Emerging, challenges and modernization path of gene privacy in China: from personal privacy to group privacy

Abstract

Genetic data, which contains human life codes, is the most fundamental privacy of individuals and is therefore protected by the right to privacy. However, given the diverse subjects involved in genetic data, traditional individualistic privacy regulations face challenges in practise, posing a global dilemma on effective gene privacy protection. Over the past three decades, China has seen rapid development in the concepts of privacy and gene privacy. Genetic data is inherently classified as private data, entitled to protection under CCC and CPIPL. China adopts an informed consent model rooted in individualism for gene privacy protection, yet faces triple dilemmas in practice, including inadequate protection for individuals, insufficient safeguards for societal interests, and benefit-sharing imbalances. Going forward, China should first shift its governance philosophy from individualism to group dimension; second, further restrict individuals’ self-determination over genetic data; and finally, give full play to its existing organizational structure, public interest litigation system, and the role of groups in safeguarding benefit-sharing.

Introduction

In the field of natural science, genes refer to DNA fragments with genetic data, which are the most basic factors that control life traits and determine life activities [1]. The right to privacy is a legal means by which a person can keep his private domain from being arbitrarily approached by others. Genetic data belongs to the private domain that individuals can dispose and should be protected by the right to privacy [2]. However, with the development and success of the global “Human Genome Project” (HGP), gene data has entered the “public domain”. Currently, gene sequencing and detection technologies rely on the disclosure of genetic data, boasting significant commercial value. Data shows that the scale of China's genetic testing market has grown from 7.2 billion yuan in 2016 to 37.4 billion yuan in 2024, and is expected to reach 153.6 billion yuan by 2030, with a compound annual growth rate of 25.8% over the next five years.1 Moreover, on June 22, 2022, Mega Genomics, touted as the pioneer in consumer-grade genetic testing, debuted on the Hong Kong stock exchange, with its market value exceeding 4.5 billion yuan on the first day of trading, underscoring the immense potential of this burgeoning industry.2

The “disclosure” of genetic data not only brings huge benefits, but also leads to huge ethical and moral risks, and has already had some adverse effects on personal life. For example, in 2013, the genome sequence of “HeLa Cell” was disclosed,3 and the researchers did not obtain the consent of the family related to the cell.4 This disclosure exposes the genetic traits of the family simultaneously, potentially leading to unnecessary troubles, worries, and social pressures. Genetic discrimination has already surfaced in areas such as health insurance, labor, and employment, exacerbating the challenges faced by individuals and families alike. The “first case of genetic discrimination” in Guangdong, China in 2010 has aroused widespread concern.5 At preseent, many countries have carried out special legislative practice around these special fields.6 Meanwhile, the emergence of Direct to Consumer businesses, public gene banks, and online genetic repositories has further heightened the risk of gene privacy breaches. Considering the particularity of genetic data, that is, 99.9% of human genetic data has commonality, [3] while the remaining 0.1% is closely related to its family,7 it seems that the reason for individuals to decide the disclosure of their genetic data is not sufficient, which inevitably causes people’s concerns and worries about the disclosure of their gene privacy.

In fact, there are inherent contradictions in assigning the responsibility of protecting genetic data to the realm of privacy rights. Theorists argue that the concept of privacy gained global recognition and evolved further through Samuel D. Warren and Louis D. Brandeis’ seminal article “Privacy”. In this paper, the right to privacy is traced back to the legal safeguarding of personal life. The individual’s “right to life” encompasses not only shielding against external infringements and dangers but also extends to the “right to enjoy life” – in other words, the “right to be let alone” [4]. As such, privacy rights have often been associated with individualism, with the right to individual life serving as its foundational principle. Subsequently, the development of privacy theory and legislation has largely unfolded within the framework of individualism. One of the most esteemed principles within this context is the establishment of the “rule of informed consent,” which dictates that the utilization of personal privacy must be predicated on obtaining consent [5]. However, genetic data involves multiple interests, extending beyond individuals to encompass their families and even humanity as a whole. Therefore, there exists a fundamental conflict regarding the applicability of privacy rights in regulating genetic data. Countries have encountered varying degrees of challenges in applying privacy rights to protect gene privacy. These challenges primarily revolve around issues such as whether doctors should inform the close relatives of patients about the risks associated with genetic testing and whether obtaining personal consent is adequate for gene privacy. These issues remain unresolved [6]. Currently, gene privacy protection in China primarily adheres to individualistic principles, facing numerous practical governance challenges. Globally, privacy theory has evolved beyond individualism, and produced the derived notions of group privacy, offering potential solutions to these issues. In this regard, this paper initially examines the legislative development of gene privacy protection in China, expounding on the prevailing approach to safeguarding genetic data. Besides, the paper delves into the challenges confronting genetic data protection in China and highlights the limitations of the existing model. Finally, drawing on advancements in group privacy theory and considering China’s unique circumstances, this paper proposes a future pathway for enhancing gene privacy protection in the country.

Review of China’s legislation on gene privacy

The right to privacy is a complicated concept. As Westin said, “The field of privacy, the form it takes, the role of law and the global aspect of making privacy a clear social problem depend on specific social, historical, political and economic backgrounds” [7]. To understand privacy as a future and a contemporary social problem, we must analyze the concept of privacy from the perspective of personal and social history. The discourse on gene privacy in China is intricately linked with these two dimensions. Privacy, as a concept, has its origins in the West. It took nearly 30 years from its inception in Chinese legislation to being formally recognized as an independent civil right. Despite that, the discourse on gene privacy has evolved in tandem with the development of privacy laws, which is quite unique. Due to differences in legislative systems and ideological frameworks, the content of privacy rights in China diverges from that of other nations. As a result, gene privacy, framed within the context of privacy rights, assumes a distinct connotation and embodies specific Chinese characteristics in terms of protection methodologies.

The origin and system orientation of the right to privacy in China

This section provides an overview of the legislative framework and process surrounding the right to privacy in China, shedding light on its legal position and meaning in the country. This introductory exploration is crucial, as the concept of privacy in China differs significantly from that in the United States, being explicitly defined by legislation rather than evolving through judicial interpretation. Only by understanding the connotation of Chinese privacy rights can we clarify the issues that Chinese legislation can and should address.

China adheres to a continental legal system, wherein the right to privacy is within the broader framework of personality rights. However, compared to other aspects of personality rights, privacy has historically received less attention in China. Notably, the Constitution of the People’s Republic of China does not include a dedicated provision addressing the right to privacy. The constitutional origin of the right to privacy in China is considered to be Article 388 of the 1982 Constitution, “The personal dignity of citizens of the People’s Republic of China is inviolable”, Article 39,9 “The residences of citizens of the People’s Republic of China are inviolable,” and Article 40,10 “Freedom and secrets of correspondence of citizens of the People’s Republic of China are protected by law” [8]. The General Principles of the Civil Law of the People’s Republic of China promulgated in 1986 (hereinafter referred to as the General Principles of the Civil Law) clearly stipulates that citizens enjoy personal rights such as the right to life and health, the right to name, the right to portrait and the right to honor, but does not recognize the right to privacy. This is comprehensible. During that period, China’s civil legislation was still incomplete, making it unrealistic to demand comprehensive protection of personal dignity. However, this does not mean that China does not protect privacy. Article 10111 of the General Principles of the Civil Law establishes that “Citizens and legal persons shall enjoy the right to dignity”, which provides space for judges to protect citizens’ privacy by expanding the interpretation of “personal dignity” in judicial practice.

