Genomic Data as a National Strategic Resource: Implications for the Genomic Commons and International Data Sharing for Biomedical Research and Innovation

Abstract

This article provides a critical review of new policies in China, the United States, and the European Union that characterize genomic data as a national strategic resource. Specifically, we review policies that regulate human genomic data for economic, national security, or other strategic purposes rather than ethical or individual rights purposes.

For the past 30 years, beginning with the policies surrounding the Human Genome Project (HGP), researchers, policy makers, journals, and funding agencies around the world have worked towards building an information commons of human genomic data. This commons, as expounded on by Contreras and Knoppers, is a worldwide collection of publicly accessible human genomic data housed in a variety of privately and publicly funded databases and governed by a consistent set of principles regarding privacy, use, openness, and access.¹ This global public resource has served as the basis for countless biomedical discoveries in the past two decades² and as a model for various medical information commons and open science frameworks that have proliferated in recent years.³ Of course, managing this increasingly complex collection of data is an ongoing challenge, and researchers grapple with data sharing complexities arising from access management, interoperability, and data protection laws.⁴ Nevertheless, there is a clear consensus that the need for widespread data sharing and international collaboration in the field of genomics has never been greater.⁵ Deploying new healthcare technologies,⁶ developing new personalized treatments,⁷ and managing public health crises,⁸ all while working towards more equitable access to the benefits of health research,⁹ will require data collection and collaboration on a more integrated and international scale.

In contrast to the needs of the biomedical research and healthcare communities, there is growing evidence of a paradigm shift in national policy toward human genomic data in China, the United States (US), and the European Union (EU) that threatens to derail the policies and objectives of the genomic commons. As we will outline in this paper, policymakers in these jurisdictions increasingly categorize collections of human genomic data and the infrastructure and technologies that support these collections as national strategic resources (NSR). As a result, their curation, cultivation, and protection are no longer viewed as just supportive of biomedical research and innovation, but as a critical concern of national security, economic security, and national autonomy. Strategic resource essentially denotes any resource for which states compete and is necessary to effectuate a national strategic goal.¹⁰ Although sharing genomic data is mutually beneficial, states may still seek to exclude foreign researchers, research institutions, and commercial entities from accessing genomic data to secure a competitive advantage through asymmetric access to information.¹¹ Alternatively, states may seek to exclude foreign governments from accessing data to prevent their misuse as a weapon or surveillance tool.¹² These policies threaten to undermine the basic reciprocity that underscores the genomic commons, and elevate national interests over collective interests in biomedical advancement.

Preserving the genomic commons and its substantial benefits for the international research and healthcare communities requires further analysis of the legal consequences and ethical implications of policies that categorize genomic data as a national strategic resource.

Preserving the genomic commons and its substantial benefits for the international research and healthcare communities requires further analysis of the legal consequences and ethical implications of policies that categorize genomic data as a national strategic resource. We will begin in Part I by providing a definition and overview of the genomic commons and highlight some ongoing developments in the commons. Next, we will identify recent policy developments in China, the US, and the EU that demonstrate how these jurisdictions increasingly categorize human genomic data as a NSR (Part II). We then explore the implications these new developments may have for important aspects of the genomic commons including international collaboration, shared infrastructure, and shared ethical safeguards and oversight (Part III). Finally, we will conclude with some brief recommendations for future research with the goal of empowering the international research community to respond to genomic data as a NSR.

I. Definition and Overview of the Genomic Commons

There is no commonly accepted definition for the genomic commons, but we will largely build off the concept outlined by Contreras and Knoppers.¹³ When we refer to the genomic commons (“the commons”), we refer specifically to the global collection of human genomic data — including sequenced data, association data, and phenotypic data — housed in a variety of public and private databases, available for shared use and access, and subject to common rules and governance.¹⁴ This commons originated with the policies surrounding the Human Genome Project and subsequent Bermuda principles, which required the rapid and public release of sequenced genomic data.¹⁵ Since then the commons has evolved through polycentric compromise and negotiation into a global system encompassing a diverse set of stakeholders and increasingly complex collections of health and genomic data.¹⁶ A full exploration of the commons is beyond the scope of this paper, but here we highlight some ongoing developments in the commons that are important to understanding genomic data as a NSR.

