Assessing Legal and Ethical Considerations for Processing Digital Medical Data in China: Framework,Issues,and Policy Recommendations

1. Individual Control Right/Informed Consent

The Personal Information Protection Law responds to the practical problems of citizens’ personal information data protection in the form of law and conforms to the trend of data protection, aligning with the developmental demands of the information era. It also conforms to the development of internet hospitals and protects the data health and privacy security of patients from the legal level. In particular, the law defines “medical and health information” as “sensitive information.” The processing of sensitive information thus requires the individual “personal consent” of specific patients, and individuals should be informed of the necessity of processing sensitive information and the impact on their personal rights and interests. The procedure requires a risk assessment of sensitive data in advance, and the entire process of treatment needs to be fully documented. ⁴⁸

2. Institutional Obligations

As the processing body of DMD, medical and health institutions have the professional obligation to protect patients’ personal information. These obligations, reflected in the daily work of healthcare organizations, are the core content of their data compliance obligations. For medical and health institutions, DMD is not only the basis for providing services to patients, but also a huge asset. When considering compliance obligations, it is necessary to fully consider the various risks of data processing and the multi-faceted and multi-layered nature of DMD and then prevent risks through compliance construction.

At the national level, since 2016, China has successively introduced many policies and regulations to regulate the security of medical and health data. These include “Guiding Opinions on Promoting and Regulating the Application and Development of Big Data in Health Care,” ⁴⁹ “Internet Diagnosis and Treatment Management Measures,” “Internet Hospital Management Measures,” “Telemedicine service management Standards,” “National Health Care Big Data Standards, Security and Service Management Measures (Trial),” etc. ⁵⁰ The “Information Security Technology Health and Medical Data Security Guide” implemented in July 2021, ⁵¹ also guides the processing subjects of DMD to manage data security from the standard.

Many local regulations have also been introduced to regulate the processing of DMD. For example, the Regulations on the Application of Big Data for Health Care in Guiyang City ⁵² and the Measures for the Management of Big Data for Health Care in Shandong Province are the first local regulations to restrict the collection, ⁵³ aggregation, storage, development, application, and supervision and management of DMD in respective administrative regions.

3. Security Impact Assessment

In the healthcare industry, especially in hospitals, data security is of paramount importance. The healthcare sector, particularly hospitals, is a focus area for data security risk assessment because of the large amounts of sensitive personal health information it stores and processes. Data breaches not only threaten patients’ privacy, but they can also have a serious impact on a hospital’s reputation and operations. Data breaches or improper use can lead to patients’ privacy violations, medical malpractice claims, and other legal liability. Therefore, conducting a data security risk assessment is a fundamental step in ensuring the security of DMD.

Hospital institutions are required to comply with relevant data protection regulations, such as the Cybersecurity Law of the People’s Republic of China and the Personal Information Protection Law. Meanwhile, hospitals should develop internal data security policies to clarify the security requirements of data collection, storage, transmission, and destruction.

4. Second Use Compliance

DMD is divided into population health information, human genetic resources information, medical record information, and health and medical big data. Under China’s current law, the use of health and medical data has clear provisions.

OPEN IN VIEWER

DMD type	Data usage regulations
Population health information	In 2014, the “Measures for the Management of Population Health Information (Trial)” established the principle of “interconnection and shared utilization” of population health information, requiring relevant units to establish a comprehensive utilization system and authorize the use of relevant information based on the purpose of improving medical research, scientific decision-making, and convenient services. 54 In 2019, China’s State Council issued the Regulations on the Management of Human Genetic Resources, establishing the legislative principle of “protection + utilization,” advocating the full use of health and medical data within the scope of use, on the basis of protecting personal information and privacy. 55
Human genetic resources information	The Regulations on the Administration of Human Genetic Resources stipulate that “trading” of human genetic resources information is prohibited, but the provision or use of human genetic resources for scientific research in accordance with the law and the payment or collection of reasonable costs are not regarded as trading, and the use of information shall comply with the technical norms formulated by the administrative department of science and technology under The State Council. 56 In addition, foreign organizations and foreign institutions (including institutions actually controlled by foreign organizations and individuals) that need to use China’s human genetic resources to carry out scientific research activities should be carried out in cooperation with Chinese units such as Chinese scientific research institutions. The BioSafety Law stipulates that overseas organizations, individuals, and institutions established or actually controlled by them shall obtain approval for the acquisition and utilization of China’s biological resources in accordance with the law. 57
Medical record information	The Medical Records Management Regulations of Medical institutions have strict regulations on the use of medical records. 58 The purpose of the use of medical record data: Medical institutions and medical personnel are required not to disclose patient medical record data for non-medical, teaching, and research purposes. In terms of the main authority to consult medical records: Except for medical personnel providing diagnosis and treatment services for patients, and relevant responsible personnel of relevant administrative and management departments, and other personnel related to medical records, other institutions and individuals shall not consult patients’ medical records without authorization.
Health and medical big data	According to the provisions of the National Health and Medical Big Data Standards, Security and Service Management Measures (Trial), the responsible unit shall establish strict electronic real-name authentication and data access control, standardize the trace management of data access, use and destruction process, and ensure that the health and medical big data access behavior can be managed and controllable, and the service management can be queried and traceable. Any data leakage accident and risk can be traced back to the relevant responsible unit and responsible person. 59