In 1988, the promulgation of Notice of the Supreme People’s Court on Issuing the Opinions on Several Issues concerning the Implementation of the General Principles of the Civil Law of the People’s Republic of China changed this situation. According to Article 140, paragraph 112of the Notice, privacy protection was been classfied under the right of reputation and only enumerates violations related to privacy disclosure. This judicial interpretation has remedied the significant deficiency in the General Principles of Civil Law by not stipulating the right to privacy. It has positive significance, but by placing privacy protection under the right to reputation and only listing the act of disseminating privacy as a type of infringement, it to some extent limits the strength of privacy protection. Subsequently, the Supreme People’s Court has maintained the approach of safeguarding privacy within the framework of the right of reputation, albeit expanding its protective scope. In the Answers to Several Questions on the Trial of Reputation Cases promulgated in 1993, it was pointed out that “those who publish other people’s privacy materials without their consent or publicize other people’s privacy in written or oral form, causing damage to their reputation, should be treated as infringing on others’ reputation rights.”

This situation continued until 2001, when the Interpretation of the Supreme People’s Court on Problems regarding the Ascertainment of Compensation Liability for Emotional Damages in Civil Torts was issued, which pointed out that invasion of privacy is no longer regarded as infringement of reputation right, and compensation for mental damage can be claimed.13 At this stage, we can say that understanding of privacy has changed qualitatively and opened the road of its independence.14 Finally, in Article 215 of Tort Law of the People’s Republic of China promulgated by China in 2009 (hereinafter referred to as Tort Law), the right to privacy was explicitly specified and officially enshrined into law, ending its past attached to other rights. The General Principles of the Civil Law of the People’s Republic of China in 2018 clearly established the right to privacy in “civil rights”,16 and the Civil Code of the People’s Republic of China promulgated in 2020 (CCC) carried forward this provision, and separately stipulated “right to privacy and Protection of Personal data”17 in Book Four “Personality Rights”.

According to Article 1032 of CCC, privacy is the tranquility of the private life of a natural person, and the private space, private activities, and private data that he is unwilling to be known to others. Theoretically, some scholars contend that privacy can be distilled into two dimensions: the tranquility and secrecy of private life. Tranquility pertains to the freedom from unwarranted interference, while secrecy involves safeguarding private data from illegal collection, surveillance, and disclosure by others. Other scholars believe that the content of privacy should include three aspects: the confidentiality of personal data: personal life is not disturbed; have the freedom to decide personal affairs [9]. In addition, CCC independently compiles personality rights for the first time, and the protection of personality rights does not exclude property interests on personality elements. According to Article 993 of CCC,18 a civil party may license another party to use his name and likeness, among others, except those prohibited to be licensed according to the law or the nature. Privacy is not a legally prohibited element for licensing. In line with the fundamental principle of “freedom not prohibited by law,” a party can license their privacy to external parties and receive economic rewards in return.

From a technical standpoint, China has actually taken a different path from the right to publicity and private self-determination. The decision to not adopt the right to publicity stems from the respect for human dignity and aims to prevent the abuse of personality interests (privacy). The choice to not recognize private autonomy is twofold: first, China acknowledges the right to bodily integrity without the need for redundant provisions; second, it prevents the right to privacy from becoming a framework right, similar to the development of privacy rights in the United States, which has led to multiple interpretations and blurred the boundaries of privacy rights.

Development and legislation of gene privacy in China

From the aforementioned analysis of the right to privacy, it can be seen that the legislative provisions on the right to privacy need to be traced back to 1988, and it was not until the promulgation of Tort Law in 2009 that privacy became an independent right. In contrast, the legislative process on gene privacy is relatively rapid. In Chinese legislation, the object of gene privacy is defined as genetic data, so gene privacy is equivalent to genetic data privacy. Because the gene privacy is placed under the right to privacy, the protection mode should follow the negative defense form of the right to privacy, prevent the spying and disclosure of genetic data, and obey the particularity of genetic data, not competely following the personal consent rule.

Unlike France, which explicitly stipulates genetic rights in its Civil Code—Article 16–10 of the French Civil Code restricts an individual’s right to self-determination over gene privacy, specifying that genetic data may only be used for medical or public welfare purposes [10] — China places genetic data under privacy rights, without recognizing that individuals hold a specific right to their own genetic data. Special provisions on genetic data was issued in 1998, and the State Council approved the Interim Measures for the Administration of Human Genetic Resources, which is the first regulation to adjust genes in China. However, this regulation aims to safeguard the national sovereignty of genetic materials such as genes, rather than the genetic right of individuals, which has distinct public law nature. The subsequent legal norms closely related to human genes, such as Ethical Guiding Rules for Human Embryonic Stem Cell Research and Ethical Review Measures for Biomedical Research Involving Human Body, also regulate gene research from the level of public law [11].

At the level of private law, Article 12, paragraph 1,19 of Provisions of the Supreme People’s Court on Several Issues concerning the Application of Law in the Trial of Cases involving Civil Disputes over Infringements upon Personal Rights and Interests through Information Networks, which was officially implemented in 2014, mentioned “genetic data” for the first time and defined it as personal privacy. Although this clause is only applicable to Internet infringement, it has shown that the Supreme People’s Court pays great attention to the legal issues of gene technology, and in the Chinese context, the object of gene privacy is clearly defined as genetic data, so fundamentally speaking, gene privacy should be expressed as genetic data privacy. In 2019, Regulation of the People’s Republic of China on the Administration of Human Genetic Resources was promulgated, which is mainly a public law norm in nature. However, in Article 12, it is clarified that individuals should be fully informed when obtaining genetic resources such as human genetic data (Human genetic resource providers shall be informed of the data prescribed in the preceding paragraph in a comprehensive, complete, true and accurate manner, no data shall be concealed, and providers shall not be misled or deceived), and the written consent of individuals should be required.20 Article 1009 of CCC promulgated in 2020 stipulates that “Medical and scientific research activities concerning human genes and human embryos, among others, shall be carried out according to the laws and administrative regulations, and relevant provisions issued by the state, without endangering human health, violating moral principles, or damaging public interests.” CCC first responded positively to the utilization of gene, which is the first time that China regulates gene protection in the form of law. In 2023, Detailed Rules for the Implementation of the Regulation on the Administration of Human Genetic Resources was promulgated, which further improved the collection, preservation, utilization and external provision of biological genetic resources such as genes and promoted the development of gene technology in China.

From the perspective of time span, the legislative development of gene privacy as a subordinate concept is almost consistent with the legislative development of privacy. This is due to several major events related to genes: First, HGP, which originated in the 1990 s, made China realize the great value potential of genes and began to pay attention to genes; second, the emergence of CRISPR/Cas9 technology and the He Jiankui gene editing baby incident in China in 2018 [12], which made China realize its shortcomings in life science governance and accelerated the corresponding legislative construction [13]; third, the life technology competition started in the world at present. In the field of gene editing technology, the number of patent applications and authorizations in the world has shown explosive growth [14], which indicates to a certain extent that we have entered a technology competition without smoke. These incidents have promoted China’s genetic legislation and promoted the rapid development of gene privacy.

