바이오뱅크 포괄적 동의의 효력과 활용 범위에 관한 법적 고찰 ― 영국, 핀란드, 독일 바이오뱅크 포괄적 동의에 따른 데이터 수집과 활용 사례를 중심으로 ―

초록

This paper analyzes the legal meaning and scope of effect of comprehensive consent used in biobanks and examines improvement measures from the perspective of personal information protection and the protection of data subjects' rights. Biobank research presupposes the long-term storage of human-derived materials and health/genetic information, subsequent studies, multi-institutional linkage, and secondary utilization. Therefore, the method of repeatedly obtaining specific consent for each individual study faces practical constraints. Considering the balance between the procedural complexity and the utility it provides for the data subject's right to self-determination, it has been discussed as an institutional mechanism to respond to the modern biomedical research environment. However, the mere existence of comprehensive consent does not readily justify all future data processing, particularly data combination, algorithmic learning, or commercial research derived from scientific studies. It is necessary to more precisely structure the legal meaning of consent and the scope and limitations of the consent form. This paper first analyzes the legal structure of comprehensive consent centered on the frameworks of the Bioethics Act and the Personal Information Protection Act. It examines the potential for cross-application between consent for research involving human-derived materials and general consent for personal information processing. By conducting a comparative analysis of the German Biobank Act, the UK Data Protection Act 2018, and the Finnish Personal Data Act, it investigates the specificity and clarity requirements for comprehensive consent, the grounds for processing without consent based on public interest purposes, and the internal governance and mechanisms within institutions. This comparative analysis examines the specificity and clarity requirements for comprehensive consent under each legal system, the basis for processing without consent for public interest purposes, and the meaning and function of internal institutional governance and mechanisms. Cases such as UK Biobank, Helsinki Biobank, and University Medicine Greifswald(UMG) emphasize the importance of the consent form's wording itself. However, they also demonstrate that the legitimacy of comprehensive consent can only be secured when combined with governance mechanisms. These include informing participants about research purposes and data categories, independent review of access and use, standards for long-term storage and third-party provision, establishing prohibited areas, and post-disclosure procedures. Based on this analysis, this paper argues that the effect of comprehensive consent should be utilized within the scope of research purposes, data scope, and usage methods that participants can reasonably foresee. Particularly, as data usage for public interest expands, there is a risk of diminishing the data subject's right to self-determination over their personal information. Specifically, regarding data usage for artificial intelligence, risks exist that were not sufficiently considered in previous biobank discussions, such as the possibility of re-identification, advanced predictions about sensitive characteristics, and impacts from automated decision-making. Therefore, separate notification methods, the provision of choice options, and oversight standards may need to be reviewed. In conclusion, comprehensive consent serves as a prerequisite that enhances the significance of biobank research, making it a crucial foundation in modern science and technology. However, through ongoing research into the concept and efficacy of comprehensive consent, it is necessary to more clearly define its concept and scope within our legal framework. Institutional measures should focus on reviewing the restructuring of the system, centered on: (1) enhancing the content and methods of disclosure, (2) continuously disclosing the actual scope of use and research for public benefit purposes, (3) clarifying the concept and limits of use for public benefit purposes, and (4) introducing additional control and oversight mechanisms for the use of artificial intelligence. Through this study, we hope that comprehensive consent can function as a normative framework that promotes harmony between the activation of biobank research and the protection of data subjects' rights.

키워드