REGULATION OF NATIONAL BIOLOGICAL DATA INFRASTRUCTURE SYSTEMS

INTRODUCTION

National biological data infrastructure systems are integrated networks that collect, store, analyse, preserve, and share biological information for scientific research, healthcare, biotechnology development, agriculture, and public-health surveillance. They may include genomic databases, biological sequence repositories, biobanks, disease registries, microbiological databases, and digital platforms connecting research institutions.

In India, initiatives such as the Indian Biological Data Centre (IBDC) support the preservation and sharing of biological data generated through life-science research. These infrastructures can improve research reproducibility and scientific collaboration, but they also raise legal concerns involving privacy, informed consent, cybersecurity, access to biological resources, intellectual property, and equitable benefit sharing. Their governance requires coordination between data-protection law, research ethics, biodiversity legislation, and institutional policies.

1. LEGAL AND REGULATORY FRAMEWORK IN INDIA

A. DIGITAL PERSONAL DATA PROTECTION ACT, 2023

The Act provides a framework for processing digital personal data concerning identifiable individuals, subject to its scope, exemptions, and applicable commencement provisions. Where a biological database contains identifiable human genomic or health information, the responsible organisation must assess the applicable requirements concerning lawful processing, consent where required, security safeguards, and individual rights.

The Act does not create a separate comprehensive statutory category exclusively for genomic information. Nevertheless, genomic data can present substantial identification risks even after direct identifiers have been removed.

B. BIOLOGICAL DIVERSITY ACT, 2002

The Biological Diversity Act, as amended in 2023, regulates specified activities involving biological resources and associated knowledge. The National Biodiversity Authority and State Biodiversity Boards have functions under the applicable statutory framework.

The Biological Diversity Rules and applicable access-and-benefit-sharing regulations must also be considered. The Biological Diversity (Access and Benefit Sharing) Regulations, 2025, address relevant approval arrangements and benefit-sharing conditions. Requirements depend on the persons involved, the resource, the intended use, and the applicable exemptions.

C. BIOTECH-PRIDE GUIDELINES AND ICMR ETHICAL GUIDELINES

The Department of Biotechnology's Biotech-PRIDE Guidelines promote responsible sharing of biological data generated through publicly funded research and provide a policy framework for data repositories and access arrangements. They should not be confused with a comprehensive statute governing every national biological database.

The Indian Council of Medical Research's National Ethical Guidelines for Biomedical and Health Research Involving Human Participants, 2017, provide important standards for consent, confidentiality, sample storage, and research involving human biological materials.

2. PRINCIPAL GOVERNANCE REQUIREMENTS

A. DATA QUALITY AND STANDARDISATION: Repositories should adopt consistent formats, metadata standards, quality-control procedures, and documentation to ensure that datasets remain interpretable and reproducible.

B. PRIVACY AND INFORMED CONSENT: Human genomic datasets should be collected and shared under an appropriate legal and ethical basis. Consent documentation should address intended uses, secondary research, sharing arrangements, and foreseeable identification risks.

C. CYBERSECURITY: Infrastructure operators should implement access controls, authentication, encryption, audit logs, incident-response procedures, and tested backup systems.

D. ACCESS AND BENEFIT SHARING: Biological-resource databases must be governed in a manner consistent with applicable biodiversity legislation, contractual conditions, intellectual-property rules, and benefit-sharing obligations.

E. TRANSPARENCY AND ACCOUNTABILITY: Institutions should maintain clear access policies, establish review procedures for sensitive datasets, document transfers, and provide mechanisms for investigating misuse.

3. RELEVANT CASE LAWS

1. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1

Authority: Direct on constitutional privacy; analogous to biological databases.

The Supreme Court recognised privacy as a fundamental right under Article 21 and other constitutional guarantees. The judgment established that restrictions on privacy must satisfy the applicable constitutional requirements of legality, legitimate purpose, and proportionality.

Relevance: National genomic and biological data infrastructures should have a lawful purpose, proportionate access rules, and safeguards against unauthorised disclosure or intrusive secondary use.

2. K.S. Puttaswamy (Aadhaar) v. Union of India, (2019) 1 SCC 1

Authority: Direct on large-scale identity-data governance; analogous to biological repositories.

The Supreme Court examined the constitutional validity of the Aadhaar framework, including the use of identity information and associated privacy safeguards.

Relevance: Large-scale biological databases require clear limits on access and use, reliable security arrangements, and safeguards against function creep. The judgment does not specifically regulate genomic repositories.

3. Selvi v. State of Karnataka, (2010) 7 SCC 263

Authority: Direct on involuntary investigative techniques involving personal autonomy; analogous to genetic-data collection.

The Supreme Court addressed involuntary narcoanalysis, polygraph examinations, and brain electrical activation profiling. It considered constitutional protections concerning personal liberty, testimonial compulsion, and individual autonomy.

Relevance: The judgment supports careful scrutiny of coercive investigative practices involving the human body and personal autonomy. It does not directly determine the legality of genomic databases or every form of DNA collection.

4. District Registrar and Collector, Hyderabad v. Canara Bank, (2005) 1 SCC 496

Authority: Direct on privacy and access to private records; analogous to biological databases.

The Supreme Court considered whether authorities could inspect private documents without adequate legal safeguards. It recognised the importance of privacy in records held by institutions.

Relevance: Access to biological records should be governed by lawful authority and appropriate procedural safeguards rather than unrestricted institutional discretion.

5. Common Cause v. Union of India, (2018) 5 SCC 1

Authority: Analogous on autonomy and dignity.

The Supreme Court recognised the importance of individual autonomy and dignity in decisions concerning end-of-life care.

Relevance: The principles of autonomy and dignity are relevant to ethical decisions about human biological samples, consent, and the continuing use of material collected for research.

6. Divya Pharmacy v. Union of India, Uttarakhand High Court, 2018

Authority: Direct on access-and-benefit-sharing disputes; analogous to biological data infrastructure.

The High Court considered obligations under the Biological Diversity Act concerning commercial use of biological resources and benefit sharing.

Relevance: A national repository that supports research or commercial development involving regulated biological resources should assess applicable access, approval, and benefit-sharing requirements. The judgment does not establish that every digital sequence record independently triggers the same obligations.

4. PRACTICAL COMPLIANCE MEASURES

National repositories should classify datasets according to privacy, scientific sensitivity, and applicable legal restrictions. They should document the origin of samples, the authority for collection, consent conditions, permitted uses, access approvals, and transfer arrangements.

Institutions should establish independent access-review procedures for sensitive datasets, maintain security and audit records, and regularly assess whether data-sharing practices remain consistent with applicable law. International collaborations should also examine cross-border transfer rules and the terms governing subsequent research and commercial use.

CONCLUSION

National biological data infrastructure systems are important for scientific progress, public health, and biotechnology innovation. Their governance requires reliable data standards, secure access, lawful processing, ethical oversight, and compliance with biodiversity and benefit-sharing requirements. Indian judicial decisions provide significant principles concerning privacy, autonomy, access to records, and accountability, although they do not collectively constitute a dedicated statute for biological data infrastructure. A coordinated legal and institutional framework is essential to ensure that biological data can be shared responsibly without undermining individual rights, scientific integrity, or biodiversity protection.