Issues of legislative regulation in the field of human genetic data

INTRODUCTION

The widespread adoption of genetic research leads to the accumulation of a large volume of medical and personal data, the storage of which poses multiple ethical and legal risks. The current Russian legislative acts do not take into account specific features of this kind of information and, therefore, cannot provide for an adequate level of protection of such sensitive data. The existing discrepancy between progress in the field of genetic technologies and legislation regulating the data obtained may result in numerous legal disputes in the nearest future. Therefore, an immediate but balanced solution to the problem is necessary. This article discusses issues related to modern legislation in the field of regulating genetic data circulation, as well as probable challenges that may arise in the nearest future.

The key findings of the study:

• in Russia, a significant discrepancy between advancements in genetic technologies and legislation regulating the resulting data continue to exist;
• one of the most pressing issues is the lack of a unified terminology when defining the object of genetic data protection;
• the growing number of genetic studies and databases highlights the urgency of adequate regulation in this field;
• multidisciplinary teams consisting of lawyers, physicians, genetics scientists, and biotechnology experts should be formed to develop comprehensive legislative acts based on modern scientific know­ledge.

Genetics (and clinical applications thereof) is one of the fastest-developing fields in biomedical science. Accessibility of laboratory and bioinformatic methods allowing decoding and interpretation of nucleic acid sequences leads to exponential growth in the volume of genetic information.¹ Its use spans widely, from diagnosing hereditary diseases to forensic medicine for identifying individuals.² Naturally, such data demands special protection and proper storage, since the human genome carries information about disease predispositions, ethnic affiliation, and other individual traits of both the person and their relatives [1]. Opportunities created by advanced technologies, big data, and applied scientific research pose fundamentally new challenges, giving rise to unprecedented risks that lie both in the medical and legal domains.

It should be noted that the rapid advancement of technological capabilities is accompanied by the growing demand for genetic tests, including commercial ones. According to media reports, in 2021 compared to 2020, companies in Russia specializing in genetic testing experienced a sales increase from 15% to 250%.³ According to the report by the Innovation Agency of Moscow published in September 2023, the market for genetic testing services has been expanding annually since 2021. In 2023, the estimated market size in Russia reached approximately 192.3 million US dollars. From 2021 to 2022, the market witnessed a significant surge, increasing by 16% from 2.5 billion rubles to 2.9 billion rubles. Over the next five years, the market is forecasted to grow annually by an average of 15.3%, having potentially reached 5 billion rubles by 2025.

These trends underscore the rising demand for genetic testing services in Russia, driven by technological advancements and consumer awareness of personalized healthcare solutions.⁴ Following the completion of the COVID-19 pandemic in 2022–2023, the popularity of this service declined somewhat; however, many consulting companies express optimistic views on the development of the genetic testing market. According to some sources, it may grow from approximately 19.6 billion US dollars in 2023 to 65.03 billion US dollars in 2034, with the greatest growth occurring in the Asia-Pacific region⁵.

Unfortunately, the adequacy of protection for genetic data received by clinics and laboratories remains open to question. The situation that arose in October 2023 with one of the world’s largest operators of genetic data — the American company 23andMe — when the data of nearly seven million users was stolen from the company’s servers and subsequently sold on the black market,⁶ highlights the acute problem of securing information about human genetic characteristics. Apart from reputational losses, the company did not bear any real legal liability, demonstrating the imperfections of the current legislative regulation.

Obviously, the sensitivity of genetic data as an object of legal protection requires the creation of specialized legislative acts regulating the collection, processing, and storage of such information [2]. At present, however, the development of science, as a whole, and genetics, in particular, is outpacing updates to the corresponding legal framework. Legal acts regulating the rules for storing information in medical institutions (including physician–patient privilege) and laws on the protection of personal data are partly applicable to genetic data; however, as practice shows, they are unable to fully ensure an adequate level of security [3].

In the context of creation of a reliable legal framework for regulating work with genetic data and ensuring their security, the development of a categorical and conceptual framework is of particular importance. Such a framework should consider the variety of genetic data types and their application purposes. Given that this task cannot be solved without understanding deep biological fundamentals, it becomes obvious that close collaboration between legislators and specialists from various fields of knowledge, such as biomedicine, bioinformatics, and biotechnology, is necessary.

