保險業適用個人資料保護法問題研究—以保險法第177條之1及個人資料保護法第3條為核心

Abstract

隨著「資訊時代」來臨，隱私權概念延伸至個人資料之保護，強調個人對自身資料之自我決定權，個人資料保護相關議題頗受各方重視，國外無不致力於建立切合時勢之個人資料保護架構。我國同樣於此時空背景下，於2010年將1995年之電腦處理個人資料保護法修正為個人資料保護法，然而我國個人資料保護法之修法與施行歷程，可謂一波三折，首次公告後延宕兩年才施行，首次施行又凍結部分條文，包括個資法第6條關於敏感性個資蒐集、處理或利用之條文，後又再次針對部分條文進行修正，始成為現行之個資法。\r\n 又保險業係高度依賴個人資料之產業，無論保險銷售、核保或理賠等程序，蒐集、處理或利用客戶個人資料乃必要手段，敏感性個人資料更是壽險業的重要核心。以此作為問題發想之起點，本研究發現兩大問題，其一，個資法第6條與保險法第177條之1條之應用問題，由於自現行法觀察，此二條文內容似乎部分重疊，因而保險法第177條之1妥適性存有疑問；其二，即使個人資料係保險業不可或缺之資料，個資法第3條仍明文當事人擁有個資刪除權等權利，若要保人或被保險人於人身保險存續期間請求刪除其個人資料，保險業應如何應對，保險契約是否受到影響。\r\n 基於保險業必然涉及個人資料之特性，本研究以「個資之蒐集處理利用和個資自決權」作為中心而開展，整理比較國內外個資保護架構，目的係在了解「保險業與個人資料保護」間之互動，並針對上述保險業適用個人資料保護法之兩大核心問題，嘗試提出未來修法方向或可行之因應對策供各方參考，希冀透過本研究能引起相關單位之重視與討論。

The \"information age\" has come. The concept of privacy rights has extended its scope to the protection of personal information with the focus on the right to information self-determination of individuals. The issues related to the protection of personal information have been highly regarded by all parties concerned, and most foreign countries endeavored in the establishment of personal information protection structures that meet contemporary requirements. With the same background at the same time, our country modified the Computer-Processed Personal Data Protection Act enacted in 1995 into the Personal Information Protection Act in 2010. However, the processes of the modification and enforcement of the Personal Information Protection Act in our country were not so smooth. The act was actually enforced 2 years after the first public notification of it, and part of its content which includes the provision about the collection, processing and use of sensitive personal information in Article 6 was paused to be enforced at the very beginning. Part of its provisions were amended again after that, and the current Personal Information Protection Act was thus formed.\r\n The insurance industry highly depends on personal information. The collection, processing and use of clients` personal information are necessary no matter the case is about a sale of insurance, an underwriting or a compensation, and sensitive personal information is the core of the business operation of Life Insurance Company. With this fact as the starting point for thinking, 2 major questions were discovered in the study. First, there is a question concerning the application of Article 6 of the Personal Information Act and Article 177-1 of the Insurance Act. On observing the existing law, there are repeated parts in the contents of the 2 provisions, and therefore the appropriateness of Article 177-1 of the Insurance Act is questionable. Second, even if personal information is necessary for the insurance industry, Article 3 of Personal Information Protection Act still specifies that the concerned party of an insurance case has the right to ask for the deletion of his/her personal information provided to an insurance company. What should an insurance company do if an applicant or an insured person asks to delete his/her personal information during the validity period of his/her insurance policy? And is the effectiveness of the insurance policy affected?\r\n Based on the nature that personal information must be involved in the insurance industry, the study was developed with \"the collection, processing and use of personal information and the right to information self-determination\" as its core. Different structures for the protection in the world were compiled and compared for understanding the interaction between \"the insurance industry and personal information protection\", and the possible directions for the amendment of the acts and feasible coping measures were proposed as reference for all concerned parties. It is hoped that the study may draw the attention of the authorities concerned and trigger further discussions.