1. Group Bias and Other Data Flaws

There is a real problem of group bias in the application of DMD, which is a challenge that cannot be ignored. This bias can come from many sources, including data collection, processing, algorithm design, and clinical decision-making.

First, sample selection bias and data recording bias exist in the DMD collection stage. In the collection of DMD, if the sample selection is not representative, for example, only focusing on some specific groups (such as high-income groups, specific geographical or ethnic groups) and ignoring other groups, the collected DMD will not truly reflect the actual situation of the overall patient population. ⁶⁰ This bias will directly affect the implementation of subsequent data analysis and precision in medicine. In addition, data recording processes may be inaccurate or incomplete as a result of human error or technical deficiencies, which can further lead to data bias. This bias can also affect the accuracy and reliability of data analysis, which in turn may exacerbate neglect of or discrimination against certain patient groups.

Second, algorithmic bias and data interpretation bias exist in the data processing and algorithm design stage. ⁶¹ The design and application of algorithms may be embedded with designer bias or influenced by training data. If the training data itself is biased (such as by race, gender, or socioeconomic status), then the algorithm will likely produce unfair results when dealing with different patient groups. This bias may further intensify health inequalities. During the interpretation of DMD, subjective consciousness or preconceived notions of researchers or doctors may lead to bias. This bias can affect the objectivity and impartiality of medical delivery, resulting in certain patient groups unable to receive the attention and treatment they deserve.

Third, doctors’ subjective judgment and experience bias, imperfect medical system, and asymmetrical information exist in the clinical decision-making process. ⁶² Doctors’ clinical decisions may be influenced by their subjective judgment and experience. Different doctors may offer different treatment plans for the same condition, and this difference may be caused by the physician’s knowledge level, experience, and personal bias. This bias can lead to different treatment regimen for different patients, resulting in unequal treatment outcomes. The imperfection of the medical system and information asymmetry are also one of the important reasons leading to bias in clinical decision-making. Due to the uneven distribution of medical resources and asymmetrical information, some patients may not have access to the best treatment options. This bias further exacerbates health inequalities.

2. Privacy Risks

In the era of AI, the use of DMD may result in conflicts of interest. Individuals’ control over their own health information is weakened, and the traditional informed consent model plays a limited role. This is, coupled with the absence of industry standards and the technical barriers of “algorithm black box,” which all lead to the dilemma of personal privacy protection in the use and construction of DMD.

There may be a conflict between the public nature of the construction of DMD and the private needs of protecting personal privacy. Article 1226 of the Civil Code stipulates the obligation of medical institutions and their medical staff to keep confidential the privacy and personal information of patients. Medical institutions or their medical staff shall bear tort liability if they disclose the privacy and personal information of patients or disclose the patient’s medical records without consent. Article 12 of the Law of the People’s Republic of China on the Prevention and Control of Infectious Diseases also has similar provisions, but when these provisions are implemented, personal privacy is infringed due to asymmetrical information. Such infringements are often manifested by medical professionals simplifying procedures or downplaying informed consent, failing to implement adequate protection measures for patient privacy. Even when patients seek redress afterward, they face high costs and delays in resolution.

Privacy policy is an important way to measure the legality of the collection and use of users’ personal information by internet service providers. It is not only a tool of enterprise autonomy but also related to the protection of users’ personal information. It seems that providing privacy policy agreements to users can guarantee the security of personal DMD. However, due to the absence of unified industry standards and the practical obstacles of “algorithm black box,” individual subjects are in a relatively weak position, and personal information is still likely to be infringed.

