论个人医疗信息的匿名化处理制度——兼评《个人信息保护法》相关条款

On the Mechanism of Anonymization of Personal Medical Information—With the Relevant Provisions of Personal Information Protection Law

构建完善的匿名化处理制度是化解个人医疗信息利用困局的可行选择。匿名化是指通过对个人信息的技术处理,使得个人信息主体无法被识别,且处理后的信息不能被复原的过程。按照法定标准匿名加工后的信息不再属于个人信息,从而不再受同意规则之约束。个人医疗信息具有特殊性,既应进行更高标准之保护,又应推动更高程度之利用,有必要予以特别规制。我国《个人信息保护法》关于匿名化制度的规定仍有不少缺憾,首先应当补齐短板,形成制度闭环,完善一般性的匿名化处理制度。在此基础上,我国应对个人医疗信息的匿名化进行特别规制,由政府统一认定汇集和匿名加工个人医疗信息的专门机构,规定更严格的准入标准和工作流程,由认定机构对信息的安全负责,且认定机构自信息控制者接收个人医疗信息时适用默示同意规则。

Building a systematic mechanism of anonymization is a feasible way to resolve the utilizing dilemma of personal medical information.Anonymization is the process of letting personal information unidentified and unrecovered by technical means.The information is no longer personal information through the process of anonymization and thus not bound by the rule of consent.Personal medical information is unique which calls for both a higher standard of protection and a higher degree of utilization.It should be regulated particularly.Our Personal Information Protection Law is defective and we should make up for defects to construct a more complete general system of anonymization.On this basis,we ought to regulate the anonymization of personal medical information particularly.Our government should authenticate the specialized institutions that are responsible for collecting and processing personal medical information at a higher level,and in the meantime,authenticated institutions apply to rule of implied consent when receiving personal medical information from the controllers.