國家建置全民健康保險資料庫之資訊隱私保護爭議──評最高行政法院106年度判字第54號判決

Controversy over Information Privacy Arising from the Taiwan National Health Insurance Database: Examining the Taiwan Highest Administrative Court Judgment No. 106-Pan-54

資訊與通訊科技（Information and Communication Technology, ICT）發展對於資訊隱私概念的形成，總是扮演著重要角色。西元1950年代，隨著電腦與磁碟片科技的出現，資訊儲存技術大幅提升；而網路科技在西元1990年代的興起，更是對於資訊隱私保護形成重大衝擊。1接續隨著數位科技的不斷創新，搭配寬頻及光纖網路的普及建置，使得資料的儲存與傳輸，提升至一個完全不同層次的境地。時至二十一世紀的今日，日趨成熟的無線網路科技與行動裝置的出現，則是讓人與人間的接觸，進入一個近乎無空間、無時間距離的新世界。近年來的巨量資訊科技發展更是對於以健康資訊作為基礎的醫療、健康照護與醫學研究，帶來巨大轉變，也使得巨量健康資料庫的建立，需求孔急；全民健保資料庫便在此波浪潮下因應而生。衛生福利部（以下稱「衛福部」）中央健康保險署（以下稱「健保署」）為了因應此波浪潮需求，自民國87年起，著手將全國民眾之納保與就醫資料（以下稱「健保資料」）建置「全民健康保險資料庫」，對外提供各界申請學術研究使用。

In the four court judgements where this dispute was decided, two main issues associated with Item 4, Paragraph 1 of Article 6 and Item 5 of Article 16 of the Personal Information (Data) Protection Act remain unresolved. One is the required degree of de-identification of personal health data and the other issue relates to an individual’s right of eraser of his/her own personal data from the Taiwan’s National Health Insurance Research Database. This article argues that the principle rule is that the National Health Insurance Administration (NHI) shall obtain the individual’s consent before it can collect, process and use personal data in order to protect one’s right of controlling his/her data. However, if the control interest has to be put aside in certain circumstances, the NHI has to demonstrate the existence of other legal interests which outweigh such personal control interest to justify its collection/processing/use of personal health data without consent. In this respect, the court’s reliance on NHI’s sole defense that personal privacy shall have been well protected since the data are de-identified without requesting NHI to demonstrate the greater legal interests that deserve protection has failed to consider the nature of a person’s control interest. Additionally, the court also failed to consider the difference between the interest of control and the interest of secrecy and intimacy when it dismissed plaintiffs’ claim that their personal data shall be removed from the NHI database and held that since the personal information has been de-identified, there should be no concern of privacy invasion. As a matter of clarification, the right of erasure is to protect a person’s control interest while the de-identification is to ensure the protection of a person’s secrecy and or/ intimacy. Whether or not the personal information has been de-identified shall not be confused with a person’s right of erasure and these two issues need to be reviewed separately.