All across the globe, specialized bills aimed at regulating various aspects of work with genetic information (collection, processing, storage), and most importantly, ensuring data protection, are being developed and adopted. At the same time, recent emerging challenges have led to a reassessment and updating of both general perspectives on the safety of genetic data and corresponding legal frameworks.

MATERIALS AND METHODS

The search for scientific literature was conducted in electronic bibliographic databases in the Russian (eLibrary, CyberLeninka) and English (Google Scholar) languages. Normative documents were retrieved from the ConsultantPlus legal reference system (Russia) and using official websites of governments of different countries. The article reviews the situation in the legislative field of Russia and abroad regarding genetic information protection at the beginning of 2025.

The eLibrary, CyberLeninka, and Google Scholar databases were searched using the following keyword phases: “legal regulation of genetic data” and “laws in genetics.” In terms of depth, the search included scientific papers published from 2010 up to the present. The analysis also included publications and legislative acts describing legal relations in the field of circulation of genetic data obtained from humans.

Using the query “methods of genetic testing,” scientific publications dating back to 1990 until the present were retrieved. Publications describing methods used in today’s genetic testing were included in the analysis.

RESULTS AND DISCUSSION

Types of genetic information subject to legal regulation

When developing regulations governing the handling of genetic data, it is essential to determine exactly which types of data require protection. Our research revealed that this question remains a key point of disagreement between the current legislative acts and genetics as a science.

From a biological perspective, the molecule of deoxyribonucleic acid (DNA) contained in the nucleus (nuclear DNA) and mitochondria (mitochondrial DNA) of a human cell serves as the primary carrier of inherited, i.e., genetic, information. DNA consists of numerous constituent elements referred to as nucleotides, the sequence of which encodes information. Collectively, all DNA molecules in a cell (approximately three billion nucleotides) constitute the genome. Each person’s DNA sequence is unique (except for identical twins) and is determined at conception. Throughout one’s lifetime, mutations may occur in DNA, but only at the level of individual cells, not the entire organism. Hence, DNA sequencing can serve as a tool for identifying individuals. Simultaneously, certain genetic variants are associated with the development of specific hereditary diseases, making DNA sequences clinically valuable. Nuclear DNA exists not as a single molecule but as 46 distinct chromosomes; deviations from this standard number represent clinically significant information, as they are linked to certain syndromes (such as Down syndrome).

However, DNA is not the sole carrier of genetic data. The realization of information encoded in DNA occurs through sequential reading of nucleotides and synthesis of ribonucleic acid (RNA) during transcription. The collective term for all RNA molecules in a cell is the transcriptome. Transcription occurs not from the entire DNA molecule but from specific segments known as genes. Different levels of gene activity result in varied copy numbers of individual RNAs: transcription of some genes may intensify when needed, while others diminish. Moreover, the activity of information readout from different DNA regions can additionally be regulated by epigenetic modifications within the DNA molecule itself (e.g., DNA methylation) and surrounding molecules (such as histone protein acetylation, which maintains DNA in a compact state). The sum of such modifications, in the case of DNA methylation, is referred to as the methylome. Both the transcriptome and methylome, alongside other epigenetic markers, can change over time and reflect an individual’s current state, biological age, and environmental influences, making them vital clinical indicators. Some of these data can also be used for identifying individuals, albeit with a greater complexity compared to DNA analysis.

Thus, biologists define genetic information as encompassing details about the sequence of nuclear and mitochondrial DNA, the transcriptome, the proteome (the complete set of proteins produced by an organism), the methylome, and other epigenetic modifications.⁷ In its guidelines, the World Health Organization (WHO) also emphasizes that genetic data encompasses everything listed above and that this list is not complete,⁸ since the advancement of technologies for obtaining and analyzing genetic data may lead to its expansion and enrichment.

It is important to recognize that the analysis of genetic information can involve highly different degrees of data detail: technical capabilities of laboratories allow for both determining nucleotide sequences (of DNA or RNA) and simply counting the total number of chromosomes. Each method differs in its approach to sample preparation, equipment, consumables, data analysis techniques, etc.

One of the simplest and quickest methods for detecting the presence of a target nucleotide sequence in the human genome is polymerase chain reaction (PCR). This method relies on repeatedly amplifying copies of a specific DNA fragment, usually 100–1000 nucleotides in length. The resulting fragments are visualized using gel electrophoresis to determine the length of the fragment [4]. When it is necessary to quantify the number of copies of the target DNA fragment, a variation referred to as real-time (quantitative) PCR is used. While PCR alone does not reveal nucleotide sequences, it can be applied for identifying individuals (e.g., paternity testing and forensics) and measuring the abundance of specific RNA transcripts [5].

