Introduction

Regulation of anonymisation and de-identification standards for genomic data in China concerns the protection of individuals whose genetic information is collected, stored, analysed, or shared for medical research, biotechnology, and commercial purposes. Genomic data may reveal inherited characteristics, disease risks, family relationships, and information about biological relatives. Removing names and identification numbers does not necessarily prevent re-identification because genetic information can be compared with other datasets.

China regulates this area through the Personal Information Protection Law (PIPL), the Data Security Law, the Biosecurity Law, the Civil Code, and the regulatory framework governing human genetic resources. The central legal challenge is to enable legitimate scientific research while protecting personal privacy, data security, public health, and national interests.

Legal Framework for Anonymisation and De-identification

The Personal Information Protection Law, 2021, establishes the principal distinction between personal information, de-identified information, and anonymised information. Article 4 excludes anonymised information from the statutory definition of personal information. Article 73 defines de-identification as processing that prevents identification of a specific individual without additional information, while anonymisation requires that identification of the individual and restoration to the original state are no longer possible.

Consequently, replacing names with codes or separating identification keys does not automatically remove genomic data from the PIPL's scope. If the individual can still be identified using additional information, the data remain subject to applicable personal-information protections.

Articles 28–30 establish heightened requirements for processing sensitive personal information, including necessity, strict protective measures, and separate consent where required by law. Genetic information may qualify as sensitive personal information when it reveals biometric characteristics or medical and health information. Article 55 also requires a personal-information protection impact assessment for specified processing activities, including processing sensitive personal information and providing personal information to overseas recipients.

The Data Security Law, 2021, provides an additional framework for data classification, security management, and protection of data relating to national security and public interests. The Biosecurity Law, 2020, addresses biotechnology-related risks and human genetic resources, while the Civil Code, 2020, protects privacy and personal information through its personality-rights provisions.

Human Genetic Resources and Cross-Border Data Sharing

China's Regulation on the Administration of Human Genetic Resources (2019), together with its implementing rules adopted in 2023, governs the preservation, use, and international provision of human genetic resources. The framework protects donors' interests and regulates certain international collaborations and transfers of genetic information.

Anonymisation does not automatically exempt a genomic dataset from every human-genetic-resources requirement. The applicable obligations depend on the nature of the data, the activity, the participating institutions, and the relevant approval, filing, or security-review rules. Researchers must therefore assess privacy law and human-genetic-resources regulation separately.

Cross-border research involving foreign organisations or institutions may require specific approvals, filings, or security reviews. Institutions should not assume that removing direct identifiers eliminates these obligations. The Biosecurity Law also establishes controls relevant to the use and international provision of human genetic information.

These overlapping rules reflect two connected regulatory objectives: protecting individuals' information and safeguarding human genetic resources considered important to China's public health and national interests. <Cite refs={["turn572845search0","turn572845search2","turn572845search6"]}/>

<WritingBlock id="84162" variant="document">## Technical Standards and Institutional Compliance

China's national standards and technical guidance support the implementation of statutory data-protection duties. The Personal Information Security Specification, GB/T 35273-2020, provides guidance on personal-information processing, de-identification, anonymisation, and security safeguards. As a recommended national standard, it should not be confused with a statute imposing independent legal obligations in every circumstance.

For genomic databases, effective compliance should include removal of direct identifiers, separation of re-identification keys, access controls, encryption, audit logs, and periodic reassessment of re-identification risks. Researchers should also consider whether rare genetic variants, family pedigrees, geographic details, or linked clinical records could identify a participant.

Under Article 51 of the PIPL, processors must implement appropriate security measures, including classification, access controls, and technical safeguards such as encryption and de-identification. Article 56 requires impact assessments for specified high-risk processing activities and retention of relevant assessment records. These requirements make anonymisation part of a wider governance system rather than a one-time technical exercise. <Cite refs={["turn546240search1","turn546240search9"]}/>

Relevant Case Laws and Judicial Principles

1. Hangzhou Wildlife Park v. Guo Bing (2021)

In a widely reported Chinese personal-information dispute, Guo Bing challenged a wildlife park's demand that visitors use facial-recognition technology after the park had previously used fingerprint-based entry. The dispute raised questions about the collection of biometric information, consent, and the proportionality of data-processing practices. The Zhejiang courts addressed the dispute, and the case became an important reference point in discussions of personal-information protection.

Although it concerned facial recognition rather than genomic data, the dispute illustrates why removing identifiers or changing collection methods does not itself establish lawful processing. Genomic-data controllers must separately consider necessity, consent, proportionality, and the risks associated with sensitive biological information.

2. Personal-Information Network-Infringement Judicial Interpretation (2014, as amended in 2020)

The Supreme People's Court's judicial interpretation concerning civil disputes involving infringement of personal rights through information networks addresses unlawful online disclosure of personal information. Its principles are relevant where genetic information, medical records, or other sensitive data are disclosed without lawful justification.

For genomic databases, the relevant lesson is that removing names does not necessarily eliminate liability if the remaining information can identify a person or if disclosure otherwise infringes protected rights. The interpretation is a judicial instrument, not a judgment concerning a particular genomic dataset.

3. Personal Information Protection Law, Articles 69–70

Articles 69 and 70 establish important civil-liability and public-interest litigation mechanisms. Under Article 69, a processor that infringes personal-information rights and causes damage may be liable unless it can demonstrate the absence of fault. Article 70 permits specified eligible bodies to bring public-interest litigation where unlawful processing infringes the rights and interests of numerous individuals.

These provisions are directly relevant to genomic-data breaches and unlawful disclosure, although they are statutory provisions rather than reported case precedents. No specific reported Chinese judgment directly establishing a genomic-data anonymisation standard is identified here; the cases and judicial principles above should therefore be treated as analogous authorities rather than genomic-specific precedents. <Cite refs={["turn546240search2","turn546240search3"]}/>

Challenges and Future Legal Developments

Genomic re-identification risks continue to evolve as databases grow and analytical technologies improve. Data that appear anonymous today may become identifiable when linked with new genealogical, clinical, or population datasets. Another challenge is balancing scientific reproducibility and data sharing against confidentiality and restrictions on international access to human genetic resources.

Future regulatory development could benefit from clearer genomic-specific technical benchmarks, independent privacy assessments, risk-based standards for data release, stronger accountability for secondary use, and transparent rules for international research collaboration. Standards should also distinguish irreversible anonymisation from reversible coding systems and require reassessment when the intended use or available linking datasets change.

Conclusion

China's regulation of genomic-data anonymisation and de-identification combines the PIPL, Data Security Law, Biosecurity Law, Civil Code, and human-genetic-resources framework. The decisive distinction is that de-identified genomic information may remain personal information, whereas genuinely anonymised information falls outside the PIPL's definition of personal information. Even so, separate genetic-resource, biosafety, contractual, and security requirements may continue to apply. Effective compliance therefore requires technical safeguards, lawful processing, appropriate consent, re-identification risk assessment, and careful review of cross-border research arrangements. Judicial principles concerning biometric information and online privacy offer useful guidance, but genomic-specific judicial precedent remains limited.