Executive Summary

China’s Law on Promoting Ethnic Unity and Progress gives Beijing, through Article 63, an explicit legal basis to pursue critics outside its borders. Whether the provision ultimately serves to prosecute or simply deter, its effectiveness depends on the state’s capacity to identify those it targets. That capacity rests on an infrastructure of biometric and genomic data, assembled in part through a commercial genomics sector with a substantial presence in Western markets. The United States, European Union, United Kingdom and Canada already possess regulatory mechanisms to address this risk, yet each currently applies them in isolation. This brief accordingly recommends that allied screening authorities align their criteria for flagging genomic vendors, share their screening decisions, harmonize limits on genomic data transfers and subject sales of large consumer genetic databases to review. NATO, lacking any mandate to screen or block transactions, would contribute most effectively by using its existing intelligence-sharing architecture to detect Article 63 enforcement activity on Allied soil and refer its findings to national authorities.

Introduction

In March 2026, China’s National People’s Congress adopted the Law on Promoting Ethnic Unity and Progress, codifying a decade-long shift from accommodation of ethnic minorities toward outright assimilation (Minzner 2026). The law, which took effect in July 2026, bans acts that “undermine ethnic unity or create ethnic division” and, most notably, extends its reach to organizations and individuals outside mainland China (McCarthy 2026). Following its entry into force, both the European Union (EU) and the United States (US) issued statements expressing concern. An EU representative affirmed that “the EU opposes the extraterritorial application of third-country legislation in breach of international law”, while a US State Department spokesperson called the provision problematic for compelling people outside China to promote Beijing’s ethnic unity agenda or face retaliation (Reuters 2026).

That reaction has, understandably, been framed as a human rights story. But Article 63, the provision that extends the law’s reach abroad, is also a supply chain and identity security story, and that dimension has received far less attention. Article 63’s extraterritorial reach depends on an identification infrastructure built over the past decade through biometric and genomic data collection, and this infrastructure increasingly runs through commercial channels with a presence in Western markets. The policy response, accordingly, must run through those same channels rather than through a single security institution.

A Law Without Borders

Legal analysis of the statute notes that Article 63 omits two safeguards that Chinese criminal law otherwise attaches to jurisdiction over foreigners abroad. Under Article 8 of China’s Criminal Law, foreigners can be prosecuted for acts abroad only if the offence carries a minimum sentence of three years and the act is also illegal where it took place. Article 63 includes neither condition, and neither does Article 38 of the 2020 Hong Kong National Security Law. Hong Kong has justified that law’s reach under the “protective principle” of international law, which allows states to act against serious threats to their security, such as espionage. The principle was meant to be narrow, but authoritarian states have stretched it by treating criticism of their policies as a security threat (Cheng 2026). Multiple United Nations Special Rapporteurs have also raised concerns about the Ethnic Unity Law’s human rights implications (Cheng 2026). 

Other analyses note that the law does not invent a new practice so much as codify one, as Beijing has long pursued Uyghur and Tibetan diaspora communities through what is now commonly termed transnational repression (Clarke 2026). China has already sought to enforce its laws beyond its borders by setting up unregistered police stations abroad, attempting forced repatriations, and using extradition treaties against both Chinese citizens and foreigners. It has also worked through agents presented as private or civil society organizations, although China can still be held responsible for their conduct if they act under its direction (Cheng 2026).

The dangers facing minority communities abroad are well recognized: the European Court of Human Rights has ruled that Bulgaria could not send Uyghur applicants back to China, citing reports of torture and ill treatment in “re-education camps” (Cheng 2026). For its part, Beijing has openly defended Article 63’s reach, with China’s Vice Minister of Justice describing it as consistent with international practice and with every state’s right to legislate against separatism (Cheng 2026).