1. Optimizing Individual Permit and Authorization

The principle of informed consent is a fundamental principle in the norms for personal information protection. ⁶³ Article 13, Paragraph 1, Subparagraph 1 of the Personal Information Protection Law stipulates that the consent of the individual shall be obtained for the processing of personal information. The Personal Information Protection Law is very cautious about the processing of DMD. Articles 28–32 of the Personal Information Protection Law also formulate specific processing rules for sensitive personal information. The theoretical basis of the principle of informed consent is the rational person assumption. “The rational person assumption holds that the information subject is rational and can make decisions that are best for their own interests.” ⁶⁴ Personal information processing licenses and authorizations face the problem of being rendered ineffective in practice. Information for subjects vary greatly and may not all have the ability to make rational decisions. There are structural problems with personal licensing and authorization mechanisms, which cannot truly safeguard the information self-determination of information subjects.

These structural problems are mainly reflected in the following aspects: (1) Informed consent is formalized. Some platforms adopt an “all-or-nothing” authorization model, where users cannot access core features if they refuse non-essential permissions. Certain medical apps often require one-time authorization for unrelated permissions (e.g., contacts, location), while privacy agreements typically suffer from excessive jargon and hidden key information, making them difficult for users to understand. This reduces consent to a mere formality. (2) The authorization chain suffers from unclear accountability and secondary authorization loopholes. After initial consent, DMD often undergoes multiple transfers to third parties, during which data subjects typically lose control over their information. For instance, when medical institutions use anonymized data for research purposes, they may fail to explicitly inform patients that their data could be utilized for AI training. (3) Dynamic consent is lacking. Current authorization mechanisms primarily rely on static one-time approvals, which fail to meet scenario-specific requirements. For instance, patients’ varying privacy protection needs at different stages of diagnosis and treatment have not been incorporated into system design.

First, the principle of informed consent is hard to be taken seriously by patients. If patients have to choose between protecting DMD and disease recovery, they will inevitably give priority to the latter. Physical recovery is the goal of patients seeking medical treatment. Patients cannot lose sight of the essentials for the trivial.

Second, patients are faced with a false choice when it comes to making informed consent decisions. Medical institutions must obtain patients’ DMD to carry out effective diagnosis and treatment. Patients must agree to provide their DMD to obtain medical services. In fact, there is no other choice.

Third, there is a problem of formalization in the decision-making of informed consent for patients. When doctors are diagnosing patients, it is impossible for them to explain in detail to each patient the policies of medical institutions on handling their DMD. This does not conform to our medical experience, and patients find it difficult to clearly understand the social significance of their DMD processing permission. Additionally, privacy policy documents are usually complex in content and full of professional terms, resulting in difficult reading for the common person. Moreover, they are highly likely to contain general or blanket authorization provisions, or vague and broad informed consent, which can affect the post-event judgment of whether the informed consent of patients is genuine.

Personal permission and authorization are the gatekeepers of information processing. It is necessary to conduct rights confirmation for DMD to optimize personal permission and authorization. In China, data rights confirmation faces theoretical supply issues. The countermeasure proposed in the “Opinions on Establishing a Data Base System to Maximize a Better Role of Data Elements” is to separate the three rights—data resource holding rights, data processing and usage rights, and data product operation rights. This “three rights separation” system represents a core innovation in the market-based allocation of data elements. By structurally separating data property rights, it provides institutional safeguards for compliant and efficient data circulation. ⁶⁵ DMD originates from patients, but it only becomes valuable after being managed by medical institutions. The value of DMD is typically public. Only when DMD held by medical institutions is combined with that held by other medical institutions can its value be maximized.

First, patients are the original source of DMD, but they should not enjoy ownership or other exclusive rights over DMD. Instead, they should prevent others from infringing upon their private information in a way that protects their privacy interests. ⁶⁶ Therefore, it should be recognized that medical institutions enjoy the property rights of DMD resources, and hospitals can properly use desensitized DMD within their fields based on actual control over DMD.

