1. Introduction
On May 1, 2024, the “Administrative Regulations of the People’s Republic of China on Human Genetic Resources” (Revised in 2024, “the Regulations“) came into effect, officially announcing that the competent authority for the management of human genetic resources (“HGR“) in China had moved from the Ministry of Science and Technology (“MOST“) to the National Health Commission (“NHC“). The change of authority began a year ago. In March 2023, the State Council issued the “Reform Plan for the Party and State Institutions”, transferring the China National Center for Biotechnology Development (“CNCBD“), which was directly under MOST, to the NHC, and the Office of Human Genetic Resources Administration of China (“HGRAC“) under CNCBD was also transferred. On July 1, 2023, MOST announced the ceased operation of HGRAC, entrusted CNCBD to carry out the technical work related to the management of HGR, and the management information system was launched for trial operation. On the same day, the “Implementing Rules for the Administrative Regulation on Human Genetic Resources” (“Implementing Rules“) were implemented, and the new service guides issued by MOST took effect.
For more information on the Implementation Rules, please refer to articles we recently published such as “JunHe Legal Review | The Final Step – Issuance of the ‘Implementing Rules for the Administrative Regulation on Human Genetic Resources’” and “JunHe Legal Review | Half a Year After the Implementing Rules, What Changes Have There Been in the Regulation of Human Genetic Resources?” (Both articles are in Chinese).
In combination with our recent practical experience, this article shares our observations on common issues in the supervision and compliance of human genetic resources for pharmaceutical enterprises. It covers three subjects of general concern to the industry : the identification of foreign entities, international cooperation, and the external provision and open access of human genetic resource information (“HGR Information“). In international cooperation projects and the external provision and open access of HGR Information, enterprises may face additional compliance obligations regarding personal information protection, which we also cover in this article.
2. Identification of Foreign Entities
If an enterprise is identified as a foreign entity, its activities involving HGR shall be subject to strict regulations, including prohibitions against the collection, preservation, and overseas provision of HGR within or from China. If a foreign entity wishes to utilize HGR, it shall cooperate with a Chinese entity and apply for administrative permission for international cooperation projects or complete record-filing for international cooperative clinical trials. Identifying a foreign entity is therefore a very important and practical issue.
According to the Regulations and the Implementing Rules, a foreign entity is defined as “an overseas organization and institution established or actually controlled by overseas organizations or individuals”. The term “institutions established or actually controlled by overseas organizations or individuals” includes : (i) overseas organizations or individuals directly or indirectly holding more than 50% of the equity, shares, voting rights, property shares, or similar interests (collectively referred to as “Interests”) in the institution; (ii) overseas organizations or individuals directly or indirectly holding less than 50% of the Interests in the institution, but the voting rights or other interests they enjoy are sufficient to dominate or exert significant influence over the institution’s decision-making, management, and other actions; and (iii) overseas organizations or individuals, through investment relationships, agreements, or other arrangements, are able to dominate or exert significant influence over the institution’s decision-making, management, and other actions. Additionally, the Implementing Rules stipulate that institutions in Hong Kong and Macau that are ultimately controlled by domestic capital are considered Chinese entities.
Here is our in-depth analysis based on these definitions:
(1)Overseas Organizations
The term “overseas organizations” is relatively straightforward and refers to institutions established outside mainland China. Therefore, companies established in foreign countries as well as in Hong Kong, Macau, and Taiwan regions are considered foreign entities. The Implementing Rules provide an exception on this point in that institutions established in Hong Kong and Macau that are ultimately controlled by domestic capital (“Domestic-Controlled Hong Kong and Macau Institutions“) are regarded as Chinese entities. However, based on our recent communications with the competent authorities, there is still no unified approach in practice regarding whether the aforementioned exception can be applied, requiring a case-by-case analysis.
(2)Institutions Established or Actually Controlled by Overseas Organizations
An institution established or actually controlled by overseas organizations or individuals refers to an institution established in mainland China but is established or controlled by overseas organizations or individuals (the “Domestic Institution“).
In practice, if a Domestic Institution’s Interests are 100 % directly or indirectly held by an overseas organization or controlled by an overseas organization through agreements, even if the ultimate controller of the overseas organization is a Chinese citizen after a look-through check, the Domestic Institution may still be considered a foreign entity by the competent authorities. If the Interests of the Domestic Institution are not 100 % directly or indirectly held by an overseas organization (for example, in a Sino-foreign joint venture), it is generally judged according to the standards of the Implementing Rules through a look-through check to the ultimate controller.
Regarding the nature of H-share listed companies, we believe they can also apply the standards in the Implementing Rules by a look-through check to verify the ultimate controller, to distinguish the overseas listed shares (H-shares), the unlisted shares held by foreign shareholders (commonly referred to as “Foreign Capital Shares”), and the unlisted shares held by domestic shareholders (commonly referred to as “Domestic Capital Shares”).