In short, what Article 63 adds is not the intent to reach abroad but an explicit legal basis for doing so. That basis is limited, however: international law allows states to pass laws covering conduct abroad but generally bars them from enforcing those laws on foreign soil; extradition, meanwhile, faces obstacles such as double criminality, the political offence exception, and host states’ duty not to return people to places where they face torture. The law’s main effect may therefore be to deter critics abroad rather than to prosecute them (Cheng 2026).

The Identification Infrastructure

Whether Article 63 is used to prosecute or simply to deter, its force depends on the state’s capacity to identify who it is pursuing. Over the past decade, China has built what researchers describe as a multimodal biometric surveillance regime spanning DNA, high-definition facial imagery, voiceprints, fingerprints and iris scans, linked to police files (Dirks and Leibold 2020). The Australian Strategic Policy Institute (ASPI) estimates that since late 2017, the Ministry of Public Security has sought DNA samples from between five and ten per cent of China’s male population, a program valued at more than US$1.4 billion and one that has made China’s police-run forensic DNA database the largest of its kind in the world (Dirks and Leibold 2020).

In Xinjiang, this took the form of the “Physicals for All” campaign, under which state media reported 18.8 million physical examinations conducted in 2017 alone in a region of fewer than 22 million people (Kuo 2017). In Tibet, Citizen Lab researcher Emile Dirks estimates that police collected between roughly 900,000 and 1.2 million DNA samples between 2016 and 2022, representing between a quarter and a third of the region’s total population, largely outside any ongoing criminal investigation (Dirks 2022). Human Rights Watch (2022) has documented blood samples taken from children as young as five without parental consent and with no evidence that participation was voluntary.

What distinguishes this program from a conventional domestic policing tool is its sourcing. The same ASPI research documents that the American firm Thermo Fisher Scientific supplied sequencing kits tailored to China’s ethnic composition and publicly stated that it was “providing immense technical support for the construction of the national DNA database”; Chinese suppliers included AGCU Scientific and Microread Genetics (Dirks and Leibold 2020). The identification apparatus that Article 63 now has legal licence to act upon was assembled, in part, through the same commercial genomics sector that sells sequencing services and consumer testing kits internationally.

There are two ways in which data collected by commercial firms could help Beijing identify critics living abroad. First, the database does not necessarily need to hold a person’s own DNA to identify them. Because the Y chromosome passes almost unchanged from father to son, police can trace a sample from an unknown man to a specific family, and potentially to the individual, as long as they hold a profile from his father, uncle or even a third cousin (Dirks and Leibold 2020). A critic abroad whose genetic data reaches Chinese authorities can therefore be linked to relatives still inside China, and the Chinese state has a long record of detaining and pressuring the families of overseas critics (Dirks and Leibold 2020).

Second, Chinese firms that collect genetic data abroad have no mechanism to refuse a government request for it, since Article 7 of China’s 2017 National Intelligence Law requires all companies and citizens to support and cooperate with state intelligence work (National Counterintelligence and Security Center 2021). The US National Counterintelligence and Security Center (NCSC) warns that genomic data collected abroad, combined with other personal data, could help Beijing act against foreign dissidents (National Counterintelligence and Security Center 2021). No public case has yet shown this pathway being used under Article 63, but the legal and technical means are already in place.

The Commercial Channel

The identification infrastructure behind Article 63 intersects with a commercial genomics sector that has built a substantial presence in Western markets, and that sector is far from monolithic. Carnegie China distinguishes between two biotech firms: BGI’s subsidiaries were added to the US Commerce Department’s Entity List in 2020, and the firm has pivoted toward national genome projects in Indonesia and Thailand. WuXi AppTec, by contrast, derives roughly 64 per cent of its 2025 revenue from the United States and has consistently asserted an independent, globally oriented identity (Gong 2026). Both firms were nonetheless designated as Chinese military companies on the Pentagon’s Section 1260H list in 2026 (Gong 2026). 

