The Constitutional Court on April 26 held an oral argument on whether allowing the use of National Health Insurance (NHI) data for academic research conflicts with the principle of legal reservation and proportionality as well as the spirit of the constitution.

The petitioner said that the European Union’s General Data Protection Regulation (GDPR) stipulates that government agencies may only collect personal data on a mandatory basis for specific, explicit, and legitimate purposes. However, in Taiwan, large scale collection of NHI data is only backed by the Personal Data Protection Act and the National Health Insurance Act, which violates the principles of legal reservation and proportionality.

While the NHI data used in academic research will be pseudonymized, there are still indirect risks of re-identification. In addition, the lack of public notices about the use of NHI data is also in violation of procedure. The petitioner also said that while a sample size of 2 million should be sufficient for most academic research, authorities have not provided the option for people to opt out of having their NHI data collected. Further, the lack of the option for users to withdraw their consent to the collection and processing of their personal data has denied the basic right to privacy of some people.  

The National Health Insurance Administration (NHIA) said that the Persona Data Protection Act has detailed stipulations on the limitations, requirements, and principles on the use of personal data to ensure the protection of privacy. The NHIA added that its data pseudonymization methods are effective in preventing re-identification and as the lack of opt-out consent can be addressed by legislation, it is not necessary to consider the use of NHI data as a violation of the constitution.

The National Development Council said that constitutional court justices should provide a degree of discretion for legislation, as well as flexibility for government agencies to meet their specific remits. The Ministry of Health and Welfare said that if constitutional court justices require complete pseudonymization of data and the option for users to withdraw their consent to the processing of their personal data, sampling errors could occur and hamper research efforts of academia and industries, which is inconducive to disease prevention and could possibly lead to greater crisis.

[2022-4-26/Liberty Times]