In the connotation of gene privacy, Chinese legislators have already noticed the particularity of genetic data. The Provisions of the Supreme People’s Court on Several Issues concerning the Application of Law in the Trial of Cases involving Civil Disputes over Infringements upon Personal Rights and Interests through Information Networks promulgated in 2014 clearly defined genetic data as a privacy, thus including genetic data as the object of privacy protection. In the protection mode, the protection of genetic data should follow the negative defense situation of privacy, that is, to prevent the spying and disclosure of genetic data of a party to civil legal relations, supplemented by the limited external permission of a party to use their genetic data. This protection model has a strong individualism color, because privacy itself is the right of individuals to be alone, and their individual self-determination (informed consent) has no doubt. However, it is not feasible to directly copy the rules governing general private data to genetic data. Genetic data is different from general data and involves other subjects. It is not always appropriate for individuals to self-determine genetic data. Tracing back to the source, it is not enough to protect gene privacy only by traditional privacy rights. In this regard, some Chinese scholars have realized the deficiency of genetic data protection under the right to privacy, [15] and proposed to learn from French experience and add genetic rights to the CCC for special adjustment. Some scholars have suggested that the protection of genetic data should be handed over to the Personal Information Protection Law of the People’s Republic of China (CPIPL) [16], and special design should be carried out in “sensitive data”.

Dual mode of gene privacy protection in China

In China’s current private law norms, the safeguarding of gene privacy primarily encompasses two dimensions: privacy protection and personal information protection. These aspects are not mutually exclusive and undergo transformation and application.

Privacy protection model

Gene privacy belongs to private data in the right to privacy in nature, and can be divided into two levels: passive protection and active protection. In terms of negative protection, it is also the main way to protect gene privacy. According to Article 1032, paragraph 1,21 of CCC, a natural person enjoys the right to privacy. No organization or individual may infringe upon any other’s right to privacy by spying, intrusion, divulgence, public disclosure, or any other means, which is intended to protect the privacy of a party to civil legal relations to their genetic data. On the positive side, mainly according to Article 993 of CCC, a party to civil legal relations may license another person to use his name and likeness. This positive utilization mode is more important in today’s era of life technology. In terms of licensing methods, it includes not only the active informed consent of a party to civil legal relations, but also other ways confirmed by law based on specific interests, such as the rational use of personal data of a party to civil legal relations for public interests, supervision by public opinion,22 or other acts reasonably implemented to safeguard public interests or the legitimate rights and interests of natural persons. Under these circumstances,23 personal data can be handled without the consent of a party to civil legal relations. As a kind of personal data, genetic data should apply the above rules in theory, but considering the particularity of genetic data, this inference is not necessarily correct. However, in the absence of further provisions in the current legislation, it should be possible to deal with genetic data with reference to the fair use rules of personal data.

Personal data protection mode

CCC promulgated in 2020 separately compiled Personality Rights as a Book, and placed Chapter VI right to privacy and Protection of Personal data, thus the protection of personal data was made clear at the legal level. Because the legislative expression adopts “personal data protection” instead of “personal data protection right”, the word difference has caused a fierce dispute on the attribute of personal data protection in Chinese theoretical circles [17], that is, whether it is a right or an interest, which determines the level of personal data protection. So far, this debate has not been settled, and it need to be further explained by future legislation.

In 2021, CPIPL was promulgated, which triggered a debate among Chinese scholars on the applicable relationship between CPIPL and CCC, that is, whether CPIPL adopts a special route [18], or it is only a further development of the “personal data protection” rules of CCC [19], determining the applicable order of the laws. At present, the majority of Chinese people holds that the relationship between CPIPL and CCC is general law and special law. In the application of law, the rules of CPIPL are preferentially applied to deal with the protection of personal data, and the provisions of CCC are applied when there are no provisions or insufficient provisions [20]. In CPIPL, personal data is further divided into general personal data and sensitive personal data. According to Article 28,24 genetic data should be sensitive data. In terms of protection methods, for sensitive data such as genetic data, CPIPL puts forward stricter protection requirements than general personal data, such as “Personal data processors may not process sensitive personal data unless there are specific purposes and sufficient necessity and strict protection measures are taken.”,25 “An individual's separate consent shall be obtained for processing his or her sensitive personal data. Where any law or administrative regulation provides that written consent shall be obtained for processing sensitive personal data, such provision shall prevail.”26 In addition, CPIPL also makes special provisions on the handling of personal data by state organs.27 It can be seen that CPIPL has indeed made further contributions to the protection of gene privacy, but this step is relatively limited. China’s legislative design of gene privacy is still not perfect. To a certain extent, it only builds a “framework” for gene privacy protection. For example, Article 32 of CPIPL stipulates that “Where any law or administrative regulation provides that the processing of sensitive person data shall be subject to relevant administrative licensing or other restrictions, such provision shall prevail.” This article is a standard incurring clause, which reserves the space for further legislative provisions on special sensitive data such as gene privacy. Unfortunately, not only China, but also the whole world has not yet designed a perfect scheme for gene privacy protection.

Practical dilemma of gene privacy protection in China

Currently, gene privacy protection in China operates under a dual-track system including privacy and personal information protection. However, the absence of specialized legislative design fails to offer comprehensive safeguards for genetic data, leading to several issues that impact genetic technology practices. Firstly, there is inadequate personal protection of gene privacy. Given the unique nature of genetic data and advancements in big data technology, informed consent alone may not suffice to safeguard personal genetic data. Secondly, there is a lack of recognition of the social benefits of gene privacy. Family and societal interests related to genetic data are often disregarded, hindering the achievement of a balanced approach among multiple stakeholders. Thirdly, the distribution of benefits from gene privacy is uneven. Given the high value of genetic data, the equitable sharing of benefits arising from its disclosure remains an unresolved long-term issue. These challenges are not unique to China but are encountered worldwide. Despite China's recognition of the distinctiveness of genetic data, existing protection regulations and theories are outdated, resulting in deficiencies in addressing these issues.

The lack of personal protection

Genetic data reveals the living characteristics of each person, pointing to a specific individual like an ID card, and has distinct identification [21]. The disclosure of genetic data poses the risk of genetic discrimination, which can significantly impact individuals, families, and even entire races. As such, gene privacy is considered sensitive data for individuals. While both China's CPIPL and the EU's General Data Protection Regulation (GDPR) have included special provisions on sensitive data, they primarily rely on the informed consent model. However, these regulations impose more stringent conditions, such as requiring independed written consent, without further specific provisions for genetic data. Given concerns about gene privacy breaches, individuals, families, and groups may be hesitant to provide personal genetic data for fear of its acquisition and misuse. Moreover, improper acquisition and processing of genetic data by enterprises may expose them to legal risks, potentially triggering a chilling effect in the genetic field. To delve into this issue, we will examine the two key aspects of data acquisition and processing under the informed consent model.

