本文以新冠疫情为背景，深入探讨在现今大数据时代下所造成对于医疗敏感个人信息侵害增加之趋势与现况，并重新研究探讨此种对于医疗敏感个人信息新型态侵害于民事侵权行为法上，是否有已存在的请求权基础？以及是否应修正现有的请求权，以使医疗敏感个人信息遭受侵害者，得获得在法律上足够的保障。又考量海峡两岸目前存有不同的法律制度，依照不同的立法目的与精神正按部就班地分别运行中，是于遭受相同医疗敏感个人信息新型态侵害时，虽侵害态样相似，但可能因适用两岸不同法律而产生完全不同的法律效果，故本文将通过比较法分别研析我国台湾地区“个人资料保护法”与中国大陆《个人信息保护法》的立法背景、精神以及规范方式，以进一步了解我国台湾地区及中国大陆法规范体系对于医疗敏感个人信息保护的保护权源，并依照比较法方法研究后所得之结果做出本文的诠释。在探讨前述问题的基础之上，本文分别深度详述，我国台湾地区与中国大陆不同法治下对于医疗敏感个人信息的侵害，及受侵害时可能的救济途经，亦即，以民事侵权行为作为请求权基础或以“个人资料保护法”、《个人信息保护法》等有关保护医疗敏感个人信息的特别法作为请求权基础之异同，同时，本文亦探讨前开民法与个人信息保护特别法间在个人信息、敏感性个人信息、医疗敏感个人信息的定义及保护医疗敏感个人信息上的法律适用及竞合关系。最后，综合上述研究成果，本文认为有鉴于医疗敏感个人信息得以连接到个人疾病史进而影响个人甚至整体社会，而对于国家公共卫生层面造成严重损害的特殊性，两岸法规范皆可研拟提高对于医疗敏感个人信息的保护程度，并建立特别适用于保护医疗敏感个人信息而有别于适用于一般个人信息受侵害的侵权行为请求权基础，以依不同保护必要性而做出不同保护程度的区别保障；于中国大陆法规范部分，因现行《个人信息保护法》对于医疗敏感个人信息的定义要件采取列举兼概括性的一定模糊定义方式，造成对于医疗敏感个人信息的保护范围不明，而可能造成对其保护程度的不足，此或可借由借鉴我国台湾地区「个人资料保护法」就医疗敏感个人信息的搜集、处理、利用等行为，依照不同行为主体而区分为公务机关与或非公务机关，并给予不同的法律适用体系。
This article delves into the increasing trend and current situation of the infringement of sensitive personal medical information in this big data era in the context of the COVID-19 pandemic. This article further reexamines and explores whether there is an existing legal basis for claims regarding this new form of infringement of sensitive personal medical information under civil tort law. Considering the different legal systems currently in place across the Taiwan Strait, operating independently in accordance with their respective legislative purposes and principles, it is important to note that when facing similar infringements of new forms of sensitive personal medical information, the legal effects may differ significantly due to the application of different laws on both sides.Based on the research findings, the ability of sensitive personal medical information to be linked to individuals‘ medical histories and its potential impact on individuals, it is advisable for the legal regime from both Taiwan Strait to consider enhancing the protection level. It is recommended to establish a distinct basis for claims in cases of infringement of sensitive personal medical information, separate from the basis applicable to general personal information, in order to provide differentiated safeguards based on the varying levels of protection required.In the context of Mainland China‘s regulatory framework, the current Personal Information Protection Law adopts a combination of enumerated and generalized criteria in defining sensitive personal medical information. This approach introduces a certain level of ambiguity regarding the scope of protection for sensitive personal medical information, potentially resulting in insufficient protection. This issue may be addressed by drawing upon the Personal Data Protection Act of Taiwan District. Specifically, the processing of sensitive personal medical information could be differentiated based on the entities involved, distinguishing between governmental and non-governmental organizations, and providing separate legal frameworks for each.
