Abstract
Protection of individual privacy has been the consensus of the world. With the development of information technology, the worries about personal information collection and usage arise once and again in our lives, which also causes the world to pay more attention onto the protection of individual control over ones’ own information. Following this trend and inherited from the concept of “information privacy” called in America and “right to informational self-determination” claimed in German, concerns about information privacy also take root in our legal system, including in the interpretation of Taiwan’s constitutional court and the legislative act. Both Interpretation No. 603 of Taiwan’s Constitutional Court and Personal Information Protection Act in Taiwan reveal several basic principles for any collection and use of personal information, which are almost the same as other countries have indicated. However, most countries set some exemptions against the claim of information privacy when faced with the interest conflict with academic research. After detail comparative analysis of the Data Protection Directive 95/46/EC and General Data Protection Regulation of E.U., Data Protection Act of UK, and Privacy Act and HIPAA Privacy Rule of U.S.A., deficit in personal information protection was found in Taiwan’s academic research exemption. The academic research exemption standard do not vary according to different using stages of personal information; furthermore, the standard itself is a little less flexible since de-identification is the only way to meet the requirement. Although there are some legal data protection obligations upon the data holders, some tailored requirements are needed for specific exemption circumstances. With regard to protection extent, only choosing de-identification process as a way to protect personal information is not sufficent. Considering the other countries legislation, for the stage of information-providing obligation, in order to protect the right to know, keeping data subject knowing and understanding the relevant information should be the principle, except for the situations when notice is pratically impossible and already with some protection measures. Moreover, when personal information is directly from the data subject, notice afterward is needed. For the personal information collection stage, data subject’s consent is the primary consideration. Only when getting consent is impossble or quite difficult, and protection measures are taken can researchers collect personal information on the basis of academic research exemption. For the process and use stage, there is no need to separate process and use into different categories because every behavior on the data should be acted in compliance with the basic principles. For any usage beyond the original colletive aim, general personal data and spcial category data should be distinguished. Protection measures required as in E.U. are needed for general personal data, and a higher-leveled protection standard, such as independent board review or limited data set designed in U.S.A., would be better for special category data. As for the collection permission of special category data, defining some researches inside the lawful collection range and excludeing others research would be too strict. Interests balance as used in E.U. could be considered an alternative way. Besides, individual consent is primary required; unless when consent is impossble or quite difficult, and reviewed by an independent board can researchers collect special category data. If there is any difficulty for the review processs, protection measures are demanded at least. Finally, for the individual rights, right to access shouldn’t be rejected simply for interests balance. Protection measures ought to be considered and taken. Although there is no right to rectification specified in Taiwan’s law, taking the practical situations into account, reject of right to rectification should be allowed when correct is practically impossible and protection measures are adopted. With regard to the right to erasure and right to restriction of process, refusal is permited only if related protection measures are carried out during the research.