1. China: Human Genetic Resources and Biosecurity

Of the three jurisdictions we will highlight, China has been the most consistent and assertive in characterizing human genomic data as a national resource, but it has not always done so in a way targeted towards exclusion. As far back as 1998 the Ministry of Science and Technology (MOST) has enforced its Interim Measures, which were essentially licensing restrictions on the export of so called “human genetic resources” (HGR), including inter alia genomic data.Reference Chen and Song³⁴ These measures required foreign entities to obtain a permit, register with local authorities, and collaborate with a Chinese institution to access Chinese HGR.³⁵

Facially, the Interim Measures are at odds with data sharing principles supporting the commons and mostly seem to be an obstacle to international collaboration,³⁶ but some context is needed. The original purpose of these measures was to prevent biopiracy, or uncompensated exploitation of a country’s genetic resources, and to ensure that as a developing country China received its fair share of the benefits that might accrue from Chinese HGR.Reference Xue³⁷ Rather than discourage collaboration, the number of international collaborations between Chinese institutions and institutions in developed countries rose dramatically during the 2000s.Reference Au and Silva³⁸ Indeed, for the most part the Interim Measures seem to have been interpreted narrowly or lightly enforced in this context.

Since 2016, coinciding with Xi Jinping’s administration, it has become increasingly clear that Chinese officials view the collection and exclusive control of genomic data as critical to economic development and national security.³⁹ The Chinese government has stated an intent to become a world leader in the fields of biotechnology and precision medicine and has recognized the need for large amounts of health and genomic data to achieve this goal.⁴⁰ It has facilitated this through the mass collection of health and genomic data at home and abroad through publicly funded development of data infrastructure, largescale sequencing initiatives, and investment in private genomics companies.⁴¹

In late 2018, for the first time Chinese officials publicly denounced five Chinese institutions for violating the data export requirements in the Interim Measures.Reference Cyranoski⁴² These companies included the BGI group, which had published the results of a large international study on the genetics of depression in Nature⁴³ without MOST’s permission.⁴⁴ Following this, in early 2019 China enacted its first comprehensive regulation on HGR, the Regulation on the Management of Human Genetic Resources (MHGR), and in 2020 it enacted a first of its kind Biosecurity Law, with strict sets of provisions directly addressing HGR used in research and international collaboration.

The MHGR and Biosecurity Law together form the backbone of the new Chinese legal regime for human genomic data. The MHGR mostly codified many of the requirements of the Interim Measures while adding stricter controls on foreign researchers.Reference Li and Chen⁴⁵ The Biosecurity law imposed a new governance framework for managing seven identified biology related activities that present national security risks, including the management of HGR.Reference Huigang⁴⁶ Recognizing the complex interaction between these two laws, in March 2022 MOST released a set of draft implementing rules that represent a substantial break from policies underscoring the commons. They effectively ban the provision, use, or collection of HGR information by foreign controlled entities.⁴⁷ All international research collaborations involving HGR must share a backup of any HGR data with Chinese researchers and the Chinese government.⁴⁸ Moreover, the laws require a MOST security review for the foreign provision of HGR of important biological families, HGR originating from sensitive places, exome sequencing and genome sequencing of over 500 individuals, and any other cases that could impact public health, national security, or the social interests of the state.⁴⁹ There is some dispute over the full impact of the provisions, particularly as Chinese researchers continue to share research data even in the face of suspected government pressure.Reference Zhang⁵⁰ Nevertheless, there is already some evidence that these laws are having a chilling effect on international collaborations with Chinese researchers.Reference Cohen⁵¹ There are also examples of recent retractions of genomic data linked to international publications at the request of Chinese institutions.Reference Cai⁵²

2. The United States: Research Integrity and Safeguarding the Bioeconomy

For the US, treating genomic data as a NSR stands in contrast to the past commitment and continued leadership of US institutions in promoting the genomic commons. From their inception with the polices surrounding the HGP and continuing to this day, open access and widespread genomic data sharing are the official policy of US funding institutions, like the National Institutes of Health (NIH),⁵³ and reinforced by funding legislation, like the 21^st

Century Cures Act.Reference Majumder⁵⁴ Moreover, while the EU, China, and most countries around the world have gradually adopted stricter data localization measures and controls on international data sharing, the main US federal laws that regulate genomic data sharing in this context, namely the Health Insurance Portability and Accountability Act (HIPAA) and the human subjects research protections found in the Common Rule, impose few restrictions on international data sharing.Reference Majumder⁵⁵

