대만의 '가명처리된 의료정보의 이용중지청구권' 도입과 한계 - 대만사법원판결(111年憲判字第13號)과 한국헌재결정(2020헌마1476)의 비교를 중심으로 -

초록

On 12 August 2025, the National Health Insurance Administration, which is part of Taiwan's Ministry of Health and Welfare, implemented an order recognising the so-called 'data subject's right to request suspension of the use of health insurance data'. This measure was introduced in response to a legislative amendment requirement set out in a Taiwan Supreme Court ruling three years earlier (Judgment No. 13 of 111 Constitutional Case), which focused on the right to request the suspension of the use of one's own health insurance data. On 12 August 2022, a landmark ruling permitted academic institutions and others to utilise pseudonymised medical information for research purposes without the individual's consent. However, the ruling also found the existing legal framework to be unconstitutional due to the absence of: legislation regulating this procedure; an independent supervisory body; and the data subject's right to request suspension of use. Therefore, this provision can be considered significant in that it partially recognises the data subject's right to control their sensitive personal health information. Taiwan's right to request suspension of use ensures the independence and transparency of the review process. This is achieved by requiring the National Health Insurance Review Committee, which decides whether to disclose individuals' health insurance information to third parties, to include a majority of external members, such as experts, scholars and civic organisation representatives. Furthermore, only the data subject themselves can request suspension of use. Requests are restricted when necessary for the public interest. Even if a request is approved, the suspension cannot be applied retroactively to personal information provided before the effective date. This realises the data subject's right to self-determination over their personal information, while avoiding the excessive regulation of the use of medical information by academic institutions and others. The right to self-determination over personal information is an 'active right to autonomously control information about oneself', as set out in Articles 10 and 17 of the Constitution of the Republic of Korea. Article 10 stipulates the right to pursue happiness, while Article 17 guarantees the right to privacy and freedom. In today's highly information-driven society, this right must be protected particularly carefully, especially with regard to sensitive information. From this perspective, the Taiwan High Court ruling discussed in this paper, and the system established accordingly, can be considered an institutional supplement that balances the contemporary trend of actively utilising personal information with the constitutionally protected right of the information subject to self-determination. In the case of Taiwan, even if the right to request the suspension of processing is recognised, this cannot be considered complete cessation. This right requires the cessation of 'use for purposes other than processing', which distinguishes between the concepts of processing and use. Therefore, it is understood as the right to request the cessation of the provision of pseudonymised information by third parties, which is significantly narrower in scope than the broadly defined cessation of the processing of pseudonymised information under our legal system. In practice, however, when a data subject requests suspension, questions arise as to whether suspending the use of already pseudonymised information is technically feasible, specifically with regard to the practicality of re-identifying data when identifiers are stored separately for the purpose of suspending only third-party use, and ascertaining whether the data subject's information is included. Consequently, further observation is required to understand how this will function in practice. While limitations are anticipated in terms of the legislative form of the system and technical feasibility, Taiwan's introduction of the right to request the cessation of use is significant. At a time when discussions are underway regarding institutional improvements, such as the introduction of a comprehensive consent system and the relaxation of pseudonymisation standards, this right effectively corresponds to the cessation of the use of pseudonymised personal information for purposes other than processing. Therefore, it can be considered a type of phased opt-out mechanism.

키워드