의료정보의 연구목적 활용을 위한 법제적 검토

초록

Article 28(2) of the Personal Information Protection Act of 2020 stipulates that “a personal information processor may process pseudonymised information without the consent of the data subject for statistical compilation, scientific research, public record keeping, etc.”. On the other hand, the Act on Bioethics and Safety (hereinafter referred to as the Bioethics Act) stipulates that research on human subjects or research on human derivatives must be conducted. In addition, the Healthcare Data Utilisation Guidelines (hereinafter referred to as the Guidelines) have been established to apply the pseudonymisation exception of the Personal Information Protection Act to the healthcare sector. This study analyses the methods of interpretation and the limitations of each law. This study is limited in that it is not an interpretation of the entire legislation, but an interpretation of the use of medical information for the purposes of the study, and it is based on a literal interpretation. However, as there are ongoing discussions in the areas of legislation, interpretation and application, the following points need to be considered in future legislation. First, it is necessary to clarify the scope of human subjects research and the scope of scientific research. The current definition of human subjects research includes information that can directly or indirectly identify an individual, which could be interpreted to include pseudonymised information in research that uses indirectly identifiable information. This is because, if we stick to the literal interpretation, pseudonymised data can still be re-identified by combining it with other information (despite the penalties for re-identification). While human subjects research already requires IRB review after consent is obtained to provide information for human subjects research purposes, pseudonymisation for scientific research purposes is different because it is done without consent. The IRB or Data Review Board (DRB) must consider the appropriateness of the anonymisation method and procedure in light of the purpose of the research. Second, in the long term, it is necessary to review the classification and use of information according to the level of risk. The conflicting terminology in the legislative history of the Bioethics Act and the Personal Data Protection Act may lead to various confusions in practice. In particular, while there is no significant technical difference between anonymisation and pseudonymisation in terms of identifiability, there is a difference in the consent and use procedures between anonymisation under the Bioethics Act and pseudonymisation under the Personal Information Protection Act. Therefore, in the long run, medical information should be classified according to the degree of risk, such as identifiability, and simplified for low-risk information, but improved by clarifying procedures for high-risk information. In the same vein, the concepts of anonymisation and pseudonymisation need to be used in a more detailed way within the process, according to the level of risk and in line with the purpose of the research.

키워드