The subject of gene data is not fully informed and consent a mere formality

According to the provisions of CCC and CPIPL, except for the special provisions of the law, the gene data should be fully informed and obtained after obtaining its consent. The legitimacy of this acquisition is based on the autonomy of the civil party, that is, the civil party has the right to dispose of part of his or her personality or property rights according to his free will. However, if the “knowledge” of the civil subject is insufficient, to what extent the “consent” of the civil party should be considered to be effective, and whether the legitimacy of the behavior of obtaining genetic data is sufficient, these issues are worth considering. In this regard, according to the provisions of CCC, genetic data collectors should at least ensure “the purpose, method, and scope of data processing are explicit.”,28 and CPIPL also clearly stipulated that “personal data processing shall be for a clear and reasonable purpose, directly related to the processing purpose and in a manner that has the minimum impact on the rights and interests of individuals.”29 These requirements suggest that data must be adequately informed when collecting genetic data, and that without restrictions on the scope, manner and purpose of collection, individual consent will become a mere formality, which will make informed consent overhead [22]. However, considering that genes contain a huge genetic code of life, and its connotation is extremely rich, it is sometimes impossible to set an accurate purpose in advance for the mining of genetic data, so it is usually difficult to accurately describe and define the purpose of genetic data processing in practice, and researchers themselves may not think of the possible aims of genetic data research. Therefore, in practice, when a participant agrees to store his genetic data in a biological sample bank for research, he must broadly agree to unspecified future research. But this broad agreement is alarming because participants lose control and knowledge of who has access to his data and future research uses [23]. This will not only make individuals fall into fear that their genetic data will be illegally disclosed, but also put enterprises on the verge of breaking the law.

Big data technology and the particularity of genetic data make anonymity impossible

Anonymity refers to a technical means that removes the personal identification in personal data, so that the corresponding data cannot be directly or indirectly identified with other data. This is a very important concept, because if the data is anonymous, it means that the processing of data is no longer regulated by CPIPL,30 which is actually equivalent to removing the restrictions on personal data processing. On this basis, hospitals and research institutions are free to disclose health data as long as it is deprived of certain identifiers. If insurance companies obtain customer data from the public domain, they can use customer data to discriminate. Discrimination based on health data is a problem because much of the de-identified data is now available in the public domain of data repositories [24]. However, considering the particularity of genetic data, it is impossible to realize the anonymity of data. Because of the inherent stability and uniqueness of genetic data, the DNA of any two individuals can be easily distinguished from each other, making it vulnerable to individual re-identification [25]. With the further development of research, it is found that only a small amount of snp can re-identify individuals in aggregate statistics. When it comes to genetic data, the force for justice of individual consent and autonomy begins to show its limitations. The development of big data technology and the complex meaning of genetic data mean that the orthodox consent method and anonymity are no longer match with the task of proving the ethical rationality of genetic research.

Absence of the social interests

Nowadays, people’s understanding of privacy as a human right has become increasingly individualistic and rooted in the values of personal autonomy and self-control [26]. The emergence of genetic data poses a challenge to the prevailing modern concept of individual privacy, shifting the focus towards group relationships. This indicates that the handling of gene privacy must no longer solely adhere to individual preferences but should also consider the interconnected interests of genetic makeup. Dealing with gene privacy demands more than adherence to standard data processing protocols; it necessitates a tailored system design, which is of utmost importance. Gene research is a long-term endeavor, and its sustained progress relies on the equitable distribution of benefits. Currently, the benefits derived from gene privacy are unevenly distributed among stakeholders, overlooking the rightful interests of genetic data providers and stakeholders. In this context, our primary concern lies in the inadequate protection of familial and societal interests within China’s existing gene privacy framework.

Insufficient protection of family interests

In fact, many Chinese scholars have a clear understanding of the impact of gene privacy disclosure on their close relatives, and have discussed it in theory, [27] which shows that the lack of attention to family interests in gene data protection has aroused widespread concern in China. This lack of protection can be reflected in two aspects: Firstly, the issue arises as to whether individuals should have sole discretion over the disclosure of genetic data. When individuals opt to divulge their identified genome data voluntarily, other genetic data may inadvertently be revealed. Often, individuals make these decisions without fully considering the repercussions on themselves or their relatives. There is limited recourse to prevent such voluntary disclosures, except to ensure that individuals are fully informed about the potential consequences [28]. It is not known from the public data whether Angelina Jolie, a famous movie star, respected the privacy of her family members when she disclosed her gene privacy on May 14, 2013. Considering that the disclosure of individual genetic data has an important impact on family members, individual self-determination should be restricted to a certain extent [29]. Although many scholars in China have realized this regard, there is no legislation so far; Second, after checking personal genetic data, under special circumstances, if there is family genetic risk, whether doctors need to inform their close relatives. People’s simple emotional value holds that clinicians should inform patients of the importance of diagnosing or predicting genetic data for their relatives. Ideally, clinicians would encourage disclosure and offer to assist patients in this process, but there are differences on whether clinicians are obliged to contact and provide results when patients refuse and do not authorize clinicians to contact relatives.31 In China, there is little discussion on this aspect, [30] and the current legislation does not clearly stipulate the doctor’s obligation to inform. In contrast, a guidance document from the American Society of Human Genetics pointed out that data disclosure is appropriate in some very unusual circumstances.32 Although this guidance document of the United States is controversial, it provides a value judgment standard, which is helpful for further reflection and improvement.

Lack of protection of group interests

From the perspective of historical development, the development of privacy can not be separated from the changes of technology. Because of the harm suffered by contemporary privacy challenges such as profiling and large-scale monitoring, the traditional concept of privacy as an individual’s laissez-faire right cannot be fully solved [31]. With the development of gene technology and big data technology, when it comes to the processing of genes and data, individuals are more and more accidental, and the focus of big data analysis is on the concept of “group”, which gives birth to the concept of group privacy [32]. The traditional expression of personal privacy focuses on the protection of personal data, but it cannot guarantee the autonomy of individuals to be free from influence and manipulation at the group level [33]. While directly harming the group interests of privacy, it will eventually harm the personal interests [34]. To a certain extent, protecting group interests means protecting individual interests. Under the traditional right of personal privacy, the interests of groups are usually ignored by individuals’ independent decisions. However, in genetic data, because it involves the interests of multiple subjects, when personal privacy choices begin to affect other people’s autonomy, the limitations of personal consent model become obvious [35]. In view of the limitations of the individual consent model, it is necessary to expand the data protection rights to allow group management of data rights [36]. Under this background, the concepts of group privacy has been developed, and the solutions including class action [37], group association [38] and compulsory multi-risk assessment [39] have been derived. In contrast, Chinese theoretical community pay less attention to this, and lack of attention to the protection of group interests.

The imbalanced sharing of the benefits

With the continuous development of biotechnology, the interest in genetic resources has been increasing all over the world, and genetic data, especially human genetic data, has become the most valuable part of genetic resources. In fact, the gene piracy incident for genetic resources has already been staged, and there are not a few incidents in China, such as the Harvard Gene Island incident in Yuexi County, Dabie Mountains, Anhui Province [40]. It is reported that Millennium Pharmaceuticals in the United States has invested more than 100 million US dollars in several genetic research projects such as asthma just because it has access to DNA resources in Anhui Province. However, Toutuo Town Health Center in Yuexi County has not received any other funding or support from this project except for several old domestic sphygmomanometers donated by the sampling group. A farmer’s family of four took part in physical examination twice to draw blood, and each time they received lost time allowance from 10 or 20 yuan, plus two packs of instant noodles, and finally got a biomedical environmental report and two bottles of antihypertensive drugs. In this incident, the benefits are shared in an extremely unfair manner. If such a “robber-style” incident remains unchecked, it will undoubtedly ruin the development of biotechnology. In this regard, it is not sufficient to protect their genetic data through individuals, and further international consultation and national legislation are needed if the benefits arising from the disclosure of genetic data to third parties are to be rationally distributed.

