Beyleveld D, Histed E
Sheffield Institute of Biotechnological Law and Ethics, UK.
Med Law Int. 1999;4(1):69-80. doi: 10.1177/096853329900400105.
This case commentary analyses a ruling that any use of information given in confidence for unconsented purposes is a breach of confidence capable of supporting a legal action (even if the information has previously been anonymised and aggregated). The ruling is being appealed. It is argued that, while it is reasonable to delineate a narrower duty of confidentiality (not to disclose personal information, against breach of which anonymisation protects), this must be within a broad duty of confidence (not to use private information, which using anonymous information can still breach). Thus, the ruling is fundamentally correct in holding that anonymisation does not permit information obtained in confidence to be used for unconsented purposes. This, however, implies that information obtained for a patient's treatment may not be used lawfully for medical research or NHS management purposes without consent, even if it is anonymised. Such a consequence is unacceptable as a matter of public policy. However, it is equally unacceptable to seek an exemption through the idea that patients give "implied consent" for medical research and NHS management purposes. It is also unacceptable to maintain that the public interest in medical research (regardless of its aims) justifies unconsented use of information obtained in confidence, even if the information is anonymised. The way in which Section 33 of the Data Protection Act 1998 creates an exemption to its Second Data Protection Principle provides a ready-made model for a public interest based exemption for medical research and statistical NHS purposes.
本案例评论分析了一项裁决，即未经同意将保密信息用于其他目的属于违反保密义务，可引发法律诉讼（即便该信息此前已匿名化和汇总）。该裁决正在上诉。有人认为，虽然划定更狭义的保密义务（不披露个人信息，匿名化可防止此类信息被泄露）是合理的，但这必须在广义的保密义务（不使用私密信息，使用匿名信息仍可能违反此义务）范围内。因此，该裁决认定匿名化不允许将保密获取的信息用于未经同意的目的，这在根本上是正确的。然而，这意味着未经患者同意，为其治疗获取的信息即便已匿名化，也不得合法用于医学研究或国民医疗服务体系（NHS）管理目的。从公共政策角度看，这样的结果是不可接受的。然而，通过患者对医学研究和NHS管理目的给予“默示同意”的观点来寻求豁免同样不可接受。认为医学研究的公共利益（无论其目的为何）可证明未经同意使用保密获取的信息合理，即便该信息已匿名化，这种观点也是不可接受的。1998年《数据保护法》第33条为其第二项数据保护原则创设豁免的方式，为基于公共利益的医学研究和NHS统计目的豁免提供了现成模式。
