被遗忘权保护健康医疗数据的实践困境与对策

Practical Dilemmas and Countermeasures of the Right to be Forgotten in Protecting Health Medical Data

欧盟2018年颁布的《通用数据保护条例》(General Data Protection Regulation,GDPR)第十七条规定了被遗忘权这一新型数据权利,但未对被遗忘的数据种类作出特别限制。据此规定,健康医疗数据也可以根据数据主体的要求进行删除或修改,这也是将个人对自身的健康医疗数据控制权交还给个人的体现。这种激进、强势的数据控制权如何在健康医疗领域得以适用,不仅事关我国医疗数据资源保护,而且是充分发挥健康医疗数据价值的应有之义。健康医疗数据作为一种特殊类型的个人数据,不仅关系到个人隐私、信息自决等个人利益,还涉及公众知情、人类健康等公共利益。鉴于法律规定落后于数字技术的发展边界,公共卫生利益与个人利益相互博弈的实践困境,通过外部风险评估与内部分级分类相结合将被遗忘权不同程度地予以适用,找寻个人数据权利与公共卫生集体利益之间的动态平衡,并结合伦理规范层面进行被遗忘权的制度构建,不失为数据时代保护健康医疗数据的可行之道。

Article 17 of the General Data Protection Regulation(GDPR),enacted by the European Union in 2018,establishes the right to be forgotten,a novel data right without specific restrictions on the types of data to be forgotten.Accordingly,health medical data can be deleted or modified at the request of the data subject,thus returning control over personal health medical data to individuals.The application of such an assertive and radical data control right in the health field is crucial not only for the protection of medical data resources in China but also for fully realizing the value of health medical data.Health medical data,as a special type of personal data,concern not only individual interests such as privacy and information self-determination but also public interests such as public awareness and human health.Given the lag in legal provisions behind the development boundaries of digital technology,and the practical dilemma of balancing public health interests and individual rights,combining external risk assessment with internal grading and classification to apply the right to be forgotten to varying degrees can help find a dynamic balance between personal data rights and public health collective interests.Moreover,constructing a system for the right to be forgotten in conjunction with ethical norms is a feasible approach to protecting health medical data in the digital age.