Balancing the Public Interest of Healthcare and the Right to Privacy: The Personal Data Protection Act

Author: Jamie C. Yang

The Public Interest of Healthcare versus the Right to Privacy

The Taiwan National Health Insurance, instituted in 1995, is a single-payer compulsory health-care insurance plan. The NHI subsidizes care and treatment of most diseases for all Taiwanese citizens (foreigners are also eligible under certain circumstances), and the population coverage had reached 99% by the end of 2004. Having such high level of coverage, the NHI is a custodian of very valuable medical data.

Photo Courtesy US Army Africa CC BY 2.0

As data science progresses, data analysis has become increasingly important in the development of medical research. Since its inception, the NHI has been providing such data to researchers on a case-by-case or ad hoc basis. Parallel to the growing demand for health information, the Personal Data Protection Act of 2012 (New Act) was announced and implemented to replace the Protection of Computer Processed Personal Data Act (Old Act). The New Act has further clarified the circumstance under which government and research institutes may utilize personal health data.

In an ideal world, the purpose of scientific research and the protection of personal privacy could both be adequately served by de-identification of personal data. However, whether personal information has been de-identified is a judgment call. Currently, there is no standard operating procedure to ensure that personal data is absolutely de-identified. The data might be re-identified with the advancement of data mining techniques or when correlated with other information. Moreover, for patients with rare diseases, their personal data could be easily identified by matching a few indexes.

Patients Brought the NHI to Court

Lately, the NHI began to promote value-added applications of health data to the public and announced that it would be outsourcing some of its functions to a database service provider, hence the issue of personal privacy was brought to the attention of privacy advocate NGOs. On May 5, 2011, one NGO issued letters to the NHI and requested it to cease its current practice of providing data to the database service provider and academia. The named plaintiffs claimed that individuals are still identifiable after de-identification and such practice has breached the regulations under the New Act.

The Old Act provides that a government organization may not make use of personal data it collected outside of its original purpose of collection (i.e., ostensibly collect personal data for purpose X, but make use for purpose Y), unless some narrow exceptions are met. These relevant parts of the exceptions under the applied regulations provide that, if utilization of personal data is necessary for academic research and no significant harm is brought upon an individual, an exception can be made.

The NHI is an insurance body, and it was authorized by law to collect personal medical data for calculation of insurance rates and coverage. The use by academia for research was obviously not the original purpose of collection. The NHI thus argued that because personal data is necessary for academic research, an exception applies in this case. The Taipei High Administrative Court, applying the Old Act, agreed with the NHI.

Regarding the plaintiffs’ claims for removing their own health information, the Court further reasoned that “since personal data was collected pursuant to the law and no consent of the person was necessary, the right for the person to opt out shall be limited accordingly,” and “even assuming that certain persons are still identifiable, in order to pursue the benefits of healthcare research, their privacy interests can be sacrificed.” The public interest of healthcare prevailed over private individuals’ right to privacy in this first case of its kind in Taiwan.

The Ongoing Struggle between the Public Interest of Healthcare and the Right to Privacy

In this day and age, a majority of bio-medical research is based on analysis of big data. The tension between the public interest of healthcare and private individuals’ right to privacy will continue to be a common theme.

The New Act provides, the government or academia may make public interest use of data if such data is de-identified so that no specific individuals can be identified. However, the required degree of de-identification is decided by courts on a case-by-case basis and may depend on the scope, scale and sensitivity of personal data involved. The Taipei High Administrative Court’s decision that the plaintiffs’ rights can be compromised for the pursuit of healthcare research has the effect of alleviating the cost of operation for similar large databases in Taiwan. Nevertheless, whether a vague concept of public interest may always prevail over personal rights to privacy under the New Act is highly debatable. The personal information intensive industries in Taiwan would be keeping a close eye on new court decisions.

Extended Reading：

• 誰允許國家販賣全民健保資料?