Second, different personal licensing, authorization methods, and exceptional circumstances should be set up based on different data needs such as patients’ visits, clinical research, and the secondary utilization of DMD by third parties, such as government departments, researchers, or enterprises, etc. In secondary DMD utilization, the purpose of DMD usage is no longer the same as those informed patients at the time of data collection. Objectively, from clinical treatment to clinical research and then to third-party utilization, patients are increasingly lacking the right to know about the property rights and uses of DMD. Informed consent required for clinical research can be obtained through broad consent when patients visit the hospital. Such DMD can be used for future clinical research without identification. The use of raw patient-derived data, and of curated but patient-identifying DMD, should be strictly limited to the treatment of a patient’s own condition. Medical institutions should establish clear data processing policies when acquiring and managing patient data, including measures for data classification, collection, transmission, storage, usage, disclosure, sharing, and audit management, to ensure patients’ right to informed consent. Patients should be prompted through electronic or article medical records and other carriers to ensure that they can access the data processing policy and exercise their data rights at any time.

Third, in secondary DMD utilization, due to the change in the purpose of data collection, the subject of data processing also changes. Medical institutions should once again seek the explicit authorization of patients. Medical institutions need to inform patients in a positive and clear way of the future application scenarios of their personal DMD, and make it easy to contact patients by email, SMS, WeChat, and other effective ways to ensure their rights to know. Medical institutions can directly use DMD in response to public health emergencies or to protect the life, health, and property safety of natural persons in emergencies, but this cannot be used as an excuse to refuse to notify patients whose identifiable information may be released. The important purpose of DMD is to support the development of public health. Public health data formed by public health management departments using relevant data of medical institutions belonging to public data and should strengthen the de-identification of relevant data. In DMD processing, it is crucial to determine which ranges of medical and health data are absolutely not allowed to undergo re-identification operations. ⁶⁷

In short, medical institutions and subjects collecting DMD should separately ask patients whether they can authorize it and clearly guarantee the patient’s right to be forgotten unless that specific DMD is found to be helpful to restore for specific individuals’ healthcare.

2. Creating Three Types of Obligations

The key to exempting medical institutions from unfair legal liability is to build compliance systems for DMD and effectively fulfill their compliance obligations on DMD. The Decision of the Standing Committee of the National People’s Congress on Strengthening Information Protection on Networks, the Civil Code, and the Personal Information Protection Law all put forward that information processing should abide by the principles of legality, reasonability, and necessity, and the implementation of these principles is the key for medical institutions to fulfill their obligations in personal information processing. ⁶⁸ Under the rights framework separating the three rights, the obligations of medical institutions regarding DMD will vary.

In China, some scholars believe that the performance of hierarchical obligations is directly related to the legitimacy of the use of medical data and the standardized exercise of the right to use medical data. The relevant obligations are divided into general obligations, ancillary obligations, and special obligations. ⁶⁹

General obligation refers to the “fair use” obligation of medical institutions on DMD. Medical institutions must consider the interests of other subjects and the public interests when using DMD. The core of the ancillary obligations is to distinguish DMD resources from data products and set the obligations of commercial entities. The obligations that commercial entities acquire when they obtain the right to use DMD in accordance with the data contract are the ancillary obligations of the data contract.

The ancillary obligations of a medical data usage license contract mainly include the payment of benefits and the avoidance of infringement. The former is the duty of fidelity, and the latter is the duty of care. The realization of the right to use medical data resources by commercial entities is premised on the fulfillment of the obligation of reasonable utilization, which requires a reasonable purpose of use, a reasonable scope of use, and a reasonable way of use. The realization of the right to use medical data products by commercial entities is premised on the fulfillment of the obligation of fair competition, which requires commercial entities not to violate the competitive order and not to cause damage to market competition.

The special obligation for regulatory entities refers to the public welfare priority protection obligation of medical data, which is the justification standard for the exercise of the right to use medical data by the regulatory institution. The priority duty of public welfare protection of medical data is mainly reflected in procedures. The first is to obtain and use medical data in accordance with legal procedures, the second is to maintain the record and supervision of the whole process, the third is the sealing system of administrative and judicial files involving sensitive medical data, and the classification and use of medical data.

We argue that these three obligations proposed are distinguished from the scenario where DMD is utilized and the burdens data processors carry. The key to understanding these three obligations lies in the three principles of legality, justification, and necessity. From general obligations to ancillary obligations and then to special obligations, the processing requirements for DMD are becoming increasingly specific, and the possibility of data processing losing control also increases. When processing subjects of DMD are medical institutions, the security status of DMD depends on the self-restraint of medical institutions, and data security is an internal issue of medical institutions. When data processing subjects expand to other medical institutions, especially commercial subjects, data processing activities need to balance the interests of all subjects involved. Any compliance activity has a cost, and the more specific and directed the attributes of digital health data, the more valuable the data will be.