First, genomic data accessible in the commons are not kept in isolation, and are increasingly integrated with routinely collected personal health data leading to what some have termed a medical information commons.¹⁷ This has been driven in a large part by the demands of studies that utilize advanced statistical methods and require large amounts of phenotypic data like Genome Wide Association Studies (GWAS) and phenome-wide association studies (PheWAS).¹⁸ Recognizing the need for more data, policymakers have sought to accelerate integration through large publicly funded precision medicine initiatives and databases like the the All of Us Research Program in the US.¹⁹ There are also ongoing efforts to make electronic health records more available for secondary research purposes along with genomic data. An example of this is the recently proposed EU regulation for a European Health Data Space (EHDS).²⁰

Second, of equal importance to open access policies that support the commons is the information technology (IT) infrastructure that supports the secure access, storage, and sharing of genomic data on a global scale. This includes databases, federated networks, cloud service providers, data management platforms, and software providers that are essential for analyzing ever larger volumes of health and genomic data²¹ and overcoming issues regarding data silos and interoperability.²² The provision of this infrastructure is also the focus of some large initiatives sponsored by governments, public funding agencies, and non-profit institutions including the Global Alliance for Genomics and Health (GA4GH),²³ the European 1+ Million Genomes Initiative,²⁴ and the China National GeneBank DataBase (CNGBdb).²⁵

Third, although the commons is by definition a public resource, private commercial organizations play an important and increasingly essential role as sources of data, expertise, innovation, and infrastructure in genomics research.²⁶ This is especially true regarding the direct-to-consumer (DTC) genetic testing industry and cloud computing industries. For example, 23andMe, a US based for-profit corporation that offers DNA testing for health and ancestry purposes, has amassed a genomic database of at least one million individuals and its research team has made valuable contributions to genomics research in recent years.²⁷ Moreover, as genomics research becomes more reliant on computing power, more research involves public-private partnerships between research institutions and commercial providers of cloud computing and data analysis services.²⁸ Some examples include Amazon Web Services (AWS),²⁹ Microsoft Azure,³⁰ and Google Cloud.³¹ As a result, a broad range of policies targeting private and public sector organizations that collect genomic data or provide computing services could impact data sharing in the commons.

II. Genomic Data as a National Strategic Resource

As previously stated, a NSR is essentially any resource for which states compete and is necessary to effectuate a national strategic goal. It can also be thought of as the stock of national resources which states can depend on when there is an unexpected surge of demand such as for medical supplies during a pandemic, food reserves during a drought, and natural gas during a foreign conflict.³² Large collections of data have been recognized as fundamental strategic resources needed to develop new technologies, compete economically and militarily, and improve public services.³³

We use the term NSR in this context to emphasize several common features among policies, which we refer to as NSR Policies, that are markedly different than policies that have supported the creation of the commons over the past several decades. First, NSR policies primarily serve a strategic purpose rather than a purpose in support of human rights or values. Second, NSR policies serve to protect, acquire, or restrict the use of genomic data as a collective resource rather than as a vested personal privacy or data protection right. That is to say data protection or privacy are not the exclusive objective of these policies even if there may be some benefits to data protection or privacy. Third, NSR policies tend to treat control over genomic data as a competition or zero-sum game rather than a cooperative endeavor based on reciprocity, like the commons. As such NSR policies are those that tend to dispose of the benefits of global cooperative biomedical research and innovation in favor of strategic benefits, the interests of a limited set of countries, or explicitly national interests. States may accomplish this by restricting access or granting preferential access to certain categories of data, specific data sources, or data infrastructure.