In order to accurately determine or “read” the sequence of DNA or RNA, various sequencing methods are used. Among the most common are Sanger sequencing, NGS (Next Generation Sequencing), and nanopore sequencing. In Sanger sequencing, the nucleotide sequence of a strictly predefined target DNA fragment, typically 500–1000 nucleotides long, is determined [6]. NGS refers to a group of methods capable of simultaneously determining the sequences of many (up to billions) random short DNA fragments, each 50–300 nucleotides in length. Depending on sample preparation and the purpose of analysis, NGS can provide information about sequences of varying lengths (even complete genomes), although requiring preliminary fragmentation [7]. Nanopore sequencing enables the determination of both short and long nucleotide sequences. Its distinct feature is the ability to analyze multiple long sequences without prior genome fragmentation, enabling individual sequences to reach up to 100,000 nucleotides in length [8].

DNA microarrays fall between PCR and NGS methods in terms of utility. Similar to PCR, when using DNA microarrays, exact nucleotide sequences should be preselected in the sample. However, the scale of positions detected simultaneously can sometimes rival NGS and act as a substitute for this technology. With DNA microarrays, it is possible to identify tens to hundreds of thousands of individual positions in the genome and determine whether specific short sequences (~100 nucleotides) are present in the sample [9].

Light microscopy is the simplest, fastest, and most affordable method for assessing the number, size, and shape of chromosomes (without extracting DNA sequence information). To that end, chromosomes are isolated from cells at a specific lifecycle phase, stained, and examined under a microscope.

Table 1 summarizes the main ways of utilizing the information obtained through the aforementioned methods.

Thus, genetic information encompasses a broad spectrum of data obtained through various methods, and all possible types of genetic information should be protected legally in accordance with their significance and sensitivity. Clearly, lawmaking should adopt such definitions of “genetic information” and “genetic data” that would align with those established in the scientific community. However, current legislative acts display significant flaws in their terminological framework, leading to the corresponding legal implications.

Federal Law No. 242-FZ⁹ employs the term “genomic information,” referring to “personal data comprising coded information about specific fragments of deoxyribonucleic acid belonging to a physical person or an unidentified corpse.” In this context, it is important to note certain discrepancies in the use of this term. As mentioned earlier, the concept of “genome” implies information about the complete DNA sequence in a cell, whereas under the framework of state genomic registration, only short tandem repeats (STR, Table 1) are considered. This allows for the identification of an individual or their relatives but does not provide information about their genome or the traits they may possess (including the risk of developing diseases or other characteristics). Thus, the term “genomic information” used in Federal Law No. 242-FZ¹⁰ does not correspond to the biological essence of the subject matter of legal protection, lacks universality, and serves specific purposes of this law. Nevertheless, this legislative act clarifies that in the legal sphere, genetic data that can restore an individual’s identity should be regarded as personal.

At the same time, Article 11, Paragraph 1 of the Federal Law “On Personal Data”¹¹ states that “information characterizing physiological and biological features of a person, based on which their identity can be established (biometric personal data), and which is used by the operator to verify the identity of the subject of personal data, may only be processed if written consent from the subject of personal data is obtained.” In this part of the law, the concept of “biometric personal data” is indirectly introduced. Paragraph 2 of Article 11 indirectly specifies what data can be classified as biometric, mentioning, for instance, the processing of biometric personal data in connection with mandatory state genomic registration.¹² However, the terms “genetic data” and “biometric personal data” cannot be equated, since the latter is broader and also includes fingerprints, facial images, and other types of data.

