我國於2015年底通過新修正之個人資料保護法（以下簡稱「個資法」），將病歷納入特種個人資料中保護。目前個資法第六條特種個人資料列舉包含病歷、醫療、基因、性生活、健康檢查及犯罪前科之個人資料。雖然該條文係取法自國際賦予敏感性個人資料特別保護的模式，惟在個人相關健康資料保護部分，我國個資法不若歐盟一般資料保護規則（EU General Data Protection Regulation, GDPR）保護寬廣，納入資料之類型仍較國際立法例狹窄。尤其此次GDPR修法擴大特種個人資料空間，增列基因資料、生物性資料和性傾向，檢視我國特種個人資料列舉類型是否符合現今科技社會需求有其必要性。 過去研究針對健康資料個資法適用問題較少。大數據資料來源來自各處，以一般健康保健物聯網模式為例，自行操作之檢查數據或穿戴式裝置所蒐集之資料，若非須由醫師或其他之醫事人員施以檢查，而可由一般民眾自行測量之行為，該民眾自行測量之結果應不屬於個資法所謂之病歷、醫療或健康檢查個人資料，即非為特種個人資料。 惟大數據分析技術進步之環境下，健康資料亦攸關資料主體生理健康之敏感性，且容易連結並識別個人，考量健康資料敏感性提升，蒐集、處理、利用健康資料易侵犯到個人隱私，因此有加強保護之需求。將來可刪除個資法第六條第一項各種個人資料例示之「醫療」、「病歷」與「健康」資料，並新增「健康」或「與健康相關」之列舉項目。 但解釋「與健康相關」資料之內涵時不能無限上綱，在適用時應考量情境說，依據不同使用情境判斷是否為係作為特種個人資料利用，以排除一般性描述健康的使用情境。 / The change to the regulation of special categories of data (sensitive data) in the Taiwan Personal Information Protection Act (PIPA) in 2015 comes with the inclusion of medical records. The definition of sensitive data in the PIPA Article 6(1) refers to personal information of medical records, medical treatment, genetic information, sexual life, health examination and criminal records. However, the list of sensitive data in PIPA do not contain categories as broad as foreign legislation such as EU General Data Protection Regulation (GDPR). It is important to review the continuing relevance of existing categories of sensitive data in the light of change in social structures and advances in technology. Differ from “medical data” such as medical records, medical treatment and health examination, the collection, process and use of “health data” which is measured from wearable device, is not included in the sensitive data. Concerning the development of big data analysis, the “health data” which sensitivity enhanced is easy to identify an individual. It needs to give a higher level of protection to “health data” under PIPA. Therefore, this thesis suggests that medical records, medical treatment and health examination in PIPA Article 6(1) should be consolidated and amended to health records or data concerning health. However, this is not to say that the processing of all kinds of medical and health data should be regarded as the processing of sensitive data. But data, under certain contexts/circumstances may be treated as the processing of sensitive data.

La protection des données personnelles sensibles consistait, jusqu'au RGPD, en un contrôle préalable réalisé par une autorité indépendante, malgré l’obstacle posé à la libre circulation. Cette protection renforcée est aujourd'hui remplacée par l’obligation du responsable de traitement d’élaborer une étude d’impact. Une telle mutation implique un risque de pré-légitimation des traitements et peut être favorable au responsable de traitement. Or, est-elle conforme au droit fondamental à la protection des données personnelles ? La thèse interroge le contenu de ce droit et la validité du RGPD. À partir d'une étude comparative allant des années 1970 à nos jours, entre quatre pays et l’Union européenne, les données personnelles sensibles sont choisies comme moyen d'analyse en raison de la protection particulière dont elles font l’objet. Il est démontré qu’en termes juridiques, la conception préventive fait partie de l’histoire de la protection européenne des données et peut donner un sens à la protection et à son seul bénéficiaire, l’individu.Un tel sens serait d’ailleurs conforme aux Constitutions nationales qui garantissent aussi l’individu malgré leurs variations. Cependant, cette conception n’est pas forcement compatible avec l’art. 8 de la Charte des droits fondamentaux de l’UE. La thèse explique que cette disposition contient la garantie d’une conciliation (entre les libertés de l’UE et celles des individus) qui peut impliquer une réduction de la protection de ces dernières. Or, il revient à la CJUE, désormais seule compétente pour son interprétation, de dégager le contenu essentiel de ce droit ; objectif auquel la thèse pourrait contribuer. / Before the GDPR, protection of sensitive personal data consisted of a prior check by an independent authority despite limiting their free movement. This has been replaced by the obligation of the controller to prepare a privacy impact assessment. With this modification, one can assume a risk of pre-legitimization of data processing, putting the controller at an advantage. Is that compatible with the fundamental right to the protectionof personal data ? This thesis questions the content of this right and the validity of the GDPR. It is based on a comparative study from 1970s until present day between four European countries and the European Union, in which sensitive data are chosen as a meanto the analysis due to their particular protection. Research shows that in legal termsthe preventive conception is a part of the history of protection in the European Union. By limiting freedom of processing it gives meaning to protection and its only subject,the individual. Such an interpretation is compatible with National Constitutions despite their variations. However, the preventive conception of data protection is not so easily compatible with article 8 of the European Charter of Fundamental Rights. The thesis puts forward that this article contains the safeguard of a balancing, between EU liberties and individuals’ freedoms, which implicates reduced protection. It is up to the European Court of Justice to identify the essence of this right, an aim to which this thesis could contribute.