At the national legislative level, although a specific benefit-sharing system has not yet been reached at the global level, many countries have provided model templates for the contract between genetic data providers and collectors, and added benefit-sharing clauses, which is helpful for the implementation of reasonable returns for genetic data providers. In this respect, typical models are “Cooperative Research and Development Agreement” and “Refusal to Share Benefits Agreement” issued by the national park service of the United States. Another example is South Africa’s Regulations on Bioprospecting, Access and Benefit Sharing issued in 2008, which clearly stipulates that access to and utilization of genetic resources in South Africa requires signing a Material Transfer Agreement and a Benefit Sharing Agreement [41]. At the international level, the Ethics Committee of the International Human Genome Organization emphasized in the Statement on Benefit Sharing that the communities where participants are located should be shared: if profits can be obtained, a certain percentage of net profit (1–3% after tax is recommended) should be donated to medical and health infrastructure construction (such as vaccines, tests, drugs, treatments, etc.) or local, national and international humanitarian assistance. In very rare cases, a large family or a small population (tribe) has an abnormal gene, but the research ultimately benefits people suffering from another disease. The principle of justice requires recognition of the contribution of the original population. In this case, benefits can be provided to all members of the population, regardless of whether they are involved in the study.33 However, within China’s legislative framework, genetic legislation primarily falls under the purview of public law, often overlooking the private interests that stem from the sharing of genetic data. Despite the protective measures in place by the state to prevent incidents like the genetic piracy case in Anhui from reoccurring, villagers and communities do not receive assured benefits for sharing genetic data. This underscores the necessity for further enhancements in China’s legislation to better address the distribution of property interests concerning gene privacy.

The way to perfect the system of gene privacy in China

In China, the concept of privacy and gene privacy has been evolving for nearly 20 to 30 years, and it’s understandable that legislative provisions may still be imperfect. In addressing gene privacy, China has adopted a dual-track system encompassing both privacy and personal data protection. However, as previously discussed, this approach has inherent limitations. Both models emphasize individualism, yet the interests associated with genetic data extend beyond the individual, challenging the notion of absolute individual self-determination. The current dilemma facing genetic data protection in China can largely be attributed to the constraints of the individualistic approach. To progress, China should first break the constraints of individualism in terms of philosophy and examine genetic privacy protection from group dimension; second, restrict individuals’ self-determination over their genetic information to prevent improper disposal; and finally, based on China’s national conditions, leverage the existing organizational functions and public interest litigation system, and safeguard the role of groups in benefit-sharing.

The value shift in gene privacy protection

The proposition and development of the concept of group privacy

Currently, the goal of big data analytics is no longer directed at individuals but at groups with shared characteristics. These groups generated through data analytics fall beyond the protection scope of existing privacy and personal information legislation based on individualism. However, the harms resulting from group-based analytics are actually borne by each individual—for instance, price discrimination derived from data analytics damages every person in the targeted group. To fundamentally protect individual rights, redress must be sought from a group-level perspective. In this regard, theories asserting that groups should enjoy privacy rights similar to those of individuals or exercise certain control over information have been proposed and developed, primarily including the theory of group privacy and the theory of collective privacy.

Edward J. Bloustein is regarded as one of the earliest scholars to propose the concept of group privacy. He defined group privacy as “a form of privacy sought in people’s associations with others” and emphasized that “group privacy is an attribute of individuals in their collective association, not of the group itself” [42]. Although Bloustein was the first to put forward the concept of group privacy, he did not recognize the group as an independent subject; instead, he viewed it merely as an aggregation of individual interests. Since the group privacy he described typically occurs within families or specific collectives, it is also referred to as family privacy or relational privacy. Such groups have distinct characteristics that make them easily identifiable, and protecting the privacy of these specific groups (e.g., families and religious communities) is ethically and morally acceptable to society. Consequently, the concept of group privacy has gradually gained recognition from both the public and academic circles.

The development of the concept of collective privacy is closely linked to theories of collective rights and collective interests. In its early stages, the theory of collective rights primarily focused on issues such as the right to self-determination and protection of minority groups, indigenous groups, etc., in political, cultural, and other spheres. With the advancement of the theory, scholars have conducted in-depth research on the nature of collective interests. Dwight G. Newman pointed out that collective interests are not a simple aggregation of individual interests but an non-aggregative entity, whose core lies in promoting sustained collaboration among collective members and achieving the prosperity and development of the collective [43]. Specifically, with respect to the protection of group interests generated by data analytics today, Alessandro Mantelero noted that emphasizing the concept of collective privacy is to a certain extent intended to distinguish it from the concept of group privacy proposed by Bloustein, and to recognize that groups possess independent interests rather than being a mere aggregation of individual interests [44].

With the development of big data technology and the emergence of special objects such as genetic data, individuals can hardly protect their data anymore—for we have been categorized into different "groups," and such groups will ultimately harm our individual interests. In this context, protecting group interests means protecting individual interests, giving rise to the concept of group privacy with independent interests. Luciano Floridi was one of the earliest scholars to identify this special type of group through big data analytics. He pointed out that the issue of group privacy is crucial in light of the privacy threats posed by big data analytics, "because big data is more likely to treat types (customers) rather than tokens (you), so the focus is on groups rather than individuals" [45]. Therefore, in essence and core, the concepts of collective privacy and group privacy are converging today. Both are rooted in the reality that privacy and personal information protection legislation under individualism is insufficient; they start from the perspective of protecting group interests (by recognizing and safeguarding group interests) and ultimately aim to protect individual interests. Considering that group privacy is a more commonly used term, this paper uses group privacy to refer to theories related to protecting individual rights from a group-level perspective in the context of big data.

From individual interests to group interests

Individual autonomy is the cornerstone of the liberal tradition, and the exercise of such autonomy is accomplished through individual consent. From an ethical perspective, if the negative consequences of an individual’s actions are confined to themselves, then the individual can be said to have the capacity to exercise their rights. However, gene privacy is more like air quality or safe drinking water—a public good that cannot be effectively regulated by relying on the wisdom of millions of individual choices, and thus requires a more collective response [46]. In genetic medical research, a reasonable balance must be struck between private interests and public interests. For example, the legitimacy of population genetic databases is often based on social interests rather than individual gains. The most optimistic outcome in the name of public interests is to consider and seek a balance among the interests of all parties, including taking into account the interests of ethnic minorities from the perspective of cultural diversity [47]. Against this backdrop, the protection approach under individualism is no longer feasible, and it is necessary to rethink the protection paradigm of genetic data from the perspective of group interests.