The three principles of legality, justification, and necessity can build the processing program for data processors, govern the purpose principle and other principles, and draw the bottom line that data processing subjects should abide by. The principle of legality requires that data processing must comply with the normative guidance of laws and regulations, while the principle of justification requires that the purpose and means of data processing should be justified.

The principle of necessity requires that data processing should not exceed the necessary limit to achieve the purpose of processing, which also derives from the principle of proportionality and other subprinciples. For commercial subjects, economic interests are the fundamental motivation for the processing of DMD, and they are also the most likely cause of data security problems. Therefore, the principle of justification requires that the accompanying obligation with fiduciary duty attribute limit the data processing behavior of commercial subjects. When data processors change from private entities to government agencies, public interests replace economic interests and become the motivation and purpose of data utilization behavior.

By doing so, it is necessary to prevent individual rights from being infringed upon in data processing. Furthermore, it is necessary to synchronously set the authorization rules to set the right to use DMD of the management institution and ensure the public welfare of DMD through compulsory rules.

3. Promoting Responsible and Explainable Security Impact Assessment

According to the provisions of Articles 55 ⁷⁰ and 56 ⁷¹ of the Personal Information Protection Law, personal information processors should conduct personal information protection impact assessments before processing sensitive personal information. The content of the assessment should include whether the purpose and method of processing of personal information are legal, justified, and necessary, the impact on personal rights and security risks. The assessment should also ask whether the protective measures taken are legal, effective, and appropriate to the level of risk. These personal information protection impact assessment reports and processing records shall be kept for at least three years. Health care institutions should follow these rules when handling DMD.

The above provisions of the Personal Information Protection Law cannot effectively guide the development of DMD security impact assessment in practice. First, the coverage of personal information security impact assessment is not clear, and there is a lack of quantitative standards for evaluating the effect at the legal level. In Article 55 of the Personal Information Protection Law, the processing of sensitive personal information is only one of the circumstances where a personal information protection impact assessment should be conducted. Article 13 of the Personal Information Protection Law stipulates that an assessment should be completed in six other situations besides “obtaining individual’s consent.”

Since the processing of personal information in the other six situations does not require informed consent, the need for security impact assessment of personal information processing should be greater. However, current legal provisions do not include these situations in which a security impact assessment should be carried out. Second, the content of personal information security impact assessment is broad and general, and it is difficult to apply its guidance in practice. Article 56 of the Personal Information Protection Law stipulates the content of personal information security impact assessment, which is too programmatic to guide practice. The guidance on the security assessment of personal information processing needs should be more specific and interpretable.

A responsible security impact assessment means that it can properly achieve its normative purpose and can be effectively implemented in practice. An interpretable security impact assessment means that the concepts of the relevant terms of the system are clear, without controversy, and can be implemented in good faith in practice.

Personal information security impact assessment is a mandatory self-restraint, which is a precompliance assessment and risk assessment procedure. ⁷² The EU General Data Protection Regulation (GDPR) provides for a data protection impact assessment for data processing activities that may create a high risk to the rights and freedoms of natural persons. The GDPR’s data protection impact assessment is a model for the formulation of specific provisions on information (data) security impact assessment in China. The purpose is to improve recommended national standards. ⁷³ National standards are not the source of law. Compared with normative documents such as law, which are guaranteed by national compulsory force, national standards belong to “soft law.” They are derived from practice and used in practice, serving the purpose of refining the provisions of normative documents such as laws and regulations. The governance effect of these national standards is complementary and important to the formation of normative documents.

In terms of personal information security impact assessment, the Information Security Technology Guidance for Personal Information Security Impact Assessment (GB/T 39335-2020) specifically standardizes the development of such assessment. The standard defines key terms for personal information security impact assessment. For example, Article 3.4 defines personal information security impact assessment as “in view of personal information processing activities, checking their legal compliance, judging their various risks of damaging the legitimate rights and interests of personal information subjects, and a process for assessing the effectiveness of measures used to protect the subject of personal information.” The normative purpose of personal information security impact assessment is to evaluate the value of information and data processing work. Article 4.2 of the above standards defines the evaluation value as “it can effectively strengthen the protection of the rights and interests of the personal information subject, help the organization to display its efforts to protect the personal information security, enhance transparency, and enhance the trust of the personal information subject.”

In promoting the construction of a responsible and interpretable security impact assessment mechanism, the assessment procedures and contents should strictly focus on the purpose of DMD security, and also pay attention to the reality that DMD is sensitive personal information.