1. China: Human Genetic Resources and Biosecurity

Of the three jurisdictions we will highlight, China has been the most consistent and assertive in characterizing human genomic data as a national resource, but it has not always done so in a way targeted towards exclusion. As far back as 1998 the Ministry of Science and Technology (MOST) has enforced its Interim Measures, which were essentially licensing restrictions on the export of so called “human genetic resources” (HGR), including inter alia genomic data.³⁴ These measures required foreign entities to obtain a permit, register with local authorities, and collaborate with a Chinese institution to access Chinese HGR.³⁵

Facially, the Interim Measures are at odds with data sharing principles supporting the commons and mostly seem to be an obstacle to international collaboration,³⁶ but some context is needed. The original purpose of these measures was to prevent biopiracy, or uncompensated exploitation of a country’s genetic resources, and to ensure that as a developing country China received its fair share of the benefits that might accrue from Chinese HGR.³⁷ Rather than discourage collaboration, the number of international collaborations between Chinese institutions and institutions in developed countries rose dramatically during the 2000s.³⁸ Indeed, for the most part the Interim Measures seem to have been interpreted narrowly or lightly enforced in this context.

Since 2016, coinciding with Xi Jinping’s administration, it has become increasingly clear that Chinese officials view the collection and exclusive control of genomic data as critical to economic development and national security.³⁹ The Chinese government has stated an intent to become a world leader in the fields of biotechnology and precision medicine and has recognized the need for large amounts of health and genomic data to achieve this goal.⁴⁰ It has facilitated this through the mass collection of health and genomic data at home and abroad through publicly funded development of data infrastructure, largescale sequencing initiatives, and investment in private genomics companies.⁴¹

In late 2018, for the first time Chinese officials publicly denounced five Chinese institutions for violating the data export requirements in the Interim Measures.⁴² These companies included the BGI group, which had published the results of a large international study on the genetics of depression in Nature⁴³ without MOST’s permission.⁴⁴ Following this, in early 2019 China enacted its first comprehensive regulation on HGR, the Regulation on the Management of Human Genetic Resources (MHGR), and in 2020 it enacted a first of its kind Biosecurity Law, with strict sets of provisions directly addressing HGR used in research and international collaboration.

The MHGR and Biosecurity Law together form the backbone of the new Chinese legal regime for human genomic data. The MHGR mostly codified many of the requirements of the Interim Measures while adding stricter controls on foreign researchers.⁴⁵ The Biosecurity law imposed a new governance framework for managing seven identified biology related activities that present national security risks, including the management of HGR.⁴⁶ Recognizing the complex interaction between these two laws, in March 2022 MOST released a set of draft implementing rules that represent a substantial break from policies underscoring the commons. They effectively ban the provision, use, or collection of HGR information by foreign controlled entities.⁴⁷ All international research collaborations involving HGR must share a backup of any HGR data with Chinese researchers and the Chinese government.⁴⁸ Moreover, the laws require a MOST security review for the foreign provision of HGR of important biological families, HGR originating from sensitive places, exome sequencing and genome sequencing of over 500 individuals, and any other cases that could impact public health, national security, or the social interests of the state.⁴⁹ There is some dispute over the full impact of the provisions, particularly as Chinese researchers continue to share research data even in the face of suspected government pressure.⁵⁰ Nevertheless, there is already some evidence that these laws are having a chilling effect on international collaborations with Chinese researchers.⁵¹ There are also examples of recent retractions of genomic data linked to international publications at the request of Chinese institutions.⁵²

2. The United States: Research Integrity and Safeguarding the Bioeconomy

For the US, treating genomic data as a NSR stands in contrast to the past commitment and continued leadership of US institutions in promoting the genomic commons. From their inception with the polices surrounding the HGP and continuing to this day, open access and widespread genomic data sharing are the official policy of US funding institutions, like the National Institutes of Health (NIH),⁵³ and reinforced by funding legislation, like the 21^st

Century Cures Act.⁵⁴ Moreover, while the EU, China, and most countries around the world have gradually adopted stricter data localization measures and controls on international data sharing, the main US federal laws that regulate genomic data sharing in this context, namely the Health Insurance Portability and Accountability Act (HIPAA) and the human subjects research protections found in the Common Rule, impose few restrictions on international data sharing.⁵⁵

