Core Principles for an Online Permit and Monitoring System to support the Nagoya Protocol

Design Principles

These principles refer to the design and implementation of the online permit and monitoring system.

1. A Single System that serves the needs of permit granting authorities and applicants seeking to access genetic resources and/or traditional knowledge associated with genetic resources within a country’s jurisdiction.

2. A Central Hub. In existing systems a permit application may be circulated by email or by post to various permit granting authorities. In this system the application, once submitted in electronic form, stays in place at a central server based hub. It is assumed that more than one authority may be involved in reviewing or authorising a permit. In this system notifications are dispatched to relevant authorities to inform them of the need for action on a particular application. Authorities log in to the system and take action accordingly, including communications with applicants that are transmitted through the notification system. Communications arising from an application are stored with the application as part of the electronic file register for the application.

3. Easy to Use. The system should be as simple as possible and not require specialist knowledge or software to access or use the system. The system is intended to be used by non-specialists using simple check boxes and entries in forms.

4. Responsive. The system should be sufficiently flexible to adapt to the needs of different authorities, including their reporting needs. The needs of police, customs and national park authorities should be addressed through responsive mobile formats (phones and tablets) including use of “permit passes” with QR codes (Quick Response codes) and bar codes similar to a mobile airline boarding pass. The “permit pass” would be carried by applicants and could be checked by relevant authorities on the ground using reader software on mobile phones with minimal effort. Consultation and practical testing with the relevant authorities is required to implement this principle.

5. Secure. The system should meet standard security requirements (e.g. https:) and comply with applicable data protection laws. Attention should be paid to the provisions of the Nagoya Protocol on confidentiality (Article 14.2, 17.3, 17.4). Particular attention should be paid to the storage of commercially sensitive information linked to a permit and ABS contract including secure offline storage of such information. Backups of the system should be maintained securely and encrypted in accordance with existing standards for the protection of digital information. A physical archive of the documents should be maintained in accordance with existing practice.

Attention may also be required to protect against back doors. A back-door is a secret route into an electronic system that bypasses normal authentication requirements. Back doors may be built in at the design stage (to provide a means of restoring access to the system resulting from lockout) or discovered by users seeking access to the system. Consideration should be given to limiting the potential for back doors in any code and monitoring to detect back doors that may subsequently be discovered by users. For discussion on types of back doors see Wysopal, C and Eng, C (2015) Static Detection of Application Backdoors.

6. Independent. The system should be based on, and maintained, using widely available standard open source software tools and standard text formats to avoid dependency on a single supplier/contractor or data format. No third party should own all or part of the system. Note that public procurement rules are likely to be of relevance in implementing this principle.

7. Long Term. The research and development cycle involving biological and genetic resources or associated traditional knowledge may take place over a period of decades. It is therefore important to take a long term perspective on the functioning of the permit system and its integrity over time, including proper back-ups.

8. Unique Identifiers. Unique identifiers enable internal coherence within the system and monitoring outside the system. For a permit and monitoring system the starting point could be a unique identifier such as a standardised country code (e.g. BS for the Bahamas or UG for Uganda and ZA for South Africa), the date (2015) and unique number (1234) to produce unique identifiers such as BS20151234, UG20151234 or ZA20151234. This system functions very effectively for 90 million patent documents in multiple countries and is recommended.

9. Triple Redundancy. The permit system should build in the principle of triple redundancy in its tracking system rather than relying on a single point of reference. Triple redundancy is an engineering design principle that means that three distinct systems perform the same function. Because they are independent systems, if one system fails the two others will continue to work. If a second system fails then one other system, normally the simplest, will continue to work. Further details and examples of the implementation of this principle for ABS are provided in Section 4 on unique identifiers.

10. Integrating Technical and Legal Components. The development of an online permit and monitoring system is a technical development that is directed towards the effective realisation of legal obligations on the part of Parties to the Protocol and establishing clear legal requirements on the part of applicants. Legal aspects of the system, notably with respect to the terms of permits and contracts as well as change of intent should be recognised at the design stage. In practice this means that the development of the technical aspects of the system and the legal aspects should be closely linked. Longer term legal advice should be built into the development cycle to respond to changing legal requirements.

11. Minimal Human Intervention. Primary responsibility for data input should rest with applicants in entering legally required information. Government action should be confined, as far as possible, to approval of electronic applications, communications related to approvals, and archiving of physical copies of records. The basis of this principle is that human intervention introduces typological errors (such as spelling mistakes) or errors of interpretation (such as interpretations of person or institutional names). These errors affect the integrity and utility of the system over the long term, particularly with respect to monitoring and reporting.

12. Anticipate Legacy. A development cycle approach to the permit system should be established that involves forward planning and transitioning from an existing system (that becomes the legacy system) to a new system over time. A formal development plan should be developed and periodically reviewed based on experience gained.

13. Value Permit Staff. The permit system is important to the ability of Parties to the Protocol to implement their obligations, generate benefit-sharing and the valuation of genetic resources and associated traditional knowledge. The time horizon for the realisation of benefits may span decades. While most countries have a permit system it is also important to value the staff who process permit data. This role will become increasingly important in future years in terms of the capacity to bring benefits for conservation and sustainable use. Consideration should therefore be given to recognition of the importance of staff roles and maintaining continuity in the skills required to run and maintain the system.

