The Conflicts Between The Applications of Big Data and Personal Information Protection Act in Taiwan-Take Insurance Industry as an Example

With the continuous innovation of technology, Big Data analysis has become one of the hot topics in recent years. The various industries are all bound to the Big Data and applied it to every aspect of the enterprise. People all look forward to have a perfect use of Big Data, and then benefit not only the enterprise but also for the society. As well, the development of the applications of Big Data in insurance industry is in full swing. However, one of the most important issues of Big Data is privacy protection for personal data. In Taiwan, the current Personal Information Protection Act, although revised in 2010, enacted in 2012, its legislative history can be traced back to the Computer-Processed Personal Information Protection Act in 1995. Thus, Big Data and Personal Information Protection Act are from different ages, it is understandable that personal data protection mechanism in the Act did not take the special nature of Big Data into account, the two then conflict as a result. Based on the characteristics of Big Data, this paper reviews the important provisions of current Personal Information Protection Act, and proposed four points of conflict; includes: (1) The possibility of data re-identification causes ambiguity on the definition of personal data. (2) The obligation of informed consent is difficult to fulfill. (3) Unable to determine the specific purposes in advance. (4) The difficulty of stop using and deleting personal data when specific purposes no longer exist. As the insurance industry is highly using with the personal information, this paper lists a number of Big Data applications in insurance industry and analyzes legal risks they may face with once personal data is involved. Besides, Insurance Act Article 177-1 seems fails to resolve the relevant issues. In the end, this paper attempts to propose certain suggestions of future legislative revision and feasible countermeasures to the interested parties for reference in hope of arising the parties' attention and further discussion to this issue in the future.

關鍵字

Personal Information Protection Act ； Big Data ； Privacy ； Insurance Act Article 177-1 ； Personal Data Re-identification

並列摘要

隨著科技不斷創新進步，大數據分析成為近幾年熱門話題之一，業界無不卯足全力將大數據分析技術應用在企業的方方面面，期待透過大數據分析，完美掌握所有數據資料，進而為企業、為社會帶來利益。同樣地，保險業關於大數據的運用，也正如火如荼發展中。然而，使用大數據的適法性是最啟人疑慮的所在，其中之一即是個人資料隱私保護；我國現行個人資料保護法雖於2010年修法，自2012年施行至今，其立法沿革其實可溯至1995年的電腦處理個人資料保護法。由此可見，大數據和個人資料保護法係來自不同的時空背景，個人資料保護法對個人資料的保護機制完全未考慮大數據運用的特殊性，兩者進而產生衝突。基於大數據特性，本文檢討現行個人資料法重要條文，提出四點衝突；包括：大數據中，個人資料被重新識別的可能性下，個人資料定義與劃分標準不明、告知義務履行之困難、特定目的難以提前確定、特定目的結束後資料停止使用及刪除之困難等。又保險業屬與個人資料緊密關聯的產業，本文列舉保險業大數據應用實例，此一旦涉及個人資料，依然可能面臨上述衝突，造成保險業巨大的法律風險，保險法第177之1條亦未能解決相關問題。因此，本文嘗試提出未來的修法方向及可行的因應對策供各方參考，希冀透過本文能引起相關單位對此問題的重視與討論。