大數據時代下之個人資料保護—以保險業運用大型個人資料庫為討論核心

當大數據時代來臨，相關新興資訊蒐集、分析技術之快速發展不僅帶動各產業之多面向發展，更是徹底改變人類之社會型態與日常生活。大數據時代下之產業發展雖透過對於個人資料之蒐集、處理、利用而創造無限之可能與價值，惟基於大數據之本質與特性亦同時對於個人資料保護面向帶來難以估計之衝擊與侵害風險，如何在時代發展下兼顧個人資料運用以及個人資料保護實為重要之議題。有鑑於保險制度之本質涉及個人資料之大量蒐集、處理、利用，保險業不論是於投保、核保、理賠等階段皆對於個人資料具大量需求性，故當面臨大數據時代所帶來之變遷，保險業如何於相關技術應用與發展下兼顧對於個人資料之保護即有相當之討論價值。故本文以保險業於大數據時代下之個人資料相關應用與發展作為探討起始點，以保險業利用大型個人資料庫為探討核心，並分別針對健保資料庫之應用、非自然人健保資料應用平台之應用、保險法第177條之2修正條文草案所涉及之保險業大型資料庫建置等議題之可行性與合憲性進行討論與分析，藉由重新檢視我國資訊隱私權理論、我國實務判決與眾學說見解，並兼參考外國法制度後，再行針對前述議題進行爭議要點之提出以及未來發展方向之建議。結論上，本文認為傳統資訊隱私權已不足因應大數據時代下之個人資料保護需求性，故先行提出修正之資訊隱私權理論，並藉此做為前述議題之立論核心基礎。針對健保資料庫、非自然人健保資料應用平台之保險業利用，以及保險法第177條之2修正條文草案等議題，除應確保個人資料主體之資訊自決權受保障外，另亦需考量個人資料去識別化程度之設定、保險歧視之消除、尚生存家屬之保障等面向。另針個人資料保護之整體制度設立上，本文認為除應建立個人資料保護影響評估機制、個人資料利用回饋機制外，政府方與保險業方亦應分別設立個人資料保護專責機關以及專責之個人資料保護長，以確保憲法所奠定之資訊隱私權保障以及個人資料之保護。

關鍵字

個人資料保護法；健保資料庫；資訊隱私權；保險法第177條之2

並列摘要

When the era of big data comes, new technologies related to data collection and data analysis develop rapidly. The development of these technologies drives the advancement of various industries variously and changes the social pattern and daily life of human beings entirely. Although industries create unlimited possibilities and value through collecting, processing, and utilizing personal data in the era of big data, at the meantime, these industries also bring incalculable impacts and risks to personal data protection due to the characteristics of big data. These potential impacts and risks raise the vital issue in balancing the utilization and the protection of personal data. The nature of insurance involves a large amount of personal data collecting, processing, and utilizing, so the insurance industry always has a great demand for personal data all the time, no matter it's in customer targeting, insurance underwriting, or insurance claims. Therefore, when the insurance industry faces the changes brought about by the era of big data, it is worth discussing how the insurance industry can take personal data protection into account while applying and developing new technologies. Considering the reason above, this article takes applications and development of the insurance industry as the starting point for the discussion and analyzes the critical issues of the insurance industry's utilization of large-scale personal data banks.Take Taiwan's National Health Insurance Research Databases, deceased person's personal data application platform, article 177-2 of the Insurance Act for examples, discussing and analyzing the feasibility and constitutionality of the insurance industry's utilization. By re-examining Taiwan’s traditional theory of information privacy, judicial opinions, legal judgments, and authorities’ opinions, along with reference to foreign legislations, this article proposes several methods to the issue questions and directions for future development. In conclusion, this article believes that the traditional theory of information privacy is no longer sufficient to meet the needs of personal data protection in the era of big data, so revision theory to information privacy is proposed and used in the aforementioned issues. When considering the use of Taiwan's National Health Insurance Research Databases, deceased person's personal data application platform, and the feasibility of article 177-2 of the Insurance Act in the future, its necessary to ensure the data subject's autonomy to personal data, the degree of identification, the elimination of insurance discrimination, the protection of surviving family members, etc. Regarding establishing a better system for personal data protection, it's necessary to develop Data Protection Impact Assessment and a feedback mechanism for the use of personal data, the government should also set up a particular agency for personal data protection, and the insurance industry should hire a Data Protection Officer. In this way, the constitutional right to information privacy and personal data protection can be insured.