Currently, the most comprehensive definitions of “genetic data” and “genetic information” are provided in Federal Law No. 643-FZ, which has come into force.¹³ In the document, within the description of the legal framework for the functioning of the Russian State Information System in the field of genetic data — the National Database of Genetic Information — a definition of “genetic data” is introduced as “the information about the genetic information of various biological objects represented in a format suitable for obtaining, organizing, accumulating, storing, refining, using, distributing, and destroying such information.” Additionally, the meaning of the term “genetic information” is clarified as “the sequence of nucleotides in nucleic acid polymers,” which is the most accurate biological definition, considering not only DNA but also RNA. However, it is important to note that the mentioned information system does not include genetic data obtained from humans, which are actually more sensitive than data obtained from other organisms (plants, animals, bacteria, etc.), since such information can be used for identifying individuals and assessing their characteristics. Although the terminological framework used to describe genetic information obtained from different species is the same, the sensitivity of data obtained from humans prevents extrapolation of the provisions of Federal Law No. 643-FZ¹⁴ to databases containing information about human genetics. Currently, genetic information in the context of human research is not viewed as a general concept but is presented as different types of genetic data, completely unrelated to each other, governed by separate legislative acts.

Legal framework for genetic data in Russia

When discussing the circulation of genetic data, it typically refers to the collection, storage, and dissemination of information obtained from individuals, including its transfer abroad. Within the current Russian legal framework, there is no single legislative act regulating the circulation of all types of genetic data that can be obtained from humans. Interaction with specific types of genetic data is regulated by three federal laws: No. 323-FZ¹⁵, No. 242-FZ¹⁶, and No. 152-FZ¹⁷. The respective areas of application of these legislative acts and the types of genetic information they may apply to are summarized in Table 2.

Genetic information as part of personal data

Genomic information is most frequently treated as an example of personal data, with this trend persisting both in Russia and globally. This approach is valid when the obtained genetic data can be used to identify an individual, i.e., retrieved by appropriate methods (Table 1). In this context, cases involving the acquisition of complete (genome) or nearly complete (exome) DNA sequences can be considered, where such research is conducted either for scientific purposes or at the request of an individual through commercial entities offering genetic testing services aimed at finding relatives, determining lineage, creating a “genetic passport,” and assessing genetic risks across extensive panels that simultaneously examine a large number of genetic loci. The results of DNA sequencing are processed in accordance with Federal Law No. 152-FZ¹⁸, which aims to protect citizens’ rights and freedoms when their personal data is handled, including respecting their privacy. According to this law, every operator of personal data must obtain written consent from the data subject for processing actions, including collecting, recording, organizing, accumulating, storing, updating (modifying), retrieving, using, transmitting (disseminating, granting access), depersonalizing, blocking, and fully deleting personal data.

In October 2019, the State Duma passed in the first reading a bill proposing amendments to Article 11 of the Federal Law “On Personal Data”¹⁹ concerning the processing of biometric personal data. The bill sought to strengthen the protection of genetic data obtained from individuals. The authors of the bill also highlighted gaps in the legislation “regarding the protection of information about a person obtained from their biomaterial, which contains genetic information that can provide additional insights (about health status, nutrition, lifestyle, behavioral traits, sensitivity to pharmaceutical drugs or allergens, and other individual characteristics).” However, in 2023, the State Duma of the Russian Federation rejected this bill in the second reading.²⁰

In scientific research, each participant signs a consent form agreeing to participate in the study and permitting the processing of personal data, thereby authorizing the operator (research institution) to carry out a full range of activities with all provided information, including genetic data, within the declared research objectives. Often overlooked is the fact that expanding research objectives, performing new genetic analyses, or publishing such results (either raw genetic data in anonymized form or aggregated statistical analysis results) may necessitate updating the signed consent. In the case of commercial genetic testing, the terms of personal data processing are typically outlined in the Privacy Policy, which participants accept, automatically granting consent for processing genetic data. It is important to note that accepting the Privacy Policy often implicitly grants permission for sharing genetic test results for scientific purposes (mandatory in anonymized form).

State genomic registration

The use of genetic data for state genomic registration also implies treating this information as personal data and is regulated by Federal Law No. 242.²¹ Under this law, the operators responsible for collecting the “genomic information database” and the specific purposes of registration are clearly defined. Thus, “genomic information” is used for crime prevention, detection, and investigation; identifying perpetrators; searching for missing Russian citizens, foreign nationals, and stateless individuals residing or temporarily staying in Russia; identifying deceased individuals whose bodies cannot be recognized by other means; and establishing familial relationships of searched-for individuals. This information is stored for approximately 70 years before being destroyed (Articles 12 and 16 of the Federal Law²²).

