefully and not assume they are interchangeable. Our study highlights the necessity for researchers to use terminology which is consistent with an individual African country's choice to ensure internal consistency, legal compliance, and respect for legislative preferences. It is imperative for researchers involved in international health projects to be acutely aware of how terms are interpreted within each jurisdiction and the possible legal ramifications for data sharing.