Regulation Of German Infectious Disease Genomic Surveillance Networks

Introduction

Infectious disease genomic surveillance involves collecting and analysing the genetic sequences of viruses, bacteria and other pathogens to identify mutations, monitor disease transmission, detect emerging variants and support public-health responses. In Germany, these activities are important for monitoring infectious diseases such as influenza, COVID-19, tuberculosis and antimicrobial-resistant infections.

Germany does not regulate all genomic surveillance networks through one separate statute. Instead, their activities are governed by the Infection Protection Act (Infektionsschutzgesetz – IfSG), the General Data Protection Regulation (GDPR), laboratory regulations, public-health legislation and European Union rules. The principal national institution is the Robert Koch Institute (RKI), which coordinates important epidemiological surveillance and scientific activities.

Legal Framework Governing Genomic Surveillance

1. Infection Protection Act (IfSG)

The IfSG provides the main legal foundation for infectious disease surveillance in Germany.

Sections 6 and 7 establish notification requirements for specified diseases and pathogens. Depending on the disease or pathogen, physicians, laboratories and other responsible persons must notify the competent public-health authorities.

Section 11 regulates the transmission of certain notifications from local health authorities to the relevant state authorities and the RKI. Section 13 provides a framework for additional epidemiological surveillance. Section 14 concerns the electronic reporting and information system used for infectious disease surveillance.

These provisions support the collection and analysis of epidemiological information. However, mandatory notification of a disease or pathogen does not automatically mean that every pathogen's complete genomic sequence must be submitted. The legal basis and requirements for sequencing and transferring sequence data must be assessed separately.

2. Role of the Robert Koch Institute

The RKI is Germany's central federal public-health institution. It analyses infectious disease trends, coordinates surveillance activities and provides scientific information to public-health authorities.

Genomic surveillance can help the RKI and collaborating laboratories:

Identify emerging pathogen variants.

Monitor changes in pathogen characteristics.

Investigate transmission patterns.

Detect antimicrobial resistance.

Support outbreak investigations.

Inform public-health recommendations.

The RKI also collaborates with state laboratories, university hospitals, research institutions and international public-health organisations.

3. German Electronic Reporting and Surveillance Systems

The IfSG provides the statutory foundation for electronic infectious-disease reporting. The RKI's digital reporting infrastructure supports the exchange and evaluation of epidemiological information.

Genomic information may be linked with epidemiological information where legally justified. However, institutions must distinguish between identifiable patient data, pseudonymised clinical information and pathogen sequence data. A pathogen sequence is not automatically personal genetic data, although linked clinical and epidemiological information may identify an individual.

Data Protection and Research Governance

The General Data Protection Regulation (GDPR) is relevant whenever genomic surveillance involves identifiable or identifiable patient information.

Article 6 establishes lawful bases for processing personal data, while Article 9 regulates special categories such as health information. Article 9(2)(i) permits certain processing necessary for public-health reasons, subject to legal safeguards. Article 9(2)(j) provides a separate framework for scientific research under applicable legal conditions.

The German Federal Data Protection Act (BDSG) supplements the GDPR. Research institutions must apply appropriate safeguards, including:

Data minimisation and purpose limitation.

Pseudonymisation where appropriate.

Restricted access to patient information.

Secure storage and transfer systems.

Defined retention periods.

Data protection impact assessments where Article 35 GDPR applies.

International sharing of genomic surveillance information must also comply with GDPR Chapter V when personal data are transferred outside the European Economic Area.

European and International Cooperation

German genomic surveillance networks operate within wider European public-health cooperation.

Regulation (EU) 2022/2371 on serious cross-border threats to health establishes a framework for cooperation, preparedness and response among EU Member States. The European Centre for Disease Prevention and Control (ECDC) coordinates important surveillance and risk-assessment activities.

Germany also contributes to international pathogen surveillance initiatives through cooperation with the World Health Organization and other public-health organisations. Such cooperation supports the identification of emerging variants and the comparison of pathogen sequences across countries.

International cooperation does not remove national requirements concerning confidentiality, data protection or the lawful transfer of patient information.

Relevant Case Laws

There is no leading German judgment specifically governing infectious-disease genomic surveillance networks. Nevertheless, the following decisions establish important principles relevant to their operation.

1. Federal Constitutional Court – Census Act Decision (BVerfGE 65, 1, 1983)

The German Federal Constitutional Court recognised the constitutional right to informational self-determination. Individuals must receive protection against unjustified collection and use of personal information. This principle is important when genomic surveillance links pathogen sequences with identifiable patient records.

2. S. and Marper v United Kingdom (Applications Nos. 30562/04 and 30566/04, 2008)

The European Court of Human Rights held that retaining DNA profiles and related personal information engages the right to privacy under Article 8 of the European Convention on Human Rights. Although the case concerned forensic databases, its reasoning is relevant to safeguards governing genetic and biological information.

3. Z v Finland (Application No. 22009/93, 1997)

The European Court of Human Rights emphasised the importance of confidentiality in medical information. The judgment supports strict safeguards when genomic surveillance networks use patient health records or information that could reveal an individual's identity.

4. Digital Rights Ireland (Joined Cases C-293/12 and C-594/12, 2014)

The Court of Justice of the European Union invalidated the Data Retention Directive because its broad and insufficiently controlled retention requirements interfered disproportionately with fundamental privacy rights. The judgment provides relevant proportionality principles for large-scale public-health data systems, although it did not concern pathogen sequencing.

Conclusion

German infectious disease genomic surveillance networks operate under the Infection Protection Act, GDPR, BDSG and relevant European public-health legislation. The RKI plays a central role in coordinating surveillance and analysing pathogen information. The legal framework supports the collection and exchange of epidemiological and genomic data while requiring confidentiality, proportionality and secure processing. Importantly, mandatory pathogen notification does not automatically create a universal obligation to submit every genomic sequence. Effective governance therefore requires a clear legal basis for each stage of data collection, sequencing, storage and sharing.