Processing rules for the collected data are established by the Ministry of Internal Affairs of the Russian Federation. Accounting, storage, and classification of genetic data obtained during compulsory state genomic registration of convicted individuals serving sentences are managed by the Federal State Institution “Expert Criminalistic Center of the Ministry of Internal Affairs of the Russian Federation” through the creation and maintenance of a federal genomic information database. Currently, genomic registration is mainly conducted using STR typing by licensed laboratories.

Furthermore, on November 7, 2024, amendments to migration-related legislation concerning genomic registration of foreign citizens and stateless individuals came into effect. Federal Law No. 253²³ “On Amendments to Certain Legislative Acts of the Russian Federation,” dated August 8, 2024²⁴, introduced adjustments to the Federal Law, stipulating that migrants may undergo voluntary genomic registration. The law permits migrant identification using the corresponding genomic database of the Ministry of Internal Affairs. Authorized parties, including courts, investigative agencies, inquiry bodies, and departments conducting operative-search activities, can utilize the collected genomic information database (Article 15, paragraph 1). This database can also be transferred overseas provided that there are relevant international agreements (Article 15, paragraph 2). Presidential directives issued following a meeting of the Council for Civil Society and Human Rights Development on February 7, 2025, mandate an assessment of the feasibility and appropriateness of implementing mandatory genomic registration for military personnel.²⁵ Responsibility for evaluating the necessity of the procedure and preparing proposals for necessary legislative amendments falls jointly on the Russian Defense Ministry and other agencies, including the Ministry of Internal Affairs as the primary operator of the database. Thus, the Federal Law “On State Genomic Registration”²⁶ addresses a specific scenario of using genetic information for the needs of the Ministry of Internal Affairs and cannot be extended to other instances of collecting and processing genetic data.

Genetic data as part of medical information

Genetic data is not always considered personal data [10]. When conducting clinical genetic tests to evaluate the inherent risks of developing various diseases, it is possible to determine the sequence of DNA regions that are insufficient for identifying an individual (individual genome locations or short DNA fragments). It is important to clarify that, in the event of genetic testing in a medical facility and signing a contract for “Provision of Medical Services.” The information gathered during the service is deemed medical, and its processing is regulated by Federal Law No. 323-FZ,²⁷ although the document does not introduce the concepts of “gene,” “genome,” or “genetic information” [11]. In this case, genetic information cannot be freely distributed, as constituting medical confidentiality (Article 13 of Federal Law No. 323²⁸). It should not be disclosed to third parties without patient consent (with exceptions, including requests from investigative and prosecutorial authorities) [12]. Use of data for scientific purposes and publication in scientific journals is permissible only with the patient’s explicit consent.

Neither the procedure for collecting, nor procedures for processing and analyzing genetic information, are explicitly described in the legislative acts mentioned above. However, it is implied that the transfer of biological samples for obtaining genetic data is voluntary, except for special cases related to registration, such as certain prisoners.

In summary, Russian legislation is currently lacking a document that could comprehensively regulate the circulation of genetic information obtained from humans. In the context of growing importance of genetic research and genetic technologies in Russia, it appears highly relevant to establish working groups advocating legislative initiatives in this area. For example, a working group on regulatory legal governance in the field of genetic technologies has been operating under the auspices of the Federal Scientific and Technical Program for the Development of Genetic Technologies for 2019–2030 with the purpose of discussing current legal initiatives in genetics. The Kutafin Moscow State Law University hosts a structural unit — the Scientific and Educational Center for Legal Support of Bioeconomy and Genetic Technologies — whose mission includes preparing proposals for improving Russian legislation in the field of development and application of genetic technologies. Following extensive discussions in November 2024, these groups proposed first draft bills that predominantly regulate the application of genetic technologies in agriculture, barely touching upon the biomedical direction.

International practices in legal regulation of genetic data handling

As mentioned earlier, genetic information is classified as personal data and is regulated by relevant laws in most countries worldwide [13]. However, due to the need for a more thorough approach to protecting genetic information, there is a global trend toward developing specialized legislative acts [14]. For instance, in 2018, the European Union (EU) adopted the General Data Protection Regulation (GDPR)²⁹. The Regulation, firstly, defines genetic information as a type of personal data, and secondly, establishes a strict confidentiality regime for its handling [15].