The characterization of genomic data as a national strategic resource in the US can be largely attributed to its geopolitical rivalry with China. Since 2017, US intelligence agencies have raised national security concerns related to Chinese access to genomic data through scientific collaboration, funding of scientific research, investment in US genomic sequencing companies, and the purchase of US companies.⁵⁶ The first two concerns prompted a series of investigations related to research security including a 2018 report by the Office of the Inspector General (OIG) of the Department of Health and Human Services (HHS) that addressed the potential national security risks of foreign access to genomic data.⁵⁷ They have also led to NIH investigations and the controversial Department of Justice (DOJ) investigation of foreign researchers known as the China Initiative.⁵⁸ Although these investigations have been discontinued, they caused many institutions to reassess foreign collaborations and may have a chilling effect on collaborations moving forward.Reference Van Noorden⁵⁹

The most forceful policy responses have been targeted towards concerns related to Chinese access to genomic and health data through investment and partnerships with US based private sector organizations. These concerns relate to Chinese government access to sensitive health and genetic data and its impact on US national security and economic competitiveness in the bioeconomy.⁶⁰ The national security threat from Chinese access to sensitive data is more straightforward: US officials fear that certain sensitive data could compromise important individuals, like government officials, or reveal strategic vulnerabilities regarding the US population.⁶¹ The economic security threat regarding data access and competitiveness in the bioeconomy is described in the 2019 report Safeguarding the bioeconomy from the National Academies of Sciences, Engineering, and Medicine.⁶² Billions in public research expenditures, free access to genomics data held in the in the commons, public-private partnerships, and private venture capital investment form a complex ecosystem that drives health innovation.⁶³ As such, large collections of genomic data held by public organizations and increasingly private consumer genomics companies are a critical input for technological advancement in key areas like the development of pharmaceuticals and managing public health.⁶⁴ The fear that the report focuses on is foreign government aligned organizations receiving asymmetric access to genomic data generated by US firms and research organizations.⁶⁵ A situation which could lead to a loss of economic competitiveness in strategic health sectors and create strategic vulnerabilities for the US.

Though some of these concerns could be mitigated through data protection legislation, it is telling that the US has instead responded through national security laws and policies. Through legislation like the Foreign Investment Risk Review Modernization Act (FIRRMA) in 2018 ⁶⁶ and various executive orders,⁶⁷ the Federal government has endowed executive agencies with increased authority to intervene in transactions that involve foreign organizations and US health and genomic data. For instance, in 2019 the Committee on Foreign Investment in the United States (CFIUS) used its new authority under FIRRMA to compel iCarbonX, a Chinese genomics company, to divest its controlling stake in PatientsLikeMe, a US based personalized health research company.⁶⁷ The purpose of the deal was to combine PatientsLikeMe health data, a network of 500,000 individuals, with iCarbonX’s genomics and AI technology to drive new health research and treatment.⁶⁸ Although CFIUS orders are not published (for national security purposes), the deal was likely blocked out of fear that the Chinese government would be able to access the sensitive health data of US persons.⁶⁹

More recently in late 2021, the Department of Commerce (DOC) issued a new interim rule (the Supply Chain Rule).⁷⁰ This rule originates from an executive order of June 2021, the Executive Order on Protecting Americans’ Sensitive Data from Foreign Adversaries, in which the Biden administration ordered HHS and the DOC to evaluate and respond to the threat of Chinese access to large repositories of sensitive US health and genetic data and its impact on US national security and economic interests.⁷¹ This rule authorizes the DOC to intervene in or prohibit any transaction of information services or technology between a US person and a foreign controlled entity that involves the transfer or collection of large amounts of sensitive US health or genetic data and that threatens national security.⁷² Given its sheer breadth, this rule could enable DOC intervention in a wide range of scenarios, including a research center contracting with a foreign cloud service provider, a partnership between a US hospital and a foreign genomics institute, or a research lab licensing software developed by a foreign entity.

