歐盟、美國與臺灣個資保護法規中之研究利用

Research Use Clauses in Personal Data Protective Laws: EU, the U.S. and Taiwan

個資法中關於研究利用相關條文，包括個資法第6條第1項第4款、第16條第5款等。我國中央健保署在全民健保制度下，可蒐集全國就醫的就診用藥資料，建置全民健保資料庫。中央健保署將此資料提供給外界做研究利用，而引發是否違反個資法規定的爭議。本文深入分析個資法中研究利用之要件，並比較美國、歐盟、德國相關規定，說明我國研究利用要件過於嚴格。本文將詳細介紹歐盟二○一六年個資保護規章中與研究利用有關之相關規定，以及美國健康資訊研究利用相關規定與實際運作。本研究認為，個資法之研究利用條款，限制要件過多，研究主體可不限於公益或學術團體，研究目的可不限於公益目的，而所提供資料不用去識別。另方面，對於尚未去識別資料之研究利用，在程序面，建議應經過倫理審查委員會之審查，審查認為研究風險低者，可允許免除取得當事人告知同意。

The purpose of this Article is to compare the researching use of sensitive data provisions between Taiwan’s Personal Data Protection Act and other countries’ laws, especially EU General Personal Data Protection Regulation and U.S. HIPAA privacy rule. The Section 6(4) and 16(5) of Personal Data Protection Act regulate the research use of personal data. The research exception in the Section 6(4) and 6(5) are also too strictly. All these limitations let the Ministry of Health and Welfare face difficulty to release the national-people-health-insurance database for external research, and there were some human rights groups had questioned the practices. In this paper, the research use clauses in EU 1995 personal data directive and EU 2016 General Data Protection Regulation will be thoroughly introduced and analyzed. Then, the researching use of personal health information under U.S. HIPAA privacy rule will be detailed analyzed. After compare the legislations and regulations between EU, the U.S. and Taiwan, this study suggests that there are many wrongs in the legislation and amendment of researching-use provision in Taiwan. In one hand, I argued that restrictions of research exception in Section 6(4) and Section 16(5) of Personal Data Protection Act are too excessive: 1. the researcher need not to be academic institution, 2. the purpose of research need not to be public interest, and 3. the data need not to be de-identified. In the other, I suggested that IRB or privacy board should review the researcher’s protocols before they can get the sensitive information, and IRB may immune the informed-consent requirement if they think the risk of privacy is very low.