Mandatory collection, processing, or use of personal data by state agencies incurs questions of how principles of legal reservation and proportionality are to be applied in state data practices. In the case involving National Health Insurance Administration’s mandatory use of personal health insurance data for creating a research database, the Supreme Administrative Court ruled that a state agency can rely only on its organic act as the legal basis. Also, the court found that the efficiency of data use in research can be the legitimate government interest for large-scale mandatory use of incompletely de-identified sensitive data. I will instead argue in this comment that the court erred in its standard of de-identification, and that flexibility for public authorities to collect and process personal data does not necessitate the compromise of the principle of legal reservation at the expenses of individual rights. It is also necessary to develop a hierarchical proportionality principle, with which the mandatory legislations that encroach upon informational privacy with negative effects on human dignity or flexible development of personality shall be subject to the strict scrutiny.