Genetic research, as well as the storage and processing of genetic data in different EU countries, is regulated by local personal data laws, with significant variability noted in the legal frameworks³⁰ [16]. In some countries, specific laws on genetic research have been adopted, defining which actions, under what conditions, and for what purposes can be carried out during genetic research. For example, in Portugal, the Law No. 12/2005 of 26 January on Personal Genetic Information and Health Information³¹ protects the confidentiality of genetic information. According to this document, access to genetic data is limited to a narrow circle of individuals with the highest level of authorization. The law also provides a definition for genetic databases and establishes the legal procedure for their creation. Furthermore, this document restricts the availability of genetic testing and prohibits discrimination against individuals based on genetic information/the fact of having a genetic disease, which also applies to the activities of insurance companies.

The law also regulates the conduct of scientific research on the human genome and the establishment of biobanks.

In Hungary, “XXI Law on the Protection of Human Genetic Data, on the Rules of Human Genetic Testing and Research and Operation of Biobanks” (2008) has come into force [17]. This law aims to protect genetic information, establishes procedures for the processing of genetic data, sets conditions for the use of this information in scientific research, and regulates the rules for the creation and operation of biobanks.

Specialized laws on genetic research have also been adopted in a number of other countries, including Germany,³² Spain,³³ etc. Furthermore, many governments have enacted a series of specific regulatory legal documents for the application of genetic technologies in humans. These include so-called embryo protection laws (e.g., in Germany³⁴), which define the permissible boundaries for research and genetic testing on embryos and impose a ban on modifications of the germline.

It is noteworthy that many countries focus on developing legislative norms and regulating the establishment of biobanks, which limits the range of entities permitted to collect, store, and process genetic information. Biobanks that obtain special authorization operate for specific purposes and under the strict supervision of state authorities. For instance, in Latvia, prior to the launch of the national project,³⁵ the “Human Genome Research Law”³⁶ was adopted, which is distinguished by a greater clarity and a comprehensive approach. Specifically, it stipulates that the use of the database is permitted only for scientific purposes, disease research, and population health studies. Similarly, in Estonia, a separate law was developed to regulate the operations of the national Estonian Biobank and human gene research.³⁷ The main operator of the biobank is defined as the University of Tartu, which may delegate its rights to national organizations that have obtained the corresponding authorization.

In the United States, there is no single federal law regulating all aspects of genomic research. Specialized acts that govern specific procedures for ensuring the safety of human genome research pertain to the protection of personal genetic information, provision of genetic testing services, and prohibition of genetic discrimination. It is important to note that in the United States, the vast majority of organizations conducting genomic research are non-governmental, and oversight of their activities is carried out in accordance with state-level local legislation. Some states have their own laws that include provisions on genome confidentiality, providing additional protection for genetic information (Genome Statute and Legislation Database³⁸). Among the states that regulate the conduct of genetic tests or the obtaining of genetic information, 21 permit the research use of genetic information under specific conditions that eliminate the possibility of personal identification. For instance, the genetic data protection law enacted in California³⁹ defines the types of data that companies performing genetic testing are allowed to process.

The primary law in the United States for the protection of genetic data is the Federal Health Insurance Portability and Accountability Act (HIPAA).⁴⁰ Since 2013, a provision has been in effect stating that genetic information holds the status of Protected Health Information (PHI). However, commercial genetic testing conducted by private companies such as 23andMe and Ancestry is not considered a healthcare activity and, therefore, does not fall under the purview of HIPAA.

The most important specialized regulatory act governing the handling of genetic information in the United States is the Genetic Information Nondiscrimination Act (GINA), enacted in 2008⁴¹. It aims to protect the American population from genetic discrimination in the areas of health insurance and employment. The act also includes provisions concerning the conduct of genetic and genomic research. It outlines the obligations of research organizations to inform participants about potential consequences and measures taken to ensure confidentiality.

In recent years, China has been actively developing its regulatory framework to govern the management of genomic information.⁴² In 2019, with the aim of strengthening the protection of the population’s genetic data and tightening control in this field, the “Regulations on the Management of Human Genetic Resources” were adopted⁴³. According to these regulations, genetic resources are defined as materials (organs, tissues, cells) containing human genes and data obtained during genetic research. It is noteworthy that the authority to regulate the field of genomic research is vested in the Ministry of Science and Technology of the State Council of China (Article 4 of the PRC “Regulations on the Management of Human Genetic Resources”). Thus, in China, it is the state that is responsible for the rational use of genetic data in scientific research or medical activities [18]. It is also important to note that the collection, storage, use, and transfer of genetic materials by foreign organizations are prohibited, as well as the commercial use of human genetic material. Although the Chinese approach to ensuring the security of genetic research largely resembles global practices (mandatory obtaining of voluntary informed consent), human genome research in China is subject to stricter state control.