Despite their divergent strategies, these firms’ designations carry particular weight given their reach into allied economies. The US NCSC fact sheet notes that by August 2020, BGI had sold testing kits in 180 countries and operated laboratories in 18. It further warns that American genomic data is an especially attractive target precisely because of the ethnic diversity of the US population, a diversity that helps refine identification models trained on smaller, less varied domestic samples (National Counterintelligence and Security Center 2021). The same fact sheet notes that BGI’s 2013 acquisition of the American firm Complete Genomics, for approximately US$118 million, cleared a review by the Committee on Foreign Investment in the United States (CFIUS).

That review process has since been invoked again, this time over a consumer product rather than a strategic acquisition. When 23andMe entered bankruptcy in 2025, Senator Bill Cassidy wrote to the Treasury Secretary urging a CFIUS review of any sale. He warned that the firm’s genetic database of approximately 15 million customers could otherwise pass into the hands of a foreign adversary, noting that Chinese firms had already sought to collect genetic data globally (Cassidy 2025). The episode illustrates, in miniature, the core issue at hand: a consumer product, sold openly in Western markets, which produces the kind of biometric identity data that an extraterritorial law like Article 63 depends upon to be enforceable.

The Current Regulatory Landscape

Governments on both sides of the Atlantic have begun building the regulatory architecture this problem requires. The US Department of Justice’s Data Security Program, made final under Executive Order 14117 and fully in effect since July 2025, restricts transactions that would give countries of concern, China among them, access to Americans’ bulk sensitive personal data. Notably, the threshold set for human genomic data is the strictest in the rule, triggered by transfers involving more than 100 US persons compared with 1,000 for other biometric identifiers (US Department of Justice 2025). The BIOSECURE Act, enacted in December 2025 as part of that year’s defence authorization legislation, restricts federal procurement from biotechnology companies of concern, a category defined through the Pentagon’s 1260H list rather than by naming firms directly. By contrast, an earlier version of the bill had explicitly named BGI, MGI, Complete Genomics, WuXi AppTec and WuXi Biologics (Lin, McIntosh and Wilhelm 2026).

Other governments have moved on parallel tracks. In December 2025, the European Parliament, Council and Commission reached political agreement on a revised foreign direct investment screening regulation that requires all member states to maintain screening mechanisms covering a common minimum scope of sensitive sectors, biotechnologies and data-related activities included (European Commission n.d.). 

A similar logic underpins the United Kingdom’s National Security and Investment Act. It requires mandatory notification for acquisitions in seventeen sensitive sectors, among which Synthetic Biology and Data Infrastructure are both named categories (UK Cabinet Office 2026). The government’s 2023-24 annual report found that acquirers associated with China accounted for 41 per cent of transactions called in for full review, the largest share of any single country despite representing a small fraction of total notifications (UK Cabinet Office 2024). 

Canada points reviewers toward the same underlying risk through the Investment Canada Act, whose guidelines direct reviewers to weigh whether an investment would grant access to sensitive personal data, genetic and biometric data included, and whose Sensitive Technology List names biotechnology explicitly (Innovation, Science and Economic Development Canada 2025). While none of these regimes were built explicitly with Article 63 in mind, they nonetheless provide governments with the legal footing to treat biometric and genomic identity vendors with ties to Beijing as a matter of investment security rather than of privacy policy alone.

Policy Recommendations: A Coordinated Role for the North Atlantic

Coordinating the bodies that already hold the tools and authority is more workable than creating new institutions. The US Data Security Program and CFIUS process, the EU’s newly harmonized investment screening regime and comparable UK and Canadian mechanisms each already treat biometric and genomic data transfers as a security question in their own jurisdiction. What is missing is a shared channel through which a vendor flagged in one jurisdiction is not cleared in another.