The proposition of the concept of group privacy is groundbreaking: it breaks the rigid cognitive model of individualism, recognizes that groups should enjoy independent interests under specific circumstances, and attempts to define such groups and endow them with control over information. However, the shortcomings of this theory are as obvious as its strengths: how to define groups generated by data analytics, especially groups that individuals are unaware of due to big data analytics? This question has become a strong argument against the concept of group privacy. In response, Michele Loi and Markus Christen further divided group privacy into two concepts: first, group privacy in specific relationships (e.g., teams, religious communities, etc.), where members are aware of their membership in the group and have a certain understanding of the group and other members; second, what is called inferential privacy, which involves inferences that can be made about groups defined by characteristics or combinations shared by all individuals in the group—at this point, members of the group are unaware of their membership. Regarding the second type of inferential privacy, they argued that "digital groups" do not enjoy independent status, but can be transformed into the first type of group privacy under specific circumstances (e.g., forming a collective through litigation for rights protection) [48]. Even Floridi, who advocates for the independence of groups, acknowledged that "a person may be a member of more than a thousand groups at a given moment, and he or she is barely aware of them. Therefore, endowing all such groups with the right to protect their interests is almost a Sisyphean task" [49].

To address this issue, many scholars have made efforts. For instance, from an epistemological perspective, Floridi justified the legitimacy of groups in group privacy based on the specific level of abstraction of analysis. He broke through traditional understandings of groups, pointing out that algorithmic grouping delineates scopes based on individual correlations, and the groups formed thereby imply social attribute segmentation—this serves as the practical foundation for the existence of group privacy. He also leaned toward the affirmative view that "groups enjoy rights," citing the collective consciousness of funeral groups as an example to endow groups with a subject status similar to that of individuals. In addition, he criticized reductionism and the theory of ownership, defined the essence of privacy as "the constitution of social identity," and delineated group privacy as information content exclusive to the group and reflecting its internal intimate state or shared characteristics—thus clarifying the distinction between group privacy and individual privacy, and laying a theoretical foundation for the legitimacy of group privacy [50]. Linnet Taylor also pointed out that a group is not an aggregation of individuals but an entirely new concept—a group generated by big data analytics based on specific "intervention" points. Groups created through profiling with large-scale datasets differ from the traditional concept of what constitutes a group: such groups are not self-formed but algorithmically grouped, and the purpose of grouping may not be to obtain personal information or identify individuals. Such groups are practically vague (because they do not focus on individuals within the group) but epistemologically precise (because they create a situation where people effectively self-select to accept specific interventions due to their particular preferences or characteristics) [51].

Frankly speaking, the work of defining groups in group privacy remains unfinished, with theoretical controversies still unresolved and a lack of specific measures and systems in practice. However, considering the context of the big data era—especially the rigidity of systems under individualism—recognizing that groups possess independent privacy interests under certain circumstances will help break free from this dilemma. Currently, recognizing the independent status of groups and endowing them with rights remains an extremely arduous task. In view of this situation, this paper argues that it is advisable to only initially recognize that groups have independent interests. As some scholars have noted, the emphasis on group privacy interests (rather than group privacy rights) stems from the consideration that the concept of group privacy may not yet be mature enough to be treated as a legal right, and a period of understanding and adaptation is temporarily needed [52]. This paper endorses this view. First, recognizing that groups have independent interests holds positive theoretical significance: it provides a perspective to break away from the individualism-centric redress approach and lays a legitimate foundation for protecting groups. Second, the recognition that groups enjoy specific interests has already reached a certain consensus, which helps alleviate theoretical disputes. Finally, in terms of the extent of protection and redress, existing systems can be used to provide appropriate (rather than full) protection for groups—since the protection of interests does not need to reach the level of right-based protection, this will help promote and implement the protection of genetic data. The specific recommendations proposed later in this paper (e.g., relying on organized entities, leveraging the public interest litigation system for personal information) are all developed based on this logic and China’s existing systems.

Restrictions on individual’s genetic data self-determination

Theoretical basis for restrictions

The shift from individualism to collectivism requires thinking about gene privacy protection from the perspective of the group, and on the other hand, it also requires individuals to limit their disposal of their genetic data. The uniqueness of genetic data underscores the inadequacy of allowing individuals’ complete autonomy over their genetic data. Instead, there should be limitations on the disposal of genetic data, with individual interests yielding to family and group interests to a certain extent. In the Chinese context, this restriction on individual genetic data is readily understood and accepted by society, owing to China’s legislative approach and cultural heritage. Legislatively, China adheres to the civil law system, categorizing civil rights into personal and property rights. Personal rights, being paramount for upholding human dignity, take precedence over property rights. Gene privacy falls within the realm of personal rights and is accorded priority protection. However, in deference to personal dignity, the exercise of personal rights is subject to certain restrictions. This means that individuals enjoy only limited latitude in pursuing their personal interests [53]. This legislative thought is clearly reflected in CCC, such as Article 992 stipulates that “the personality rights shall not be waived, transferred, or inherited”, and Article 993 restricts permissible personality elements. Therefore, under the Chinese legislative style, it is in line with the Chinese legislative idea to restrict the autonomy of genetic data. In addition, from the perspective of cultural tradition, China has attached importance to the concept of group, such as family since ancient times, emphasizing the significance of family as a group. There is an old saying that “family ugliness should not be publicized” and “A country has its laws and a family its rules”, which are all manifestations of Chinese group ideas. Therefore, for genetic data, a special object involving family secrets, limiting individual autonomy can be accepted by Chinese ethics.

Additionally, restricting individuals’ autonomy over genetic data aligns with communitarianism. As a significant contemporary political thought, communitarianism has its philosophical roots in neo-collectivism, emphasizing the close and indivisible connection between individuals and groups [54]. Communitarianism holds that individuals and their self-perception are ultimately shaped by the communities they belong to; individuals’ understanding of themselves and the formation of their values are deeply rooted in the community’s culture, traditions, and shared life experiences [55]. In the context of genetic data, the communitarian perspective is particularly prominent. Take families as an example: as a basic form of community, family members are closely bound by long-term emotional ties, shared life experiences, and cultural inheritance. When a family member undergoes genetic testing, the test results are not merely a matter of the individual—they may well reveal information such as family genetic disease histories, affecting other family members’ understanding and planning of their own health risks. From a communitarian standpoint, restricting an individual’s absolute autonomy over genetic data at this point and taking the overall interests of the family into account helps maintain the stability and harmony of the family (as a community) and safeguard the mutual support and care among family members. For instance, if a family member is found to carry the gene for a severe hereditary disease, communitarianism dictates that this member has a responsibility to inform other potentially affected family members of this information, enabling them to take preventive and responsive measures in advance.

From another perspective, restricting individuals’ genetic autonomy may give rise to concerns about paternalism or excessive state intervention. However, considering that the negative externalities caused by genetic data extend beyond the individual themselves, such restrictions are justified. British scholar Philip Brown proposed the concept of paternalism to describe the phenomenon where "children’s future prospects are dominated by their parents’ influence rather than their own efforts"[56]. In the context of genetic data, since the interests embodied in an individual’s genetic data go beyond the individual themselves, certain individual actions—such as disclosing genetic information—may have adverse impacts on others. Hence, it is necessary to restrict individual autonomy. In terms of causality, such restrictions are not paternalistic: their starting point is not the coercive control of one subject over another, but rather a reasonable definition of the boundaries of an individual’s rational freedom, prohibiting them from enjoying benefits that exceed their own accountability. Admittedly, such restrictions on individual autonomy in the name of social and national interests may trigger concerns about excessive state interference in personal autonomy. Nevertheless, the state’s role in genetic data governance is to safeguard public interests and fairness and justice. For example, the EU’s GDPR, while imposing strict regulations on the rights of data subjects (including individuals’ genetic data) and the conduct of data controllers, is not an act of excessive intervention. Instead, it aims to create a fair and secure data environment and protect the legitimate rights and interests of all citizens in the field of genetic data. Such state actions operate within the framework of the rule of law, balancing individual rights and the overall interests of society through rational institutional design.

