On June 1, 2023, China’s Ministry of Science and Technology (the “MOST”) issued the Implementation Rules of Administrative Regulations on Human Genetic Resources (the “Implementation Rules”). The Implementation Rules becomes effective on July 1, 2023.  The Implementation Rules clarifies a few often encountered issues during the implementation of the Administrative Regulations on Human Genetic Resources (the “Regulations”) effective since July 1, 2019.  Some highlights of the Implementation Rules include the following:

1. Narrowing the scope of regulated human genetic resource information

Article 2 of the Implementation Rules clarifies that  “human genetic resource information” excludes clinical data, image data, protein data, and metabolic data. Although it awaits for further clarification of “clinical data”, the implementation rules addressed some often asked questions about the regulation of cross-border sharing of image data, protein data and metabolic data by MOST.   

2. Emphasizing the consent requirements for the processing of human genetic resource information

Human genetic resources information constitutes personal information. According to the Personal Information Protection Law (the “PIPL”), an organization that determines the purposes and means of the processing of personal information (“PI Controller”) may have different lawful bases for the processing. Consent of the individuals is only one of the lawful bases. In theory, the processing of human genetic resources information could be relied on lawful bases such as contractual necessity or legal obligation, etc. if the conditions are satisfied. 

Meanwhile, the PIPL requires a PI Controller to obtain the separate consent of the individuals before processing any of their sensitive personal information, which includes human genetic resources information. This separate consent requirement is in parallel with the lawful basis requirement, which in practice means that multiple consent check boxes must be created for individuals to give consent to the general processing (if the lawful basis is consent) and separate consent to the processing of sensitive personal information, as well as separate consent to a few other prescribed processing activities (e.g. transferring personal information overseas). 

The Implementation Rules does not reflect the differentiation between consent and separate consent under the PIPL. Instead, it set out a very straightforward requirement that the written consent of the individuals must be obtained in any case before processing their human genetic resources information. To be fully compliant with both the PIPL and the Implementation Rules, a PI Controller shall use multiple check boxes to obtain the written consent and separate consent. 

      3. Drawing a clearer line between Chinese party and foreign party

The Implementation Rules also defines that the rules for determining foreign control being a foreign organization or individual (1) having no less than 50% shares, equity, voting rights, property ownership or other similar rights and interests; (2) having voting rights or other rights and interests which is sufficient to dominate or exert a significant impact on the decision-making, management and other acts; or (3) is able to dominate or exert a significant impact on the decision-making, management, and other acts of the institution through investment relations, agreements, or other arrangements.  Thus, a Chinese enterprise under foreign control via a VIE structure will be regarded as a “foreign party” and thus be subject to the applicable restrictions on collection, preservation and use of human genetic resources under the Regulations. 

     4. Strengthening the control for export of certain human genetic  resource information

The Implementation Rules elaborates the types of human genetic resources information in need of national security review before transfer or open access to human genetic resource information to foreign party.  Special attentions shall be paid to before the export of such genetic resources information, including genetic resources information related to important genetic family or population from designated geographic regions , or exome sequencing and genome sequencing information of more than 500 human subjects. Whereas there is loosening up on regulating certain types of genetic resource information such as protein data and image data, we believe that strict supervision on the aforementioned important human genetic resource information will be a continuing trend..

As discussed above, human genetic resource information constitutes personal information. The PIPL sets out a series of requirements on the cross-border transfer of personal information. In addition to fully informing individuals the transfer details (e.g. the name and contact information of each overseas recipient, the types of personal information transferred, the purposes of transfer, etc.) and obtaining their separate consent, a PI Controller must also go through one of the following routes to legitimize the transfer: (i) applying for the approval of the Chinese data regulator, (ii) signing and filing the standard contractual clauses formulated by the Chinese data regulator with each overseas recipient, or (iii) obtaining a certificate issued by the Chinese data regulator. Route (i) is mandatory if a PI Controller that triggers a prescribed threshold, which concerns the number of individuals whose personal information is processed within China and transferred overseas. 

In a complex cooperation project between Chinese and foreign parties, identifying which party acts as the PI Controller is critical. It is mainly the PI Controller’s obligation to conduct a thorough data mapping, calculate the number of individuals whose personal information is processed or transferred overseas, select the suitable transfer route and take all the required compliance actions to legitimize the transfer. 

In general, the Implementation Rules reflects Chinese government’s high priority on safeguarding national bio-security and it will further promote lawful, conscientious, scientific, rigorous and efficient supervision on the whole life cycle of China human genetic resources according to the Regulations.