3. International Cooperation in Human Genetic Resources – Using Clinical Trials and Investigator-Initiated Clinical Studies as an Example
Biomedical enterprises that conduct or fund R&D activities, such as preclinical research, investigator-initiated trials (IIT), and clinical trials, may incur administrative permission and record-filing procedures for international cooperation in HGR.
Using international cooperative clinical trials and investigator-initiated research conducted for the purpose of the marketing authorization of drugs or medical devices as an example, here is an analysis of the necessity of application, as well as the choice between two pathways – approval or filing.
3.1Necessity of Application
Among the various parties involved in a clinical trial, if the sponsor, contract research organization or third-party laboratory or testing institution are foreign entities, then an application for international cooperation is usually required. If the aforementioned entities are all Chinese, and the electronic data capture vendor is the only foreign entity, then there is no need to apply for international cooperation.
In investigator-initiated clinical studies funded by foreign entities, if the foreign entity does not participate substantially in the research and does not share the research results (for example, if the foreign entity only provides the clinical study medication or the partial research funding to the medical institution without being privy to the research results), there is no need to apply for international cooperation.
3.2Path Selection
If it is determined that international cooperation needs to be applied, a further judgment should be made on whether to apply for administrative approval or record-filing procedures.
According to the Implementing Rules, international cooperative clinical trials conducted for obtaining marketing authorization of drugs or medical devices do not need to go through administrative approval and are only subject to record-filing procedures, provided the following prerequisites are met:
i. There is no outbound transfer of human genetic resource materials (“HGR Materials“);
ii. The HGR Materials are collected within medical institutions; and
iii. The testing, analysis and processing of the remaining HGR Materials is conducted within medical institutions or by domestic entities designated in the clinical trial protocol.
However, if a newly initiated international cooperative clinical trial involves exploratory research, or if an ongoing international cooperative clinical trial intends to amend the research protocol to include exploratory research, then it is generally necessary to apply separately for administrative approval for the exploratory research. International cooperative clinical trials and investigator-initiated clinical studies funded by pharmaceutical enterprises that do not meet the above conditions are not applicable under the record-filing procedure.
4. External Provision and Open Access to HGR Information by Foreign Entities – Using License-out as an Example
4.1Scenarios for the External Provision of HGR Information in License-out Projects
In license-out projects, there may be scenarios where the HGR Information generated from domestic clinical trials should be provided to foreign licensees. In these cases, the preliminary research and development has been completed (i.e., the relevant HGR Information has been generated), and the provision of such information to foreign licensees should be conditional upon the completion of the HGR regulatory procedures. Generally, the competent authorities require the completion of backup and record-filing procedures for the external provision and open access of HGR Information, after which, the HGR Information may be provided to the foreign licensees. It is important to note that according to the Regulations, if the licensor (the sponsor of the clinical trial) itself is a foreign entity, it cannot directly provide HGR Information to foreign licensees and should make alternative arrangements.
4.2Security Reviews for the Provision of Specific HGR Information
According to the Implementing Rules, the provision of specific HGR Information to foreign entities necessitates a further security review process supervised by the NHC. This specific HGR Information includes: (i) HGR Information from important genetic families; (ii) HGR Information from specific regions; (iii) exome sequencing and the genome sequencing information resources of more than 500 cases; and (iv) other situations that may affect the public health, national security, and the social and public interest of China.
Currently, the specific processes and rules regarding security reviews have not been published by the authorities.
5. Personal Information Outbound Transfers
In international cooperation and license-out projects carried out by pharmaceutical enterprises, in addition to the HGR compliance obligations, there may be other requirements concerning the outbound transfer of personal information.
A Regulatory Comparison between HGR Information and Personal Information
To help readers understand the different legislative and regulatory approaches in practice, the following table offers a comparison of the main differences between HGR Information and personal information.
Requirement
HGR Information
Personal Information
Competent Authority
- NHC
- Cyberspace Administration of China or local cyberspace administrations ( “CAC“)
Concept of Outbound Transfer
- Providing or granting access of HGR Information to foreign entities
- Transferring personal information collected and generated domestically to overseas;
- Inquiring, retrieving, downloading, or exporting personal information stored domestically by foreign institutions, organizations or individuals
Application Entity
- Jointly handled by both the Chinese and foreign entities in the international cooperation;
- Handled by the Chinese entity in the external provision
- Handled by the data processor
Subject of Outbound Transfer
- HGR Information (mainly genetic data)
- Personal information (including personal medical and health information, etc.), important data (if applicable)
Recipient
- Foreign entities (including pharmaceutical enterprises set up in China but identified as foreign entities)
- Overseas recipients
Regulatory Principles
- The source of HGR intended for use/outbound transfer is legal; the type and quantity match the research content; the purpose of the outbound transfer is legal
- Overseas recipients
HGR and personal information have certain differences in aspects such as the “subject of the outbound transfer”, “the concept of the outbound transfer”, and “the recipient”, which lead to different triggering conditions for administrative application that need the readers’ attention.