Approaches to restrictions

China has only made a series of legislative provisions from the level of public law, but has not restricted individuals’ disposition of their genetic data from the level of private law, or more accurately, genetic data, as a special object in the right to privacy, has not yet attracted enough attention. In this respect, we can learn from the development of some extraterritorial systems and restrict individual self-determination to some extent.

France has established "genetic rights" in its Civil Code [57]. Article 16–10 of the Code stipulates the principle of "informed consent" for genetic testing: "Examinations of a person’s genetic characteristics shall be limited to medical and scientific research purposes." This provision restricts an individual’s right to self-determination over gene privacy, specifying that genetic data may only be used for purposes closely related to the individual (e.g., medical treatment) or for the public good. Subsequently, France further implemented the Bioethics Act adopted in 1994 and the Decree on Predictive Medicine, Genetic Identification, and Genetic Research promulgated in 2000. These instruments established a fundamental rule: except for the needs of judicial proceedings, genetic testing of an individual may only be conducted for medical or scientific research purposes and must obtain the individual’s consent.

The United States enacted the Health Insurance Portability and Accountability Act (HIPAA) in 1966, whose core objective is to safeguard the security and privacy of medical information, covering the transmission, storage, and sharing of electronic medical information. In terms of gene privacy protection, HIPAA classifies genetic data as "protected health information." The Act stipulates that covered entities—such as healthcare providers and health insurance companies—must obtain explicit authorization from patients when using or disclosing genetic data. HIPAA also requires covered entities to adopt appropriate administrative, technical, and physical safeguards to ensure the confidentiality, integrity, and availability of genetic data. In 2019, a small U.S. genetic testing company failed to implement adequate security measures for customers’ genetic data and neglected to provide HIPAA compliance training to its employees. As a result, employees engaged in numerous non-compliant practices when handling genetic data, ultimately leading to a data breach. The U.S. Department of Health and Human Services imposed a substantial fine on the company in accordance with HIPAA [58]. This case underscores HIPAA’s mandatory enforcement power in genetic data privacy protection and serves as a strong deterrent to potential violators. Additionally, the Genetic Information Nondiscrimination Act (GINA), which took effect in 2008, aims to prohibit discrimination based on genetic data, with a focus on the fields of employment and health insurance. In health insurance, GINA prohibits health insurers from using genetic data to determine insurance eligibility, premium rates, or insurance benefits. In employment, GINA stipulates that employers may not use the genetic data of job applicants or employees as a basis for personnel decisions such as recruitment, promotion, or termination. In May 2013, the U.S. Equal Employment Opportunity Commission (EEOC) announced the outcome of the first genetic discrimination lawsuit filed under GINA. The EEOC alleged that Fabricut, Inc. violated the Americans with Disabilities Act (ADA) by refusing to hire a female temporary employee, Jones, for a permanent position after deeming her to have carpal tunnel syndrome during a medical examination for employment; it also alleged that Fabricut violated GINA by inquiring about Jones’ family medical history [59]. On May 7, 2012, the two parties reached a settlement, under which Fabricut agreed to pay $50,000 in compensation.

Article 9 of the EU’ GDPR specifically governs the protection of "special category data" and genetic data is explicitly classified as one type of special category data. This Article provides that the processing of genetic data is generally prohibited, except in cases where specific lawful grounds are satisfied—such as obtaining explicit consent from the data subject, fulfilling a legal obligation, or serving a vital public interest. When obtaining consent from the data subject, the data controller must provide detailed and clear information, including the purpose, method, and retention period of the genetic data processing. Guided by this requirement, EU Member States have further refined rules for the use of genetic data. For instance, Germany’s Gesetz zur Nutzung von Gesundheitsdaten (Health Data Usage Act) and the Forschungsdatenzentrum Gesundheit (Health Research Data Center), introduced in 2025, provide a more specific legal framework for the compliant use of genetic data. These instruments allow the processing of genetic data for scientific research purposes, provided that appropriate safeguards are in place. This practice offers important reference for other EU Member States, demonstrating that with sound technical and organizational measures, genetic data processing can comply with GDPR requirements while advancing medical research.

The aforementioned practices of various countries and regions are of positive significance: they help prevent individuals from recklessly disposing of their own genetic data and avoid harm to others caused by such improper individual conduct. In future efforts to improve its regulatory framework, China may advance from the following two aspects: First, strengthen the "informed" requirement in "informed consent"—that is, require genetic data collectors to clearly inform individuals of the purpose, scope, and method of genetic data collection, and prevent "blanket consent." Such vague consent renders personal protection ineffective and may, in some cases, lead individuals to give consent beyond their authority and capacity. Second, restrict the scope of an individual’s right to self-determination over genetic data to prevent individuals from infringing on others’ rights. In fact, according to the mainstream view in China’s civil law academia, an individual’s disposal of their personal rights and interests is not absolute but subject to legal restrictions. Article 993 of CCC stipulates: "A civil subject may license others to use its name, title, portrait, etc., except where such licensing is prohibited by law or due to the nature of the right." In the application of law, this provision may be interpreted as a basis for restricting an individual’s licensing of their genetic data to others. Of course, the specific acts that should be prohibited need to be clarified through further research, rather than banning all types of licensing.

In addition, in the doctor-patient relationship mentioned above, that is, when doctors find that patients carry specific hereditary pathogenic genes, whether doctors have active disclosure obligations and whether they can break through individual autonomy. Chinese law still adopts the position of complete individual autonomy here, and fails to break through. However, the relational approach to gene privacy has been explicitly endorsed in England and Wales. The High Court acknowledged that clinicians have a legal obligation to consider the interests of their patients’ genetic relatives when deciding whether to disclose health data that reduces or prevents the risk of serious harm. Simply put, individuals are not the only ones interested in “their” genetic data, a claim that science and ethics acknowledged decades ago [60]. Many Chinese scholars have noticed this point, and suggested that doctors should explain the patients first, inform the patients of the risk that their close relatives may suffer from genetic diseases, and let the patients decide whether to disclose genetic data. If the doctor deems it necessary to inform, and after informing the patient, the patient refuses to disclose the situation to their immediate family, disclosure to the patient’s immediate family may be made upon request from the patient’s family members [61]. To sum up, from the perspective of development, the restriction of individual self-determination of genetic data has become a trend.

Gene privacy protection from the dimension of group

Group interests are not simply a combination of individual interests; they possess independent value that transcends the aggregation of individual interests. The legitimacy of this point has been proved by theoretical community [62]. In practice, the legitimacy of the interests of the relevant groups has also been recognized, and the role of genetic data in protecting privacy interests beyond the immediate consenting party—the person who gave up the disputed data—has been acknowledged by the EU Article 29 Working Group. The EU Article 29 Working Group pointed out in a 2004 working paper that the development of genetics means that a new "legal social group has been formed, that is, a biological group composed of those who are genetically related."34 However, contrary to the theoretical prosperity, the protection countermeasures around the interests of groups have been delayed. This is related to the complexity of the concept of groups itself, and the establishment and composition of groups are often spontaneous and unconscious, [63] which makes it difficult to define groups themselves, thus making it difficult to form specific countermeasures. In this respect, this paper mainly discusses the potential protection path of group interests in China based on China’s national conditions and legislative design.