The characterization of genomic data as a national strategic resource in the US can be largely attributed to its geopolitical rivalry with China. Since 2017, US intelligence agencies have raised national security concerns related to Chinese access to genomic data through scientific collaboration, funding of scientific research, investment in US genomic sequencing companies, and the purchase of US companies.⁵⁶ The first two concerns prompted a series of investigations related to research security including a 2018 report by the Office of the Inspector General (OIG) of the Department of Health and Human Services (HHS) that addressed the potential national security risks of foreign access to genomic data.⁵⁷ They have also led to NIH investigations and the controversial Department of Justice (DOJ) investigation of foreign researchers known as the China Initiative.⁵⁸ Although these investigations have been discontinued, they caused many institutions to reassess foreign collaborations and may have a chilling effect on collaborations moving forward.⁵⁹

The most forceful policy responses have been targeted towards concerns related to Chinese access to genomic and health data through investment and partnerships with US based private sector organizations. These concerns relate to Chinese government access to sensitive health and genetic data and its impact on US national security and economic competitiveness in the bioeconomy.⁶⁰ The national security threat from Chinese access to sensitive data is more straightforward: US officials fear that certain sensitive data could compromise important individuals, like government officials, or reveal strategic vulnerabilities regarding the US population.⁶¹ The economic security threat regarding data access and competitiveness in the bioeconomy is described in the 2019 report Safeguarding the bioeconomy from the National Academies of Sciences, Engineering, and Medicine.⁶² Billions in public research expenditures, free access to genomics data held in the in the commons, public-private partnerships, and private venture capital investment form a complex ecosystem that drives health innovation.⁶³ As such, large collections of genomic data held by public organizations and increasingly private consumer genomics companies are a critical input for technological advancement in key areas like the development of pharmaceuticals and managing public health.⁶⁴ The fear that the report focuses on is foreign government aligned organizations receiving asymmetric access to genomic data generated by US firms and research organizations.⁶⁵ A situation which could lead to a loss of economic competitiveness in strategic health sectors and create strategic vulnerabilities for the US.

Though some of these concerns could be mitigated through data protection legislation, it is telling that the US has instead responded through national security laws and policies. Through legislation like the Foreign Investment Risk Review Modernization Act (FIRRMA) in 2018 ⁶⁶ and various executive orders,⁶⁷ the Federal government has endowed executive agencies with increased authority to intervene in transactions that involve foreign organizations and US health and genomic data. For instance, in 2019 the Committee on Foreign Investment in the United States (CFIUS) used its new authority under FIRRMA to compel iCarbonX, a Chinese genomics company, to divest its controlling stake in PatientsLikeMe, a US based personalized health research company.⁶⁷ The purpose of the deal was to combine PatientsLikeMe health data, a network of 500,000 individuals, with iCarbonX’s genomics and AI technology to drive new health research and treatment.⁶⁸ Although CFIUS orders are not published (for national security purposes), the deal was likely blocked out of fear that the Chinese government would be able to access the sensitive health data of US persons.⁶⁹

More recently in late 2021, the Department of Commerce (DOC) issued a new interim rule (the Supply Chain Rule).⁷⁰ This rule originates from an executive order of June 2021, the Executive Order on Protecting Americans’ Sensitive Data from Foreign Adversaries, in which the Biden administration ordered HHS and the DOC to evaluate and respond to the threat of Chinese access to large repositories of sensitive US health and genetic data and its impact on US national security and economic interests.⁷¹ This rule authorizes the DOC to intervene in or prohibit any transaction of information services or technology between a US person and a foreign controlled entity that involves the transfer or collection of large amounts of sensitive US health or genetic data and that threatens national security.⁷² Given its sheer breadth, this rule could enable DOC intervention in a wide range of scenarios, including a research center contracting with a foreign cloud service provider, a partnership between a US hospital and a foreign genomics institute, or a research lab licensing software developed by a foreign entity.