Closing that gap requires four measures. First, allied screening authorities should align criteria for flagging biometric or genomic identity vendors with Chinese ownership or data-sharing ties, rather than each acting unilaterally on the same underlying risk. Those criteria should rest on conduct and ownership rather than naming firms, as the final BIOSECURE Act does (Lin, McIntosh and Wilhelm 2026). Examples include designation on the Entity List or the 1260H list and documented supply to the Ministry of Public Security’s DNA program (Dirks and Leibold 2020; Gong 2026). Such alignment will not come easily, given current strains in transatlantic relations over trade and technology policy and screening regimes that already differ in scope (Korn, Denamiel and Reinsch 2024). For that reason, coordination should be pursued between screening authorities on technical criteria rather than left to broader political negotiation. 

Second, when one authority blocks or attaches conditions to a transaction involving such a vendor, it should notify its counterparts within a fixed period through bilateral memoranda of understanding. This would build on the information sharing and common standards that CFIUS has been urged to prioritize in its engagement with allied screening regimes (Korn, Denamiel, and Reinsch 2024). Third, the EU, UK and Canada should consider limits on bulk genomic data transfers to countries of concern, modelled on the 100-person threshold in the US Data Security Program (US Department of Justice 2025). Fourth, any sale of a large consumer genomic database, including through insolvency as in the 23andMe case, should trigger mandatory screening review (Cassidy 2025).

NATO’s own guidance points in the same direction. Its Joint Intelligence and Security Division does maintain a hybrid threats analysis capability and, as of 2025, a dedicated coordinator for the issue. However, the Alliance is explicit that primary responsibility for responding to such threats rests with national authorities, with NATO supporting Allied resilience efforts only where requested (North Atlantic Treaty Organization n.d.). It has no mandate to screen a vendor’s ownership structure or to block a foreign acquisition, and asking it to do so would exceed its charter, yielding a mandate with no funding behind it and no realistic path to enforcement. Its narrower and better-fitted contribution would be to use its existing intelligence sharing architecture to identify Article 63 enforcement activity occurring on Allied soil. These findings could then be routed to the national authorities empowered to act on them, rather than to attempt enforcement itself.

Conclusion

Article 63’s reach beyond China’s borders depends on the biometric and genomic infrastructure built across Xinjiang and Tibet over the past decade, and that infrastructure could not have been built without a commercial channel running directly through Western markets. Its legal claim ultimately rests on a data supply chain that governments already regulate elsewhere, through the US Data Security Program and through the screening regimes now in force across the EU, UK and Canada. Treating the entire Chinese biotech sector as an arm of the state is inaccurate, as firms like BGI and WuXi AppTec have responded to the same external pressure in divergent ways. Policies that assess firms individually, based on their ownership, conduct, and ties to the state, are likely to prove more durable than policies that treat the whole sector as equally suspect. Allied governments therefore do not need new tools so much as coordination: no single government can fully see this risk from within its own jurisdiction, but together they can direct the tools they already hold toward it.

References

Cassidy, Bill. 2025. “Letter to the Honorable Scott Bessent, Secretary of the Treasury, on a CFIUS review of 23andMe”, April 8. United States Senate Committee on Health, Education, Labor and Pensions. https://www.help.senate.gov/imo/media/doc/2025-04-08_-letter_to_treasury_secretary_bessent_on_23andme_cfius_review_finalpdf.pdf.

Cheng, Yu-Chen. 2026. “China’s Law on Promoting Ethnic Unity and Progress and Extraterritorial Jurisdiction”, July 22. Opinio Juris. https://opiniojuris.org/2026/07/22/chinas-law-on-promoting-ethnic-unity-and-progress-and-extraterritorial-jurisdiction/.

Clarke, Michael. 2026. “Xi Jinping’s ‘Forging’ of ‘Ethnic Unity and Progress’”, July 13. The Diplomat. https://thediplomat.com/2026/07/xi-jinpings-forging-of-ethnic-unity-and-progress/.

