Processing of personal health data in the era of “AI plus Healthcare”: challenges and solutions in China

Abstract In the era of “AI plus healthcare”, personal health data has shifted from static records into dynamic and time-sequential data flow covering a full lifecycle. While it has become an important element of production in healthcare industry, it also faces new risks and challenges and the current legal framework of personal health data protection in China cannot satisfactorily address these challenges. The ambiguous rules on personal health data ownership and the ineffective individual empowerment model of data governance fail to respond to the dual needs for protection of personal health data and extraction of data value. In view of diversified and sometimes conflicting values and interests embodied in personal health data, it is therefore recommended that the agile governance model, characterized by dynamic adaptability and multistakeholders collaboration, be adopted. The bundle of rights over data should be allocated among data subjects, data processors and the government; a differentiated consent mechanism based on risk classification should be constructed; the principle of purpose limitation and minimum necessary should be reinterpreted in an expansive and generalized manner within the limits of reasonable expectation and risk control; and, anonymization measures and tort liability rules should be improved by clarifying obligations of stakeholders and balancing their rights and responsibilities. Through dynamic risk control by collaboration of multiple stakeholders, the agile governance model can reach the balance between sufficient protection and rational utilization of personal health data in data processing.