3. The European Union: Digital Sovereignty and Strategic Autonomy

Like the US, the EU has generally been a leader in genomic data sharing and open science initiatives, and it continues to advocate for these polices today. The EU has also long been a world leader in setting data protection standards for sensitive data like genetic data.⁷³ Most notably since 2018, the EU’s General Data Protection Regulation (GDPR) has imposed strict rules on the processing of largescale sensitive data including genetic data.⁷⁴ The main objective of the GDPR is to protect the fundamental rights of individuals and is therefore not an NSR policy. However, it is worth mentioning here because of its central role in EU law and policies and the challenges it has presented for the commons and international transfers of biomedical research data.⁷⁵

For the EU, the characterization of genomic data as a NSR has been an indirect result of its push to leverage EU data in healthcare and health innovation in the post-GDPR era. This push has centered around strategic autonomy, which is a term that was first used in the field of defense but has since emerged as a catch-all term for EU industrial policy that aims to increase European autonomy in specific strategic sectors.⁷⁶ Digital health has been recognized as one of these strategic sectors and the EU hopes to achieve strategic autonomy in this sector by unleashing its Strategy for Data.⁷⁷ The Strategy for Data is not one policy, but rather several pieces of legislation aimed at harnessing data as an economic resource that can help the EU maintain a competitive edge in strategic sectors.⁷⁸ This strategy represents a clear shift from the individual rights framework of the GDPR to policies that represent broader strategic and economic concerns associated with data.

Understanding how Strategy for Data legislation treats genomic data as an NSR requires some brief background on the international transfer regime for personal data under the GDPR. Under the GDPR and the Court of Justice of the European Union (CJEU) case law, personal data may only be transferred to a third country if provided a level of technical or legal protection that is essentially equivalent to that in the EU.⁷⁹ The European Commission can determine that a jurisdiction provides adequate legal protections, subject to certain conditions, and render an adequacy decision for that jurisdiction under Article 45.⁸⁰ Alternatively, data exporters can make an individual determination that, subject to certain contractual and technical safeguards, a transfer will provide essentially equivalent protections and rely on several other possible transfer mechanisms under Articles 45 or 46.⁸¹ Adequacy decisions provide exporters with the most certainty, but thus far have only been rendered for a very limited number of countries. A list which does not include the US after the CJEU invalidated the Commission’s partial adequacy decision for the US-EU Privacy Shield agreement due to concerns about the surveillance practices of US intelligence agencies in Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (Shrems II).⁸² There are ongoing efforts to render a new adequacy decision under the 2022 Trans-Atlantic Data Privacy Framework,⁸³ but these are not guaranteed to survive judicial scrutiny. Meanwhile, the alternatives to an adequacy decision have also generated a great deal of uncertainty and the required indvidual analysis may prove costly and risky for many health data exporters, especially reseachers.⁸⁴

The Strategy for Data legislation, including the recently passed Data Governance Act (DGA) and proposals like the EHDS proposal, could have provided a solution to the obstacles GDPR has created for international data sharing. Instead, these proposals appear to have created a new maze of restrictions on the international transfer of non-personal data that mirrors the adequacy system under the GDPR.⁸⁵ For instance, the EHDS proposal requires data users and access bodies to implement legal and organizational measures to prevent the international transfer or foreign government access to non-personal electronic health data.⁸⁶ This works conjointly with Article 5 of the DGA which allows the Commission to adopt delegated acts that implement special conditions for the international transfer of public sector data deemed highly sensitive, which according to the DGA includes many health and genomic data.⁸⁷

On one hand, these restrictions could be justified in part by individual rights’ concerns, more specifically a residual risk of anonymized data being subject to reidentification in some cases. Both the EHDS proposal and the DGA offer this reidentification risk as one justification for these further restrictions on transfers of non-personal data.⁸⁸ On the other hand, as some have already pointed out, adding an additional adequacy assessment on top of GDPR requirements and new security requirements in the EHDS is not necessarily justified from a privacy or data protection standpoint.⁸⁹ The EHDS and DGA also explicitly present economic concerns as a justification for these policies, specifically the issue of non-personal data revealing trade secrets or commercially sensitive information.⁹⁰ This comports more with the economic competitiveness concerns that European officials have frequently emphasized in the context of the Strategy for Data, namely issues with relying on foreign providers and improving EU digital competitiveness.⁹¹