Dirks, Emile, and James Leibold. 2020. “Genomic surveillance: Inside China’s DNA dragnet”, June 17. Australian Strategic Policy Institute. https://www.aspi.org.au/report/genomic-surveillance/.

Dirks, Emile. 2022. “Mass DNA Collection in the Tibet Autonomous Region from 2016-2022”, September 13. The Citizen Lab. https://citizenlab.ca/research/mass-dna-collection-in-the-tibet-autonomous-region/.

European Commission. n.d. “Investment Screening”. https://policy.trade.ec.europa.eu/enforcement-and-protection/investment-screening_en.

Gong, Xue. 2026. “Caught in the Middle: Chinese Biotech Firms’ Divergent Responses to U.S. Sanctions”, August 19. Carnegie China. https://carnegieendowment.org/china/posts/2026/08/caught-in-the-middle-chinese-biotech-firms-divergent-responses-to-us-sanctions. 

Human Rights Watch. 2022. “China: New Evidence of Mass DNA Collection in Tibet”, September 5. https://www.hrw.org/news/2022/09/05/china-new-evidence-mass-dna-collection-tibet.

Innovation, Science and Economic Development Canada. 2025. “Guidelines on the National Security Review of Investments”, March 5. Government of Canada. https://ised-isde.canada.ca/site/investment-canada-act/en/investment-canada-act/guidelines/guidelines-national-security-review-investments.

Korn, David, Thibault Denamiel, and William A Reinsch. 2024. “Harmonizing Inbound Investment Screening”, August 16. Center for Strategic and International Studies. https://www.csis.org/analysis/harmonizing-inbound-investment-screening.

Kuo, Mercy A. 2017. “Uyghur Biodata Collection in China”, December 28. The Diplomat. https://thediplomat.com/2017/12/uyghur-biodata-collection-in-china/.

Lin, Geoffrey, David M. McIntosh, and Rachel Wilhelm. 2026. “BIOSECURE Act Enacted”, January 15. Ropes & Gray LLP. https://www.ropesgray.com/en/insights/alerts/2026/01/biosecure-act-enacted.

McCarthy, Simone. 2026. “China tells its ethnic minorities to integrate or face consequences with sweeping new unity law”, July 1. CNN. https://www.cnn.com/2026/07/01/china/china-ethnic-unity-law-intl-hnk.

Minzner, Carl. 2026. “China’s New Ethnic Unity Law: From Autonomy to Assimilation”, March 26. Council on Foreign Relations. https://www.cfr.org/articles/chinas-new-ethnic-unity-law-from-autonomy-to-assimilation.

National Counterintelligence and Security Center. 2021. “China’s Collection of Genomic and Other Healthcare Data from America”. Office of the Director of National Intelligence. https://archive.dni.gov/files/NCSC/documents/SafeguardingOurFuture/NCSC_China_Genomics_Fact_Sheet_2021revision20210203.pdf.

North Atlantic Treaty Organization. n.d. “Countering hybrid threats”. https://www.nato.int/en/what-we-do/deterrence-and-defence/countering-hybrid-threats.

Reuters. 2026. “EU and US concerned by China’s new ethnic unity law which targets people overseas”, July 2. https://www.reuters.com/world/china/eu-concerned-by-chinas-new-ethnic-unity-law-which-targets-people-overseas-2026-07-02/.

UK Cabinet Office. 2026. “National Security and Investment Act 2021”, last updated October 12 2026. UK Government. https://www.gov.uk/government/collections/national-security-and-investment-act.

UK Cabinet Office. 2024. “National Security and Investment Act 2021: Annual Report 2023-2024”, September 10. UK Government. https://assets.publishing.service.gov.uk/media/66fff9a6e84ae1fd8592ee62/National_Security_and_Investment_Act_-_Annual_Report_2023-24.docx.pdf.

US Department of Justice. 2025. “Foreign Investment Review Section - Data Security”. National Security Division. https://www.justice.gov/nsd/data-security.