Leveraging existing organizations to provide remedies for groups

The crux of the difficulty in implementing the group privacy theory lies in the inability to provide a general identification framework for the establishment of all "groups." Starting from the stance of recognizing that groups possess independent interests, this paper has no intention of accomplishing this major theoretical innovation. Instead, it only attempts to propose a Chinese solution for the interest protection of specific groups, which may serve as a reference for other countries. At present, there are various group organizations in China. For example, in the field of laborers, there are three-tier and five-level labor union organizations in China. According to Chinese law, employers with more than 25 employees need to establish grass-roots labor unions, and less than 25 employees should establish joint grass-roots labor unions with other units,35 therefore China has a huge number of labor unions. Moreover, labor unions have the obligation to protect workers’ rights and interests, and can initiate labor arbitration on their behalf when workers’ rights and interests are infringed.36 It is fair to say that under the current labor organization system in China, labor unions can become a “group” form of workers, and workers can face the improper collection and treatment of genes and genetic discrimination by seeking the help of labor unions. Similarly, in the field of consumer protection, as of 2016, there were more than 3,000 consumer associations at or above the county level, including 31 province-level associations [64]. According to the Consumer Protection Law, consumer associations at or above the provincial level can bring lawsuits on behalf of consumers’ rights and interests in their own name.37 Consumers can also rely on consumer associations to advocate interest protection.

In conclusion, given the theoretical difficulty of providing general identification rules for "groups," it is more efficient and practical to first identify a reliable "group" for groups in specific fields based on practical circumstances. Admittedly, this approach has its limitations, as not all fields have well-established organizational structures to rely on. However, considering that the group privacy theory is still immature—with core issues such as whether groups possess independent subject status and enjoy rights remaining unresolved—taking the lead in seeking existing organizations to provide protection for such groups in specific core fields (e.g., labor and consumer sectors) should be the optimal path choice at present.

Giving full play to the value of public interest litigation

In terms of systems, China’s public interest litigation system may play a crucial role. Article 55 of the Civil Procedure Law of 2013 created a public interest litigation system with Chinese characteristics,38 allowing relevant organizations to file lawsuits against environmental pollution, infringement of consumers’ rights and interests and other acts that harm public interests. In June 2017, the Standing Committee of the 12th National People’s Congress revised the Civil Procedure Law, adding paragraph 2 to Article 55,39 which made it clear that the people’s procuratorate may file a lawsuit with the people’s court if there is no authority or organization prescribed in the preceding paragraph or the authority or organization prescribed in the preceding paragraph does not file a lawsuit.

The promulgation of public interest litigation system enables group organizations to participate in litigation as parties, giving them the opportunity to protect groups and individuals. Moreover, in the legislative revision in 2017, the procuratorate, as a public authority organ, was also given the subject status of public interest litigation, and was placed at the end in order, acting as the gatekeeper of public interests. This legislative design shows China’s determination to protect social and public interests. Considering the current situation of insufficient protection of genetic data, and the resulting infringement of social public interests, China’s public interest litigation system has great application prospects, and should give full play to the role of this system.

Safeguarding the role of groups in benefit-sharing

For a long time, the global community has continuously explored the issue of benefit-sharing in genetic research. Despite these efforts, benefit-sharing in genetic research still faces many challenges, such as insufficient protection of the rights and interests of data providers, and difficulties for developing countries to fully benefit from international cooperation [65]. Numerous studies highlight the key role of "communities" in the sharing of biological benefits. For example, scholars point out that communities, as closely connected groups, can effectively coordinate individual and overall interests in genetic research [66]. Communities can organize members to participate in genetic research decision-making, ensuring that the research aligns with community values and interest demands [67]. Based on shared culture, traditions, and values, communities can effectively supervise genetic research, ensuring that research activities are conducted within the framework of ethics and morality [68].

From the perspective of group privacy, giving play to the key role of groups (communities) in benefit-sharing is an important solution. Currently, the benefits from genetic data disclosure are improperly allocated to genetic data collectors and processors—for instance, pharmaceutical manufacturers, which produce drugs based on genetic data analysis, almost monopolize all benefits. Admittedly, genetic data collectors and processors make significant contributions, but the contributions of genetic data providers and groups should also be recognized and appropriately rewarded. In this regard, individuals are in a weak position and usually struggle to safeguard their gene privacy interests, while groups can make up for the disadvantage of individuals in bargaining power. In addition, group privacy provides a new perspective on community construction: community is no longer limited to geography or ethnicity but can also form groups based on genetic characteristics that transcend geographical boundaries. Currently, there are several global associations for the protection against genetic discrimination, such as the Global Alliance Against Genetic Discrimination, which is committed to promoting the formulation of anti-genetic discrimination policies worldwide and safeguarding the rights and interests of genetic data owners. In the future, China should attach importance to implementing the crucial role of groups in ensuring benefit-sharing, and may consider taking the trade unions and consumer organizations mentioned above as key entities to safeguard the legitimate interests of worker groups, consumer groups, and genetic data providers.

Summary

Although the understanding of privacy may vary due to different factors such as region, history and religion, for example, previous studies have found that Western societies (such as South Africa, the United States, New Zealand and Australia) pay more attention to online privacy than other societies (such as Mexico, China and India) [69]. However, it is worth noting that people from different countries but similar geographical areas may also have similar beliefs about privacy because they share similar cultures. That is to say, cultural influence transcends national boundaries and forms a “regional culture” [70]. Specific to the new field of gene privacy, although there are differences in the understanding and protection methods, the particularity of genetic data has been recognized by countries all over the world, and it has become a consensus about the lack of Collectivism to protect genetic data and the concern about the leakage of gene privacy [71]. In this context, based on the popularity of gene sequencing services and big data applications, the fear of gene privacy leakage has impacted the individualism of privacy law, and started a new round of debate on the appropriate balance among individuals, groups and society [72]. While China has established a dual framework for safeguarding gene privacy through CCC and CPIPL, it lacks a comprehensive system design, relying primarily on the informed consent principle rooted in individualism. However, this approach has encountered numerous challenges in practice, necessitating urgent improvements. When improving genetic privacy protection in the future, China should shift its protection stance under individualism, attach importance to the crucial role of groups in gene privacy protection, and its existing organizational forms and public interest litigation system may play an important role in this process.

Abbreviations

CPIPL

The Personal Information Protection Law of the People’s Republic of China

CCC

The Civil Code of the People’s Republic of China

GDPR

The General Data Protection Regulation

HIPAA

The Health Insurance Portability and Accountability Act

GINA

The Genetic Information Nondiscrimination Act

EEOC

The U.S. Equal Employment Opportunity Commission

Authors’ contributions

Jiajv CHEN wrote the main manuscript text and Wei LI made substantial revisions and improvements.

Funding

This study is supported by the Sichuan Medical Law Research Center Project (No. YF24-Q04) and the Outstanding Innovative Talents Cultivation Funded Programs 2024 of Renmin Univertity of China.

Data availability

No datasets were generated or analysed during the current study.

Declarations

Ethics approval and consent to participate

Not applicable.

Consent for publication

Not applicable.

Competing interests

The authors declare no competing interests.