Regulation Of Outbreak Genomic Data Sharing Requirements Germany

Introduction

Outbreak genomic data sharing involves collecting, analysing and exchanging genetic sequence information about infectious pathogens during disease outbreaks. It helps public-health authorities identify emerging variants, investigate transmission routes, detect antimicrobial resistance and coordinate responses to infectious diseases.

In Germany, outbreak genomic data sharing is governed by the Infection Protection Act (Infektionsschutzgesetz – IfSG), the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and applicable European public-health legislation. The Robert Koch Institute (RKI) plays a central role in national infectious-disease surveillance.

Germany does not impose one universal obligation requiring every hospital or laboratory to share every pathogen genome. The legal obligation depends on the pathogen, reporting provisions, public-health requirements and the purpose of the data-sharing activity.

Legal Framework Governing Outbreak Genomic Data Sharing

1. Infection Protection Act (IfSG)

The IfSG establishes Germany's principal framework for infectious-disease reporting and surveillance.

Section 6: Requires notification of specified infectious diseases under the statutory conditions.

Section 7: Establishes laboratory notification obligations for specified pathogens.

Sections 8–10: Identify responsible persons and regulate notification procedures and information.

Section 11: Governs the forwarding of certain notifications through public-health authorities to higher authorities and the RKI.

Section 13: Provides a framework for additional epidemiological surveillance.

Section 14: Regulates electronic reporting and information systems.

These provisions allow public-health authorities to collect and evaluate information needed to monitor infectious diseases. However, reporting a pathogen under Section 7 does not automatically mean that its complete genomic sequence must also be submitted.

Additional sequencing and sharing obligations may arise from specific statutory requirements, competent-authority measures, surveillance programmes or institutional agreements.

2. Role of the Robert Koch Institute

The RKI is Germany's central federal public-health institution. It coordinates national infectious-disease surveillance, evaluates epidemiological information and provides scientific advice to public-health authorities.

During outbreaks, genomic information can help the RKI and collaborating laboratories:

Identify newly emerging pathogen variants.

Determine whether infections are genetically related.

Investigate possible transmission clusters.

Monitor mutations associated with antimicrobial resistance.

Support outbreak-control decisions.

Exchange relevant scientific information with European and international partners.

The RKI works with state health authorities, university hospitals, diagnostic laboratories and specialised reference centres. The precise legal basis for transferring identifiable information must still be established for each activity.

Data Protection Requirements

The General Data Protection Regulation (GDPR) is particularly important when genomic information is linked to identifiable patients.

Article 6 GDPR requires a lawful basis for processing personal data. Public-health authorities may rely on applicable statutory duties or public tasks where the legal requirements are satisfied.

Article 9 GDPR protects special categories of personal data, including health information. Processing may be permitted under Article 9(2)(i) for public-health reasons, subject to suitable safeguards and applicable legal requirements. Article 9(2)(j) provides a separate basis for qualifying scientific research.

Other relevant provisions include:

Article 5: Purpose limitation, data minimisation and storage limitation.

Article 25: Data protection by design and by default.

Article 32: Security of processing.

Article 35: Data protection impact assessments for high-risk processing.

A pathogen's genomic sequence is not automatically the patient's human genetic data. Nevertheless, when sequence information is linked to hospital records, patient identifiers or identifiable epidemiological details, data-protection obligations may apply.

The German BDSG supplements the GDPR, including through Section 27 concerning certain scientific research and statistical processing of special-category data.

European and International Data Sharing

Regulation (EU) 2022/2371 establishes a framework for cooperation concerning serious cross-border threats to health. It supports information exchange, preparedness and coordinated responses between EU Member States.

The European Centre for Disease Prevention and Control (ECDC) coordinates important European surveillance activities. Germany contributes relevant epidemiological and genomic information through applicable surveillance networks.

International sharing may also take place through the World Health Organization and other public-health initiatives. Where personal data are transferred outside the European Economic Area, GDPR Chapter V must be considered. Transfers require an applicable legal mechanism, such as an adequacy decision or appropriate safeguards.

The International Health Regulations (2005) also establish international notification and cooperation obligations for public-health events of international concern. They do not, however, create a universal requirement to disclose every pathogen genome.

Institutional Responsibilities and Enforcement

German hospitals, laboratories and public-health authorities must establish clear procedures for outbreak-related data handling. These should identify:

Which institution is responsible for collecting and sharing information.

The legal basis for each disclosure.

Whether patient-identifiable information is necessary.

Which researchers or authorities may access the data.

How long the information will be retained.

How data breaches and unauthorised disclosures will be handled.

Failure to comply with statutory notification or data-protection requirements may result in regulatory measures, administrative fines or other legal consequences, depending on the applicable provision and circumstances.

Relevant Case Laws

There is no leading German judgment specifically deciding the genomic data-sharing obligations of outbreak surveillance networks. However, the following decisions provide relevant legal principles.

1. Federal Constitutional Court – Census Act Decision (BVerfGE 65, 1, 1983)

The German Federal Constitutional Court recognised the constitutional right to informational self-determination. Public authorities must respect legal limits when collecting, linking and sharing personal information. This principle is relevant when outbreak genomic data are connected with identifiable patient records.

2. Z v Finland (Application No. 22009/93, 1997)

The European Court of Human Rights emphasised the importance of confidentiality in medical information under Article 8 of the European Convention on Human Rights. Its reasoning supports strong confidentiality safeguards when hospitals disclose patient information during outbreak investigations.

3. S. and Marper v United Kingdom (Applications Nos. 30562/04 and 30566/04, 2008)

The Court held that retaining DNA profiles and related personal information engages the right to privacy under Article 8. Although the case concerned forensic DNA databases, its principles are relevant to proportionality, retention and security in genomic information systems.

4. Digital Rights Ireland (Joined Cases C-293/12 and C-594/12, 2014)

The Court of Justice of the European Union invalidated the Data Retention Directive because its broad data-retention requirements disproportionately interfered with fundamental rights. The judgment provides relevant proportionality principles for large-scale digital surveillance, although it did not concern pathogen genomic data directly.

Conclusion

Germany regulates outbreak genomic data sharing through the IfSG, GDPR, BDSG and European public-health legislation. The RKI coordinates important national surveillance activities, while hospitals, laboratories and public-health authorities contribute to outbreak investigations. Statutory pathogen notification must be distinguished from the separate sharing of genomic sequences. Effective governance requires a clear legal basis, data minimisation, secure transfers, defined access rights and appropriate international cooperation.