全民健康保險個人資料的目的外利用與退出權規範建構

Abstract

我國於西元（下同）1995年開辦全民健康保險後，衛生福利部與中央健康保險署多年來已蒐集接近全人口的健保個資，並將其對外提供予學術研究等進行目的外利用。然而，在我國個資保護法制規範密度不足的背景下，上述政策即引起合憲性的爭議。2022年，憲法法庭就上述爭議作成111年憲判字第13號判決，並認為相關法律部分合憲、部分違憲。為回應本號判決的意旨，立法院已於2025年12月三讀通過全民健康保險資料管理條例。然而，本條例的合憲性與妥適性仍持續引起討論。 在上述研究背景下，本文即以「全民健康保險資料管理條例有關目的外利用與退出權的規定是否合憲、妥適？」作為問題意識，在憲法法庭111年憲判字第13號判決的基礎上，以歐洲聯盟的一般資料保護規則與健康資料空間規則作為參考對象，評析本條例相關規定的合憲性與妥適性。 為回應上述問題意識，本文逐一分析個資保護在我國憲法與歐洲聯盟基本權利憲章上的基礎、我國與歐盟個資保護法制的規範內容。本文認為，全民健康保險資料管理條例仍有若干規定有違反憲法法庭111年憲判字第13號判決意旨之虞，且整體而言，目的外利用或退出權的規範密度仍相當不足。據此，本條例在未來仍有全盤修正的必要，以保障個資主體的資訊隱私權，並有效因應巨量資料與人工智慧時代下的個資需求。

Since Taiwan began developing its National Health Insurance (NHI) system in 1995, the Ministry of Health and Welfare (MOHW) and the National Health Insurance Administration (NHIA) have collected personal NHI data covering nearly the entire population and made such data available to external parties, including academic research institutions, for secondary use. Against the backdrop of insufficient regulatory density in Taiwan's personal data protection legal framework, this policy has given rise to constitutional controversy. In 2022, the Constitutional Court addressed this controversy in TCC Judgment 111-Hsien-Pan-13, holding certain provisions of the relevant legislation to be partially constitutional and partially unconstitutional. In response to the intent of this judgment, the Legislative Yuan passed the National Health Insurance Data Management Act on December, 2025. Nevertheless, the constitutionality and appropriateness of this Act continue to generate debate. Against this research background, this article takes as its central inquiry the question of whether the provisions of the National Health Insurance Data Management Act concerning secondary use and the right to opt out are constitutional and appropriate. Building on TCC Judgment 111-Hsien-Pan-13, the article draws on the European Union's General Data Protection Regulation (GDPR) and the European Health Data Space Regulation (EHDS) as comparative references. These frameworks are used to assess the constitutionality and appropriateness of the relevant provisions of the Act. To address this inquiry, the article systematically analyzes both the constitutional foundations of personal data protection — as grounded in the Constitution of Taiwan and the Charter of Fundamental Rights of the European Union — and the substantive content of the corresponding personal data protection legal frameworks in Taiwan and the European Union. The article concludes that certain provisions of the National Health Insurance Data Management Act risk contravening the intent of TCC Judgment 111-Hsien-Pan-13, and that, taken as a whole, the regulatory density governing secondary use and the right to opt out remains considerably inadequate. Accordingly, a comprehensive revision of the Act will be necessary in the future in order to protect data subjects' right to informational privacy and to effectively respond to the demands placed on personal data protection in the era of big data and artificial intelligence.