Concerning the issue of assessment procedures, Information Security Technology Guide for Personal Information Security Impact Assessment (GB/T 39335-2020) divides the assessment implementation process into nine elements, such as assessment necessity analysis, assessment preparation, data mapping analysis, risk source identification, individual rights and interests impact analysis, security risk comprehensive analysis, assessment report, risk disposal and continuous improvement, and formulation of report release strategy.

Some scholars argue that personal information security impact assessment should pay special attention to four aspects: participation procedure, review procedure, realization consultation procedure, and public procedure. ⁷⁴ In the security impact assessment procedure of DMD processing, special attention should be paid to the review and the implementation of the consultation procedure. In the processing of DMD, the nature of the review procedure is continuous monitoring, which contributes to the continuous security of DMD. The prior consultation procedure refers to the provisions of Article 36 of the GDPR to seek effective external assistance in the event of difficulties in the processing process, so as to avoid long-term difficulties for the information processing subject. The processing of DMD involves many legal issues; how to design participation procedures and disclosure procedures has become a challenge to whether the security impact assessment is clear and interpretable.

The core of these two procedures is to introduce specific parties to play an oversight role. Allowing patients or relevant stakeholders to express their opinions in the security impact assessment is a manifestation of procedural justice and democracy and can also restrain medical institutions. However, it is always faced with the problem of whether the security of processing activities can be guaranteed: The more participants, the more sensitive personal information can be leaked. Therefore, how to balance the relationship between confidentiality mechanisms and supervision needs to be clearly defined.

In terms of the content of DMD processing, attention should be paid to evaluating the impact on the personal rights and interests of patients and medical institutions, and based on this, to judge whether the protection measures of specific DMD can meet the requirements of legal, justified, and necessary principles. The treatment measures of patients’ medical institutions not only include technical measures such as de-identification technology and anonymity technology but also should pay attention to whether the medical institution itself has the compliance ability.

4. Identifying Public Interest Standards

According to the provisions of Article 1036 (3) of the Civil Code, ⁷⁵ the actor shall not bear civil liability if the information processing act is reasonably carried out to protect the public interest or the legitimate rights and interests of the natural person. According to Article 13 of the Personal Information Protection Law, “the processing is necessary to respond to public health emergencies or protect the life, health or property safety of natural persons under emergency circumstances” or “personal information is processed within a reasonable scope to conduct news reporting, public opinion-based supervision, or other activities in the public interest,” no individuals’ consents are required. Where the direct processing of DMD is required for public interest, personal information security impact assessment should not be carried out. Due to the lack of advance warning of security impact assessment, information processing activities in the name of public interest cannot be effectively supervised. Clarifying public interest standards is important for maintaining the security of DMD.

To determine the public interest standard is to determine when the public interest can breach the boundaries of individual information self-determination. DMD encompasses both personal and property interests, as well as private and public attributes. ⁷⁶ DMD in the era of AI is complex. Personal interests are the logical starting point for the protection of DMD, and public interests are also important stakeholders in personal information protection. Although personal interest and public interest are usually consistent with each other, there is some conflict between them. In some circumstances, personal interest may have to be sacrificed for common good; likewise, the self-determination of personal information may be sacrificed for the sake of public interest.

In public health events, grasping effective epidemic information in real time is an important guarantee for the smooth implementation of epidemic prevention and control. It is undoubtedly a great social burden to contact individuals one by one and obtain their informed consent. ⁷⁷ From the perspective of saving social costs, the provision of Article 13 of the Personal Information Protection Law has its justification. The superiority of public interests over personal interests is relative. No matter how DMD is utilized, the identity of patients should not be disclosed, otherwise the behavior of fulfilling public interests itself will be an act of violating citizens’ personal information.

The connotation and extension of public interest are not clear, and there are theoretical disputes. Some scholars think that public interest has characteristics of publicity and universality. It is the synthesis of the common parts of various interest groups, and it has the characteristics of the uncertainty of the number of subjects, the sharing of the entity, and the consistency of the interests. ⁷⁸ There are also views that public interests have broad but relative manifestations, which are related to the fundamental and inseparable overall interests of human beings, and the subject of public interest is universal, uncertain, and non-exclusive. ⁷⁹

We hold that publicness is the core element of public interest, and the standard of public interest can be developed around publicness. In the GDPR, the public interest is not a vague, indivisible whole concept, but is treated in a typed way. Some Chinese scholars have summarized the “public interest” in the GDPR and divided it into general public interest and important public interest. The general public interest is related to social goods such as employment, social security, medical purposes, scientific research, and statistical purposes. By contrast, the application of important public interest is necessary to detect epidemics and their spread and to respond to humanitarian emergencies. ⁸⁰ The important public interest and the general public interest of Article 13, paragraph 1, paragraphs 4 and 5 of the Personal Information Protection Act are to some extent similar to those of the GDPR.