Other EU laws associated with the Strategy for Data also put in place policies that, though perhaps justified through fundamental rights arguments, seem to serve more of an economic protectionist purpose. For example, the draft European Union Cybersecurity Certification Scheme for Cloud Services (EUCS) reportedly will require cloud service operators to maintain cloud service operations and store data solely within the EU to receive the highest level of certification.⁹² Although this certification scheme is supposedly voluntary, given the particular sensitivity of health and genomic data, many believe it would effectively become mandatory for many businesses and institutions.⁹³ Some have called for EU based storage of health and genetic data as a necessary precaution against data protection and privacy risks.⁹⁴ Others have, however, pointed out that these measures seem to suggest that non-European access to data should always be avoided without regard for a third party country’s particular safeguards or reasons for accessing data.⁹⁵ The EU has also repeatedly made it clear that is actively concerned about the connection between control over data and control over critical data infrastructure.⁹⁶

III. Implications for the Genomic Commons

1. Open Access Policies and International Data Sharing

Policies that categorize genomic data as a NSR are likely to create additional obstacles to open access and international data sharing, which in turn will impact the amount of genomic data accessible in the commons. One of the main challenges facing the commons in the past decade has been balancing the desire for widespread data sharing with data protection requirements and security concerns.⁹⁷ New NSR policies will add additional hurdles for transferring personal and non-personal data to the commons, and new national strategic considerations to balance along with privacy concerns. The impact will be most tangible in China where international collaborations and publishing the results of studies involving Chinese HGR will at a minimum require a more time consuming and complicated application process,⁹⁸ in which officials may be guided by economic protectionist mindsets or changing political considerations. New restrictions on the transfer of non-personal data under Strategy for Data legislation could also complicate transfers of data for health research as has been the case with the GDPR.⁹⁹ For instance, requirements under the EHDS may make it hard to transfer even de-identified summary statistics derived from genomic data found in EU electronic health records or made available by data access committees.

Policies that categorize genomic data as a NSR are likely to create additional obstacles to open access and international data sharing, which in turn will impact the amount of genomic data accessible in the commons. One of the main challenges facing the Commons in the past decade has been balancing the desire for widespread data sharing with data protection requirements and security concerns

A more invidious obstacle might come in the form of opaque security reviews under emerging regimes in China and the US. In both cases, these reviews leave enormous discretion to national governments to determine what is considered a national security threat, to allow retroactive state action with little warning,¹⁰⁰ and may be unreviewable by a national tribunal.¹⁰¹ There is a high probability that these reviews may be perceived as arbitrary or discriminatory, as was the case when the Trump administration took action against a number of Chinese technology companies with sparse reasoning.¹⁰² Such action might also be politically motivated, such as China censoring scientific data surrounding the origins of Covid-19.¹⁰³ Researchers may be reluctant to share data with foreign researchers that are not providing reciprocal access or in situations that may provoke a government investigation. These policies could also reduce innovative partnerships between private companies and cut researchers off from valuable new forms of research data. Alternatively, some researchers may avoid working on international collaborations out of fear that some results will not be publishable, a situation that may in many cases conflict with statutory requirements or requirements in grants.

As a result of these new restrictions on data transfers, the genomic commons may fracture into smaller international commons. This might be motivated by larger geopolitical concerns that make it easier to cooperate with one country rather than another. Countries may be forced to pick sides among global powers, effectively choosing among smaller research commons under EU standards, US standards, or Chinese standards. As China and the US race for technological supremacy in genomics and personalized health,¹⁰⁴ this could raise the stakes of collaboration. It could also create difficult dilemmas for many researchers, especially given the pressing need for larger and more diverse genomic and health data sets for health equity and biomedical advancement.¹⁰⁵