5.1Analysis of Personal Information Outbound Transfers
Based on our experience, in international cooperation and external provisions and the open access of HGR Information mentioned above, outbound transfer of personal information may incur in the following scenarios:
Analysis of Personal Information Outbound Transfer
International Cooperative Clinical Trial
Common scenarios include but are not limited to:
- Clinical trials conducted by pharmaceutical enterprises in China as foreign entities for obtaining drug or medical device marketing authorization;
- International multi-regional clinical trials (MRCT) sponsored by domestic and foreign pharmaceutical enterprises.
In these scenarios, the outbound transfer of personal information may include the clinical data of domestic trial subjects, and adverse drug reaction monitoring data.
License-out
Domestic pharmaceutical entities license their patents, know-how, etc., to overseas licensees, and provide data generated from clinical trials and data from Investigator-Initiated Trials (IIT) conducted in cooperation with medical institutions to overseas licensees. The clinical trial data provided to overseas licensees generally includes the personal information of the trial subjects.
(1)” Subject of Outbound Transfer”
According to the HGR regulations, data/information transferred outbound that does not contain genetic or genomic data does not constitute “HGR Information”.
From the perspective of the CAC, the medical and health data of trial subjects collected and processed in clinical trials which can individually or in combination with other information identify specific trial subjects is considered personal information, especially personal health and physiological information that may constitute sensitive personal information; the genetic data generated from HGR materials that the HGRAC supervises may also be classified as personal biometric information and thus considered sensitive personal information.
Outbound transfer applications to the NHC and the CAC are not mutually exclusive and need to be handled in parallel.
(2)The concept of “outbound transfer” and the “recipient”
The regulatory objects of human genetic resource regulations are generally institutions; however from the perspective of the CAC, the overseas recipients include not only institutions but also natural persons.
For example, a domestic pharmaceutical enterprise allows its Chinese employees located overseas to access a small amount of the sensitive personal information of trial subjects (with read-only permission). This situation is different from commonly seen outbound data transferring scenarios but does not fall outside the scope of the cross-border data transfer regulations. Based on our experience, the regulatory approach of some local CAC authorities is that when the amount of sensitive personal information is small, the urgency and priority for the pharmaceutical enterprises to implement the recordation of standard contracts can be moderated; as the volume of data transferring outbound increases and overseas commercial entities are established in the future, the recordation of standard contracts for the outbound transfer of personal information shall then be considered.
We suggest that when enterprises have personal information transferred abroad, they should comprehensively evaluate the supervision of the CAC in different regions and phases as well as the specific nature of the overseas natural persons (such as their nationality, whether they are internal employees of a pharmaceutical enterprise, etc.), the purpose, authority, and scope of accessing the data, the content, sensitivity, and magnitude of the data involved, and other factors to carefully determine the applicable mechanism for transferring personal information abroad.
5.2Selection of Personal Information Outbound Transfer Pathways
The “Personal Information Protection Law” and the “Provisions on Promoting and Regulating Cross-border Data Flows” announced by the Cyberspace Administration of China on March 22, 2024, provide clearer regulations on the data outbound transfer mechanisms that data processors should distinguish and choose when transferring data abroad.
| Outbound Transfer Mechanisms | Applicable Scenarios |
| Security Assessment of Outbound Data Transfer | Operators of critical information infrastructures providing personal information or important data abroadData processors other than operators of critical information infrastructures providing important data abroadData processors other than operators of critical information infrastructures that have cumulatively provided the personal information of more than 1 million individuals (excluding sensitive personal information) or the sensitive personal information of more than 10,000 individuals abroad since January 1 of the current year. |
| Recordation of the Standard Contracts for the Outbound Transfer of Personal Information | Data processors other than operators of critical information infrastructures that have cumulatively provided the personal information of more than 100,000 individuals but less than 1 million (excluding sensitive personal information) or sensitive personal information of fewer than 10,000 individuals to overseas entities since January 1 of the current year. |
| Personal Information Protection Certification | |
| Note: The above outbound transfer mechanisms are exempted under certain statutory circumstances. Pharmaceutical enterprises should pay attention to the regional special provisions of the outbound transfer regulations such as regulations of the free trade zones where they are located. | |
6. Conclusion
It is understood that after the change of competent authority for HGR supervision, the revision of the Implementing Rules was also put on the agenda. According to public information, from December 2023 to March 2024, the NHC organized more than three expert meetings to discuss the optimization of HGR supervision. The practical requirements for pharmaceutical enterprises to comply with HGR supervision may undergo further changes in the future. We will continue to monitor the regulatory dynamics and share practical experience with the industry in a timely manner.
For further information, please contact:
HUANG, Lu, JunHe
huanglu@junhe.com