Access and Benefit Sharing Related Principles

14. Timeliness. The Nagoya Protocol sets out minimum access standards. Article 6.3(d) requires that Parties to the Protocol:

“…provide for a clear and transparent written decision by a competent national authority, in a cost-effective manner and written within a reasonable period of time”.

The single permit system should facilitate compliance with the terms of the Protocol by the governments operating this system. This could include creating an applicants portal providing clear information on the progress of applications in the procedure, the name and contact details of the relevant person at each stage of the procedure and extend to the generation of automatic emails notifying applicants when a stage in the procedure has been approved or providing written information on issues requiring resolution. Implementation of this principle could also include a clear, transparent and time limited appeals process.

15. Transparency. This principle has four aspects:

1. Accuracy. Applicants should be required to provide full and accurate information on each legal person applying for a permit and the legal entities (universities, companies etc.) with whom the government is entering into a relationship through the research permit and ABS contract. Failure to provide accurate information should be grounds for revocation of a permit and other appropriate sanctions. “Group” or “bulk”" permit applications by a lead investigator accompanied by unnamed others should not, in our view, exist as an option because it prevents monitoring of compliance.

2. Clarity. In accordance with Article 6 of the Nagoya Protocol government authorities will provide clarity on the steps in the procedure, and the status of applications.

3. Responsibility. To ensure clear lines of responsibility and prevent bottlenecks in the processing of applications the designation of a lead authority within the system is desirable. In cases where multiple permit granting authorities are involved in processing an application, applicants should be notified on the name of the authority holding the permit within the system at a given stage in the procedure. In cases of undue delay the designated lead authority should possess the authority to assist the authority involved to resolve the delay.

4. Fair and Non-arbitrary. Clear written reasons should be given for rejection of applications. A menu of standard reasons for rejection (e.g. incomplete information, inaccurate information, failure to comply with environmental impact assessment legislation etc.) could facilitate timely and transparent communications with applicants while meeting the terms of Article 6 of the Protocol. Applicants may be provided with the opportunity to appeal against rejected applications through a well defined and transparent procedure.

16. No Backdoor Access to Permits. No legitimate means should exist to obtain a permit outside the electronic system. Users of the permit system may seek to avoid using the electronic system in order to avoid its obligations to disclose information and enter into mutually agreed terms. This is likely to be pursued through personal networking. There should be no back-door routes to obtaining permit data outside of the single system or the integrity of the overall system will be undermined at the expense of longer term benefit-sharing for conservation and sustainable use.

17. Address Types of Permit and Anticipate Change of Intent. Permits may be granted for different types of research, notably non-commercial or commercial research. The Nagoya Protocol in Article 8(a) also anticipates the possibility of a change of intent from non-commercial to commercial research and development. The single permit system should provide a basic set of options for applicants (e.g. is this non-commercial or commercial research?) that then triggers different pathways for the processing of the applications by authorities in accordance with the requirements for non-commercial and commercial applications. Issues relating to change of intent could be dealt with through a formal requirement set out in the permit and associated MAT to declare a change of intent and report such a change within the online system. A report of a change of intent (from non-commercial to commercial research and development) would then trigger a negotiation phase for informed consent and revised MAT appropriate for commercial research and development. This possibility should be anticipated at the design stage.

18. Monitoring. The system should support monitoring in two ways:

1. By facilitating automated searches for scientific literature, patent data and online sources or product registries with respect to the provisions of Article 17 of the Nagoya Protocol.

2. By providing applicants with a means to easily provide information on scientific publications, patent applications, products or other information relevant to the terms and conditions of the permit and associated MAT. Making it easier to provide information will at least partly overcome the limitations of reporting by researchers in existing systems.

19. Tidy Data. This technical principle relates to the conditions for using permit data as a tool for monitoring and reporting. Tidy data is the principle that a field in a data table should contain a single piece of information (e.g. a name) and no other information. A variable (normally a column) should only contain information of the same type (e.g. a country name, not a country name and an organisation name) (Wickham 2014). This principle is important in creating a cost-effective and efficient monitoring and reporting system because the majority of an analysts time is typically taken up with cleaning messy data prior to analysis. Anticipating the need for tidy data at the design stage will lead to cost savings at the implementation stage for monitoring and reporting.

20. Reporting. The system should contribute to the efforts of governments to meet internal national reporting requirements and to meet the obligations under Article 29 of the Nagoya Protocol on Monitoring and Reporting (national reporting and compliance with the obligations set out in the Protocol). Particular attention may be paid to COP MOP Decision NP-1/3 setting out guidelines and the format for interim national reports under Article 29.

The online permit system can facilitate information on subjects such as:

1. Numbers of permits granted by type.
2. Organisations/Companies involved.
3. Funding bodies involved.
4. Countries involved.
5. Publications/patent applications or products arising.
6. Provision of information to the ABS Clearing House Mechanism.