This fracturing of the commons is likely to have a disproportionate impact on poor and developing countries. For wealthy democracies like Canada, the United Kingdom, and Japan with close strategic ties, adequacy agreements, and strong institutional ties, data-sharing and collaboration will continue basically as usual. China may find itself excluded from some international genomics sharing and collaborations, but it is also a well-resourced and highly integrated part of the global research community.¹⁰⁶ Poor countries and developing countries may have neither the privileged strategic relationships of wealthy countries nor the domestic resources of China. As such, they may be viewed less as allies from a national strategic perspective and become more reliant on partnering with larger developed countries for biomedical research. There are some notable initiatives in understudied areas of the world like Africa¹⁰⁷ and Southeast Asia¹⁰⁸ to scale up genomics research, but these initiatives would still benefit from the resources and expertise of the global genomics community.¹⁰⁹ While the global research community has recognized the need to be more inclusive in genomics research, governments may not share this sentiment particularly where there are security concerns.¹¹⁰

2. Shared Infrastructure and Information Security

Another area likely to be impacted by genomic data as a NSR is the provision of shared technical infrastructure. Shared infrastructure is necessary for interoperability and secure data sharing and has been a central policy issue for advocates of the commons.¹¹¹ Much progress has been made in recent years and more advancements are on the horizon, but new NSR policies could further complicate public and private initiatives.

First, governments may view foreign infrastructure as a means to gain access to data and therefore consider it a national security risk and seek to ban it altogether. US reports especially indicate concerns that foreign adversaries may use IT infrastructure and software to acquire sensitive US health and genetic data.¹¹² They suggest that either due to national security provisions under Chinese law or direct involvement through state-owned businesses the Chinese government could access genomic data and use it for its own purposes. Conflicting bans on the use of foreign infrastructure may prevent foreign research institutions from collaborating on large data sets in any meaningful way. It may also discourage collaboration on projects that involve advanced computing methods or technology.

Concerns about misuse, nationalistic ideals, and pressure from state funding agencies may complicate the calculus when researchers and ethics committees are weighing the potential benefits and risk of collaboration and data-sharing. An ex post facto public revelation of foreign misuse of research data could have a deleterious impact on public trust in any research institutions involved. Studies have shown that risks of data leakage and fear of misuse are decisive factors in individual willingness to participate in biobanking and to contribute data for social welfare purposes.

Second, governments may pass laws or create funding incentives for economic purposes that lead researchers to rely exclusively on domestic infrastructure. Essentially, governments may put in place protectionist measures to ensure that domestic infrastructure providers or domestic technology providers have access to more health or genomic data or preferential access to data relative to foreign competitors. Even if they do not do so directly, policies like the EUCS might still offer an indirect boost to domestic industries by presenting them as safer or more reliable than foreign services.

At a minimum, self-preferential policies could undermine the expectations of reciprocity that are essential to maintaining the commons. These polices could also cut off researchers in one country from access to the best technologies in another. For instance, due to US dominance in cloud computing and other technology increasingly relevant to health research like mobile devices, EU member states have few competitive domestic alternatives.¹¹³ Attempts to foster domestic industries as substitutes in data driven and high-tech industries are far from guaranteed to be successful.¹¹⁴

3. Risk Assessments and Research Ethics

Genomic data as a NSR could fracture many of the shared research ethics and data governance principles of the commons such as objectivity, fairness and transparency.¹¹⁵ More specifically, it raises concerns that national security agencies and policy makers with national strategic interests in mind will have an undue influence on researchers or data access governance. Ethical frameworks vary from country to country, but prevailing international norms emphasize the importance of voluntariness for participation in human subjects research and the need for researchers to weigh the risks and benefits of research.¹¹⁶ Governments, as the primary funders of research, can either directly or indirectly create improper incentives for researchers and research institutions. A series of ethical violations by the US government during the post world two era, including harmful radiation testing on human subjects, show a serious tension between research ethics rules and national security interests shrouded in secrecy .¹¹⁷ There are also fears that Chinese laws may carve out too large an exception for the state that undermines the independence of researchers and research institutions.¹¹⁸