3. The European Union: Digital Sovereignty and Strategic Autonomy

Like the US, the EU has generally been a leader in genomic data sharing and open science initiatives, and it continues to advocate for these polices today. The EU has also long been a world leader in setting data protection standards for sensitive data like genetic data.⁷³ Most notably since 2018, the EU’s General Data Protection Regulation (GDPR) has imposed strict rules on the processing of largescale sensitive data including genetic data.⁷⁴ The main objective of the GDPR is to protect the fundamental rights of individuals and is therefore not an NSR policy. However, it is worth mentioning here because of its central role in EU law and policies and the challenges it has presented for the commons and international transfers of biomedical research data.⁷⁵

For the EU, the characterization of genomic data as a NSR has been an indirect result of its push to leverage EU data in healthcare and health innovation in the post-GDPR era. This push has centered around strategic autonomy, which is a term that was first used in the field of defense but has since emerged as a catch-all term for EU industrial policy that aims to increase European autonomy in specific strategic sectors.⁷⁶ Digital health has been recognized as one of these strategic sectors and the EU hopes to achieve strategic autonomy in this sector by unleashing its Strategy for Data.⁷⁷ The Strategy for Data is not one policy, but rather several pieces of legislation aimed at harnessing data as an economic resource that can help the EU maintain a competitive edge in strategic sectors.Reference Carvalho and Kazim⁷⁸ This strategy represents a clear shift from the individual rights framework of the GDPR to policies that represent broader strategic and economic concerns associated with data.

Understanding how Strategy for Data legislation treats genomic data as an NSR requires some brief background on the international transfer regime for personal data under the GDPR. Under the GDPR and the Court of Justice of the European Union (CJEU) case law, personal data may only be transferred to a third country if provided a level of technical or legal protection that is essentially equivalent to that in the EU.Reference Hallinan, Bernier and Cambon-Thomsen⁷⁹ The European Commission can determine that a jurisdiction provides adequate legal protections, subject to certain conditions, and render an adequacy decision for that jurisdiction under Article 45.⁸⁰ Alternatively, data exporters can make an individual determination that, subject to certain contractual and technical safeguards, a transfer will provide essentially equivalent protections and rely on several other possible transfer mechanisms under Articles 45 or 46.⁸¹ Adequacy decisions provide exporters with the most certainty, but thus far have only been rendered for a very limited number of countries. A list which does not include the US after the CJEU invalidated the Commission’s partial adequacy decision for the US-EU Privacy Shield agreement due to concerns about the surveillance practices of US intelligence agencies in Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (Shrems II).⁸² There are ongoing efforts to render a new adequacy decision under the 2022 Trans-Atlantic Data Privacy Framework,⁸³ but these are not guaranteed to survive judicial scrutiny. Meanwhile, the alternatives to an adequacy decision have also generated a great deal of uncertainty and the required indvidual analysis may prove costly and risky for many health data exporters, especially reseachers.⁸⁴

The Strategy for Data legislation, including the recently passed Data Governance Act (DGA) and proposals like the EHDS proposal, could have provided a solution to the obstacles GDPR has created for international data sharing. Instead, these proposals appear to have created a new maze of restrictions on the international transfer of non-personal data that mirrors the adequacy system under the GDPR.⁸⁵ For instance, the EHDS proposal requires data users and access bodies to implement legal and organizational measures to prevent the international transfer or foreign government access to non-personal electronic health data.⁸⁶ This works conjointly with Article 5 of the DGA which allows the Commission to adopt delegated acts that implement special conditions for the international transfer of public sector data deemed highly sensitive, which according to the DGA includes many health and genomic data.⁸⁷

On one hand, these restrictions could be justified in part by individual rights’ concerns, more specifically a residual risk of anonymized data being subject to reidentification in some cases. Both the EHDS proposal and the DGA offer this reidentification risk as one justification for these further restrictions on transfers of non-personal data.⁸⁸ On the other hand, as some have already pointed out, adding an additional adequacy assessment on top of GDPR requirements and new security requirements in the EHDS is not necessarily justified from a privacy or data protection standpoint.Reference Molnár-Gábor, Beauvais, Bernier, Jimenez, Recuero and Knoppers⁸⁹ The EHDS and DGA also explicitly present economic concerns as a justification for these policies, specifically the issue of non-personal data revealing trade secrets or commercially sensitive information.⁹⁰ This comports more with the economic competitiveness concerns that European officials have frequently emphasized in the context of the Strategy for Data, namely issues with relying on foreign providers and improving EU digital competitiveness.⁹¹