Thus, specialized regulatory legal acts in the field of genetic information protection are being actively developed and adopted in many countries worldwide. It can be seen that the introduction of new legislative acts alongside general legal instruments is largely connected with the establishment of biobanks and genetic information databases.

Genetic databases as an object of legal protection

With the increasing volume of accumulated genetic information, the subject of discussion has extended to include the legal regulation not only of the handling of individual genetic data but also of the creation and use of genetic databases containing research results from large numbers of people. The world’s largest biobanks possess genetic data derived from various biological samples, with the number of included participants ranging from several hundred thousand to several million.

For instance, the UK Biobank,⁴⁴ which aims to improve the prevention, diagnosis, and treatment of a wide range of diseases, includes 500,000 participants and currently represents a powerful resource for the scientific community. The Chinese Kadoorie Biobank (Kadoorie Study of Chronic Disease in China, KSCDC⁴⁵) includes over 510,000 participants; the Finnish FinnGen⁴⁶ project targets 500,000 participants; and the Estonian Biobank⁴⁷ aims for 200,000 participants. The US “All of Us” Biobank⁴⁸ expects to reach a cohort of one million or more volunteers within its broad-spectrum disease research program. The Shanghai-based commercial Zhangjiang Biobank⁴⁹ has announced a target of 10 million samples. The Zhangjiang Biobank utilizes integrated high-throughput research platforms for the analysis of genomic, transcriptomic, and proteomic data to develop tools for the diagnosis and early screening of various diseases.

Most biobanks are involved in nationally government-funded healthcare research. As noted earlier, the establishment of large biobanks often stimulates the development of a regulatory framework that governs their operations and ensures data protection [19]. However, to date, genetic information databases have been established and continue to be expanded not only within specialized biobanks but also across various scientific, medical, and commercial organizations, including in the Russian Federation.

Thus, the creation of Russian bioinformatic and genetic databases is one of the goals of the Federal Scientific and Technical Program for the Development of Genetic Technologies for 2019–2030⁵⁰. Consequently, their number will steadily increase.

The distinction between a genetic database and the medical and registry information discussed earlier lies in the complete anonymization of the stored information. Databases collected within research projects are not intended to store genetic and other personal data jointly. However, at present, this approach is established more at the level of ethics than legislation. Furthermore, genetic databases represent so-called “big data” arrays — vast amounts of information whose secure storage requires specialized tools and a developed technological infrastructure. The latter is also important because, even when this information is inaccessible to end-users such as research institutions and biomedical specialists, the database operators often possess not only a wide range of supplementary information about each individual whose genome is available but also other data that can unequivocally reveal a substantial layer of information and identify both the individual and potentially their relatives.

Therefore, the protection of genetic databases must be organized at a high technological level and have a clear legislative algorithm for safeguarding. Currently, legislative regulation exists for only one specific database — the “National Genetic Information Database,”⁵¹ which does not collect genetic data obtained directly from humans. Given the anonymized nature of the data collected in such databases, the protection regimes inherent to personal or medical data cannot be applied to them. Consequently, they must occupy a distinct position within the legal framework.

It is important to note that there exist other types of databases which collect information about the distribution of genetic variants within specific populations (for example, dbSNP⁵² — the database of the US National Center for Biotechnology Information), rather than about individuals. In Russia, an example of such a database is the Database of Population Frequencies of Genetic Variants of the Russian Federation Population (Genetic Data Base, GDB)⁵³, published in October 2024, whose operator is the Centre for Strategic Planning of the FMBA.

This database contains information on the frequency of occurrence of over 550 million genetic variants, obtained from whole-genome sequencing data with over 30x coverage from a sample of 120 thousand individuals collected across 85 regions of the Russian Federation. Despite using the results of human whole-genome sequencing, the data compiled in the GDB are fully depersonalized. The epidemiological study conducted as part of the GDB project ensured complete participant anonymity, and the sample collection and delivery protocol eliminated any possibility of identification. Furthermore, the database itself does not contain data on the linkage (co-occurrence in an individual) of genetic variants, thus not revealing which genetic characteristics are specific to a particular person. Instead, it provides aggregated statistical information on the frequency of genetic variants within the Russian population.