NSR policies might also lead to fears that data may be weaponized or used as a surveillance tool by either foreign or domestic governments. No country has an official public policy towards weaponizing genomic data per se, but there are concerning reports of activities in China. In one well documented incident, the BGI group, a state-owned Chinese life sciences and genomics research conglomerate, was using health and genetic data collected from non-invasive prenatal genetic test kits to conduct population studies with the Peoples Liberation Army (PLA).¹¹⁹ These kits were used by millions of individuals around the world, in EU members states, the United Kingdom, Canada, and Australia.¹²⁰ Though Chinese officials deny that any non-Chinese national data was used in this research, there were concerns that the “terms of use” associated with these tests would have allowed it anyway.¹²¹ There is also evidence of Chinese researchers publishing a disproportionately high number of studies on the genetic characteristics of minority populations like the Uighurs and Tibetans. Many of these studies have been redacted for ethical reasons and raise alarming implications regarding the use of publicly accessible genomic data for surveillance purposes.¹²² Such revelations may further cast doubt on the authenticity or quality of foreign ethics reviews.

In either case, concerns about misuse, nationalistic ideals, and pressure from state funding agencies may complicate the calculus when researchers and ethics committees are weighing the potential benefits and risk of collaboration and data-sharing. An ex post facto public revelation of foreign misuse of research data could have a deleterious impact on public trust in any research institutions involved. Studies have shown that risks of data leakage and fear of misuse are decisive factors in individual willingness to participate in biobanking and to contribute data for social welfare purposes.¹²³ This raises difficult questions about whether risks like state-backed data theft and foreign misuse ought to be disclosed to research participants. Some researchers may feel that these risks are remote, as was the case in the US when researchers pushed back against a congressional proposal for national security requirements for genomic data.¹²⁴ Nevertheless, it may be an important consideration for some research subjects and therefore relevant to disclose during the informed consent process.

IV. Future Research and Concluding Remarks

By many accounts, the genomic commons has been a highly impactful and successful system of governing and harnessing human genomic data for biomedical advancement.¹²⁵ The governance structure of the commons can accommodate laws and policies that further some national interests like those related to data protection, individual and collective privacy rights, and fairness between countries. However, policies that categorize genomic data as a NSR threaten to undermine the careful balancing and basic reciprocity needed to facilitate an international collaborative endeavor like the commons. As such, the international research community should prepare to respond to these policies with further research in four areas.

First, other areas of scientific research, including some in the biological sciences, are more carefully controlled by governments for national strategic purposes and might serve as a model moving forward. A good example here is the closely related Nagoya protocol, which provides for equitable access and benefit sharing for non-human genetic resources, while recognizing sovereignty over domestic genetic resources.¹²⁷ Some suggest that employing these types of policies for human genomic data might even improve international data sharing.¹²⁸

Second, stakeholders need to further explore the impact of NSR laws and policies on international collaboration. This is especially critical for laws and policies that might fall outside the typical expertise of the biomedical research community. As genomics research involves more public-private partnerships and leverages new forms of technology, policies that restrict foreign IT infrastructure, computing, and AI technology could have a substantial impact on international collaboration in genomics research.

Third, policies in countries outside of the three jurisdictions discussed here ought to be examined as well. For instance, Australia and the United Kingdom have close strategic ties with the US and EU and they have raised some concerns about foreign access to research data.¹²⁹ Alternatively, various middle income and developing countries may have strict restrictions on the export of human genomic data for national strategic reasons that are different then those examined in this paper. Closer attention ought to be paid to these laws, as well as the impact of new data or infrastructure restrictions on middle income and developing countries. This is especially important considering the potential impact of laws and policies on recent efforts to increase diversity and equity in genomics research.

Finally, stakeholders need more information and guidelines to respond to NSR policies. Not everyone agrees on the gravity of national security risks or on the wisdom of localizing data or preferencing domestic infrastructure. Stakeholders armed with data and research that shows the impact of NSR policies on scientific objectives might have more success influencing national policy makers. Regardless, genomic data as an NSR is likely to be the new norm and something that the international research community will need to continually respond to moving forward.