Comparing “the processing is necessary to respond to public health emergencies or protect the life, health or property safety of natural persons under emergency circumstances” with “personal information is processed within a reasonable scope to conduct news reporting, public opinion-based supervision, or other activities in the public interest,” it can be found that the former is faced with a more-urgent crisis or infringement of life, health, or property safety of natural persons. Therefore, the former defines the exceptions from informed consent as “necessary,” while the latter is “reasonable scope.” The key to understanding “necessary” and “reasonable scope” is the principle of proportionality. First, public health emergencies should be comparable to emergencies that seriously threaten the life, health, and property safety of natural persons, both of which will cause social unrest and unhappiness. Second, public health emergencies and serious threats to the life and health of natural persons and property security should have different degrees. What needs to be prevented is to replace the concept of “necessary” with “reasonable scope.”

In terms of the specific definition of public interest, some scholars hold that when expert agencies or experts believe that public health emergencies will pose an urgent or significant threat to public health based on professional scientific knowledge, state organs can follow more relaxed procedures and substantive requirements in handling personal information. When such threats are weakened, state organs should follow more stringent requirements. ⁸¹ This viewpoint takes the expert opinion standard, and the results are highly dependent on the level of the individual experts.

We hold that China’s prosecutorial organs have the function of initiating public interest litigation against the violation of personal information, and the standard of public interest can be explored from the perspective of prosecutorial public interest litigation. From this perspective, the social public interest in the Personal Information Protection Law is divided into three levels, namely: the transformation of numerous individual interests to social public interests; the value of order and efficiency in the legal use of information and data; and that individuals become interest groups in need of special protection in the face of information handlers. These three levels constitute the three starting points of prosecutorial public interest litigation. ⁸² This public interest should be taken as a reference for the public interest in Article 13, paragraph 1, Item 5 of the Personal Information Protection Law. The strict nature of the prosecutorial public interest litigation system and the intelligence advantages of state organs have opened up a nationalistic protection path for personal information protection, which can effectively make up for the deficiencies of private law protection. ⁸³

1. Paying Particular Attention to Handling Specific Groups’ DMD

“The ethical risk connotation of emerging technologies focuses on the prediction and analysis of the potential negative effects of technologies. In essence, it is about perceiving complex and diverse ethical conflicts in the application of technologies.” ⁸⁴ Using art AI technology to process DMD, special attention should be paid to the security of DMD of special groups to avoid adverse consequences such as algorithm discrimination or algorithm decision-making errors. There are many reasons for algorithm discrimination. It may be that the data used for algorithm training itself has discriminatory elements, it may be that the algorithm developer integrates its own discriminatory position into the algorithm program, and it may be that the input data and output results of the algorithm are not interpretable. ⁸⁵ In the processing of DMD, which groups should be given special attention is not clear in the Information Security Technology—Guide For Health Data Security (GB/T 39725-2020).

Typically, factors such as gender, age, and medical conditions may be used to identify vulnerable groups. In this regard, the provisions of the Personal Information Protection Law are very simple. Article 31 of the law stipulates that “Where a personal information processor processes the personal information of a minor under the age of fourteen, it or he shall obtain the consent of the minor’s parents or other guardians. A personal information processor that processes the personal information of a minor under the age of fourteen shall develop special personal information processing rules.” The Personal Information Protection Law only provides special protection for minors, but ignores other socially vulnerable groups such as the elderly, women, people with disabilities, and patients with rare diseases, and the scope of protection is obviously insufficient.

First, the management system of DMD for special populations should be scientifically designed.

On the one hand, the law should clarify the scope of special groups in the processing of DMD, so as to strengthen their protection. To adapt to the structural changes in health care data and privacy interests, identifying the group dimensions included in privacy interests is an important attempt. ⁸⁶ Taking the DMD of the elderly as an example, the elderly are in the second half of their life, and their medical and health information has considerable research value. At the macrolevel, DMD of the elderly can be used to draw a population portrait, which is helpful for the country to timely adjust the direction of medical and health services for the elderly. At the microlevel, the analysis of DMD of the elderly can obtain information such as the disease situation of the elderly group, what drugs are usually needed to treat specific diseases, how many courses of treatment are needed, and how much money is needed. These data are necessary for accurate medical and health work.