Databases, such as the GDB, cannot be used to identify the specific individuals whose data contributed to their creation. However, they contain a vast amount of information about the population structure of the Russian Federation: the proportion of carriers of pathogenic variants, the distribution of frequencies of various mutations, ethnic composition, and other details that can be gleaned from genome analysis.

Consequently, the issue of regulating the creation, storage, and distribution of genetic databases remains to be resolved. Legal discussion has proposed solutions regarding the need to apply a secrecy regime to genetic big data to exert greater control [20]. In this article, the authors proposed “drawing an analogy with the existing regime for geodetic, topographic, and cartographic information, where some data is classified as a state secret, and some as official information with limited distribution” [20].

However, it is crucial to consider that genetic information databases hold significant value for clinicians and the scientific community. Equating genetic data to a state secret would impose severe restrictions on scientific research and the development of biotechnology as a whole. It would also limit access to information necessary for physicians to make informed decisions (for instance, regarding the prevalence of a particular variant in the population), consequently leading to a decline in the quality of medical care and a slowdown in the overall progress of medicine.

Thus, it is necessary to distinguish between approaches to ensuring the protection and confidentiality of genetic information of a particular individual within healthcare delivery or personal use and the protection of genetic information databases containing anonymized data of individuals for research and clinical purposes [21]. For scientific research, freedom to study genetic information should be ensured, rather than freedom to use and disseminate such information without constraints [22][23].

CONCLUSION

In Russia, there currently exists a significant dissonance between the progress in genetic technologies and the legislation regulating the resulting data. Thus, neither unified law regarding genetic data, nor subordinate legal acts regulating this issue, nor commissions overseeing this process have been created. The absence of a unified conceptual framework and the multitude of grey areas in the legal regulation of various types of genetic data could lead to serious legal problems, not to mention ethical, deontological, and other issues beyond the scope of the current discussion.

Meanwhile, the urgency of this matter is steadily increasing: each year sees the emergence of more Federal-scale genetic projects. Consequently, legislation governing the relations arising in this context is gradually beginning to develop. As noted in this article, we are currently witnessing the emergence of new legislative initiatives in the field of genetic information management. As researchers, we support this observed trend. The development of such documents must necessarily account for all the shortcomings of existing approaches to legal regulation in this field, identified in our research.

The main directions for development could be as follows:

• defining the types of genetic data subject to legislative regulation and incorporating the relevant concepts into legislative acts;
• updating legislative acts in accordance with advances in scientific and technological progress in the field of genetics;
• establishing the legal regime for databases containing genetic information obtained from humans;
• defining the legal regime for data obtained in the course of scientific research.

Considering global legislative experience and involving leading scientists in the fields of genetics and biotechnology will enable the development and adoption of legislative acts that align with the knowledge of modern biomedical science and regulate relations in new areas of law. This, in turn, will foster the technological development of Russia as a whole.

Authors’ contribution. All authors confirm that they meet the ICMJE criteria for authorship. The greatest contribution is as follows: Daria A. Kashtanova — development of the research methodology and concept, scientific supervision, creation and editing of the manuscript; Aleksandra A. Mamchur — collection and analysis of scientific literature, generalization of results and systematization of data, writing — creation of a draft manuscript (section “Types of genetic information subject to legal regulation”), editing of the manuscript; Anna Yu. Yakovchik — collection and analysis of the regulatory framework from foreign sources, writing — creation of a draft and editing of the manuscript (section “Foreign experience in legal regulation of the handling of genetic information”); Aram R. Grigoryan — collection and analysis of the regulatory framework from Russian sources, writing — creation of a draft of the manuscript (sections “State genome registration”, “Genetic information as part of personal data”, “Genetic data as part of medical information”); Mikhail V. Ivanov — collection and analysis of the regulatory framework describing the regulation of databases, writing — creation of a draft manuscript (section “Databases of genetic data as an object of legal protection”); Sergey I. Mitrofanov — editing of the manuscript (sections “Types of genetic information subject to legal regulation”, “Databases of genetic data as an object of legal protection”); Irina N. Svidovskaya — writing, reviewing and editing the manuscript; Vladimir S. Yudin — approving the final text of the manuscript; Anton A. Keskinov — directing and coordinating the research; Sergey M. Yudin — project administration.