Other EU laws associated with the Strategy for Data also put in place policies that, though perhaps justified through fundamental rights arguments, seem to serve more of an economic protectionist purpose. For example, the draft European Union Cybersecurity Certification Scheme for Cloud Services (EUCS) reportedly will require cloud service operators to maintain cloud service operations and store data solely within the EU to receive the highest level of certification.⁹² Although this certification scheme is supposedly voluntary, given the particular sensitivity of health and genomic data, many believe it would effectively become mandatory for many businesses and institutions.⁹³ Some have called for EU based storage of health and genetic data as a necessary precaution against data protection and privacy risks.⁹⁴ Others have, however, pointed out that these measures seem to suggest that non-European access to data should always be avoided without regard for a third party country’s particular safeguards or reasons for accessing data.⁹⁵ The EU has also repeatedly made it clear that is actively concerned about the connection between control over data and control over critical data infrastructure.⁹⁶

1. Open Access Policies and International Data Sharing

Policies that categorize genomic data as a NSR are likely to create additional obstacles to open access and international data sharing, which in turn will impact the amount of genomic data accessible in the commons. One of the main challenges facing the commons in the past decade has been balancing the desire for widespread data sharing with data protection requirements and security concerns.⁹⁷ New NSR policies will add additional hurdles for transferring personal and non-personal data to the commons, and new national strategic considerations to balance along with privacy concerns. The impact will be most tangible in China where international collaborations and publishing the results of studies involving Chinese HGR will at a minimum require a more time consuming and complicated application process,Reference Mallapaty⁹⁸ in which officials may be guided by economic protectionist mindsets or changing political considerations. New restrictions on the transfer of non-personal data under Strategy for Data legislation could also complicate transfers of data for health research as has been the case with the GDPR.Reference Bentzen⁹⁹ For instance, requirements under the EHDS may make it hard to transfer even de-identified summary statistics derived from genomic data found in EU electronic health records or made available by data access committees.

A more invidious obstacle might come in the form of opaque security reviews under emerging regimes in China and the US. In both cases, these reviews leave enormous discretion to national governments to determine what is considered a national security threat, to allow retroactive state action with little warning,¹⁰⁰ and may be unreviewable by a national tribunal.¹⁰¹ There is a high probability that these reviews may be perceived as arbitrary or discriminatory, as was the case when the Trump administration took action against a number of Chinese technology companies with sparse reasoning.¹⁰² Such action might also be politically motivated, such as China censoring scientific data surrounding the origins of Covid-19.¹⁰³ Researchers may be reluctant to share data with foreign researchers that are not providing reciprocal access or in situations that may provoke a government investigation. These policies could also reduce innovative partnerships between private companies and cut researchers off from valuable new forms of research data. Alternatively, some researchers may avoid working on international collaborations out of fear that some results will not be publishable, a situation that may in many cases conflict with statutory requirements or requirements in grants.

As a result of these new restrictions on data transfers, the genomic commons may fracture into smaller international commons. This might be motivated by larger geopolitical concerns that make it easier to cooperate with one country rather than another. Countries may be forced to pick sides among global powers, effectively choosing among smaller research commons under EU standards, US standards, or Chinese standards. As China and the US race for technological supremacy in genomics and personalized health,¹⁰⁴ this could raise the stakes of collaboration. It could also create difficult dilemmas for many researchers, especially given the pressing need for larger and more diverse genomic and health data sets for health equity and biomedical advancement.Reference Sirugo, Williams and Tishkoff¹⁰⁵

This fracturing of the commons is likely to have a disproportionate impact on poor and developing countries. For wealthy democracies like Canada, the United Kingdom, and Japan with close strategic ties, adequacy agreements, and strong institutional ties, data-sharing and collaboration will continue basically as usual. China may find itself excluded from some international genomics sharing and collaborations, but it is also a well-resourced and highly integrated part of the global research community.Reference Johnson, Adams, Grant and Murphy¹⁰⁶ Poor countries and developing countries may have neither the privileged strategic relationships of wealthy countries nor the domestic resources of China. As such, they may be viewed less as allies from a national strategic perspective and become more reliant on partnering with larger developed countries for biomedical research. There are some notable initiatives in understudied areas of the world like AfricaReference Lumaka¹⁰⁷ and Southeast Asia¹⁰⁸ to scale up genomics research, but these initiatives would still benefit from the resources and expertise of the global genomics community.¹⁰⁹ While the global research community has recognized the need to be more inclusive in genomics research, governments may not share this sentiment particularly where there are security concerns.¹¹⁰

2. Shared Infrastructure and Information Security

Another area likely to be impacted by genomic data as a NSR is the provision of shared technical infrastructure. Shared infrastructure is necessary for interoperability and secure data sharing and has been a central policy issue for advocates of the commons.¹¹¹ Much progress has been made in recent years and more advancements are on the horizon, but new NSR policies could further complicate public and private initiatives.