On the other hand, DMD of special populations should be classified and managed. Information Security Technology—Guide For Health Data Security (GB/T 39725-2020) puts forward the requirements for data classification in “11.3 clinical research data security.” In the scenario of scientific research use, data can be divided into public data sets, restricted data sets, identifiable data sets, and other types. Different types of medical data of special populations should be classified into different data sets, and alternative management methods, use methods, and use permissions should be adopted.

Second, the processing of DMD for special populations should be aimed at aiding patients, and the data processing mode should be innovated appropriately according to local conditions. “Rare diseases refer to those with a very low prevalence rate, characterized mainly by genetics, severe conditions, difficult diagnosis and treatment, and high medical costs.” ⁸⁷ DMD related to rare diseases are specialized and valuable resources. The base of rare disease sufferers itself is small, and the channel of circulation of DMD related to rare disease patients is not smooth. The traditional legal framework for DMD cannot effectively meet the challenges of rare disease prevention and treatment. There are no unified sharing rules and standards for the distribution of DMD of rare disease patients, which leads to the increased risk of rare disease data being inappropriately processed or abused. This adds to the risk of rare disease patients suffering from data leakage or discrimination.

In this regard, some scholars believe that the data sharing model of rare diseases can be innovated through the way of data trust. ⁸⁸ The proposal of data trust is aimed at addressing the unbalanced power structure where individuals are unable to protect their data, and data controllers have absolute control over the data. ⁸⁹ There is a triangular structure of the principal, the trustee, and the beneficiary in the data trust. The principal entrusts the data to the trustee, the trustee with professional ability and obligations will process the data, and the beneficiary will benefit from it. For patients with rare diseases, the purpose of contributing their medical and health information is to see the hope of curing diseases. The data trust can promote data circulation, which is more conducive to the vital interests of patients with rare diseases.

2. Enhancing Accountability of Handling DMD

Chinese law stipulates criminal, administrative, and civil liability for the violation of personal information. For example, at the level of criminal responsibility, Criminal Law stipulates the crime of violating citizens’ personal information. ⁹⁰ Criminal Law regulates the act of selling, providing, stealing, or otherwise illegally obtaining citizens’ personal information. Criminal Law gives heavier punishment to those who sell or provide personal information obtained in the course of performing their official duties or providing services.

At the level of administrative responsibility, Article 66 of the Personal Information Protection Law stipulates administrative liability. ⁹¹

If the security of DMD itself is considered, the relevant responsibilities are also administrative responsibilities under the Data Security Act. At the level of civil liability, Article 69 ⁹² of the Personal Information Protection Law and Article 1226 ⁹³ of the Civil Code stipulate tort liability.

To strengthen the accountability of the improper processing of DMD, government departments need to improve the inspection of illegal acts and strengthen the awareness of rights protection of information subjects. The community has a deep understanding of the harm from illegal processing of DMD. The reason for the difficulty in accountability for the illegal processing of DMD is that the illegality of DMD processing is difficult to find. The only part of DMD processing that patients can access may be the informed consent decision made at the time of visiting a doctor. Patients do not know the likely destination or potential use of patients’ DMD. It is unrealistic and irresponsible to assign the responsibility for finding illegal facts to patients themselves. It is most appropriate for administrative departments to increase the supervision of DMD to investigate legal responsibilities. Fundamentally speaking, the ability and cost of administrative agencies to detect illegal data processing behaviors are much stronger than those of natural persons.

For individuals, they should also strengthen their legal awareness, attempt to find out in time that their medical and health information has been processed illegally, and likewise act to protect their rights in a timely fashion. In China, an incident known as the “first case of face recognition” is a controversy resulting when Hangzhou citizen Guo Bing found that Hangzhou Wildlife World had converted his fingerprint information from a membership card to face recognition. The Primary People’s Court of Fuyang District of Hangzhou City ordered Wildlife World to delete the facial information submitted by Guo Bing when he applied for an annual card. The Hangzhou Intermediate People’s Court ordered Wildlife World to delete Guo Bing’s fingerprint identification information based on the original judgment. ⁹⁴ The case was subsequently selected as 1 of the top 10 cases of the People’s Courts of China in 2021.