First, governments may view foreign infrastructure as a means to gain access to data and therefore consider it a national security risk and seek to ban it altogether. US reports especially indicate concerns that foreign adversaries may use IT infrastructure and software to acquire sensitive US health and genetic data.¹¹² They suggest that either due to national security provisions under Chinese law or direct involvement through state-owned businesses the Chinese government could access genomic data and use it for its own purposes. Conflicting bans on the use of foreign infrastructure may prevent foreign research institutions from collaborating on large data sets in any meaningful way. It may also discourage collaboration on projects that involve advanced computing methods or technology.

Second, governments may pass laws or create funding incentives for economic purposes that lead researchers to rely exclusively on domestic infrastructure. Essentially, governments may put in place protectionist measures to ensure that domestic infrastructure providers or domestic technology providers have access to more health or genomic data or preferential access to data relative to foreign competitors. Even if they do not do so directly, policies like the EUCS might still offer an indirect boost to domestic industries by presenting them as safer or more reliable than foreign services.

At a minimum, self-preferential policies could undermine the expectations of reciprocity that are essential to maintaining the commons. These polices could also cut off researchers in one country from access to the best technologies in another. For instance, due to US dominance in cloud computing and other technology increasingly relevant to health research like mobile devices, EU member states have few competitive domestic alternatives.¹¹³ Attempts to foster domestic industries as substitutes in data driven and high-tech industries are far from guaranteed to be successful.¹¹⁴

3. Risk Assessments and Research Ethics

Genomic data as a NSR could fracture many of the shared research ethics and data governance principles of the commons such as objectivity, fairness and transparency.Reference Shabani¹¹⁵ More specifically, it raises concerns that national security agencies and policy makers with national strategic interests in mind will have an undue influence on researchers or data access governance. Ethical frameworks vary from country to country, but prevailing international norms emphasize the importance of voluntariness for participation in human subjects research and the need for researchers to weigh the risks and benefits of research.Reference White¹¹⁶ Governments, as the primary funders of research, can either directly or indirectly create improper incentives for researchers and research institutions. A series of ethical violations by the US government during the post world two era, including harmful radiation testing on human subjects, show a serious tension between research ethics rules and national security interests shrouded in secrecy .¹¹⁷ There are also fears that Chinese laws may carve out too large an exception for the state that undermines the independence of researchers and research institutions.¹¹⁸

NSR policies might also lead to fears that data may be weaponized or used as a surveillance tool by either foreign or domestic governments. No country has an official public policy towards weaponizing genomic data per se, but there are concerning reports of activities in China. In one well documented incident, the BGI group, a state-owned Chinese life sciences and genomics research conglomerate, was using health and genetic data collected from non-invasive prenatal genetic test kits to conduct population studies with the Peoples Liberation Army (PLA).¹¹⁹ These kits were used by millions of individuals around the world, in EU members states, the United Kingdom, Canada, and Australia.¹²⁰ Though Chinese officials deny that any non-Chinese national data was used in this research, there were concerns that the “terms of use” associated with these tests would have allowed it anyway.¹²¹ There is also evidence of Chinese researchers publishing a disproportionately high number of studies on the genetic characteristics of minority populations like the Uighurs and Tibetans. Many of these studies have been redacted for ethical reasons and raise alarming implications regarding the use of publicly accessible genomic data for surveillance purposes.Reference Van Noorden and Castelvecchi¹²² Such revelations may further cast doubt on the authenticity or quality of foreign ethics reviews.

In either case, concerns about misuse, nationalistic ideals, and pressure from state funding agencies may complicate the calculus when researchers and ethics committees are weighing the potential benefits and risk of collaboration and data-sharing. An ex post facto public revelation of foreign misuse of research data could have a deleterious impact on public trust in any research institutions involved. Studies have shown that risks of data leakage and fear of misuse are decisive factors in individual willingness to participate in biobanking and to contribute data for social welfare purposes.¹²³ This raises difficult questions about whether risks like state-backed data theft and foreign misuse ought to be disclosed to research participants. Some researchers may feel that these risks are remote, as was the case in the US when researchers pushed back against a congressional proposal for national security requirements for genomic data.Reference Kaiser¹²⁴ Nevertheless, it may be an important consideration for some research subjects and therefore relevant to disclose during the informed consent process.